natural-language-to-security-policy.ipynb

{"metadata":{"kernelspec":{"language":"python","display_name":"Python 3","name":"python3"},"language_info":{"name":"python","version":"3.10.14","mimetype":"text/x-python","codemirror_mode":{"name":"ipython","version":3},"pygments_lexer":"ipython3","nbconvert_exporter":"python","file_extension":".py"},"kaggle":{"accelerator":"none","dataSources":[],"dockerImageVersionId":30804,"isInternetEnabled":true,"language":"python","sourceType":"notebook","isGpuEnabled":false}},"nbformat_minor":4,"nbformat":4,"cells":[{"cell_type":"code","source":"!pip install openai","metadata":{"_uuid":"8f2839f25d086af736a60e9eeb907d3b93b6e0e5","_cell_guid":"b1076dfc-b9ad-4769-8c92-a6c4dae69d19","trusted":true,"execution":{"iopub.status.busy":"2024-12-05T08:05:47.803512Z","iopub.execute_input":"2024-12-05T08:05:47.803936Z","iopub.status.idle":"2024-12-05T08:05:59.943373Z","shell.execute_reply.started":"2024-12-05T08:05:47.803884Z","shell.execute_reply":"2024-12-05T08:05:59.942392Z"}},"outputs":[{"name":"stdout","text":"Collecting openai\n  Downloading openai-1.56.2-py3-none-any.whl.metadata (24 kB)\nRequirement already satisfied: anyio<5,>=3.5.0 in /opt/conda/lib/python3.10/site-packages (from openai) (4.4.0)\nRequirement already satisfied: distro<2,>=1.7.0 in /opt/conda/lib/python3.10/site-packages (from openai) (1.9.0)\nRequirement already satisfied: httpx<1,>=0.23.0 in /opt/conda/lib/python3.10/site-packages (from openai) (0.27.0)\nCollecting jiter<1,>=0.4.0 (from openai)\n  Downloading jiter-0.8.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.metadata (5.2 kB)\nRequirement already satisfied: pydantic<3,>=1.9.0 in /opt/conda/lib/python3.10/site-packages (from openai) (2.10.2)\nRequirement already satisfied: sniffio in /opt/conda/lib/python3.10/site-packages (from openai) (1.3.1)\nRequirement already satisfied: tqdm>4 in /opt/conda/lib/python3.10/site-packages (from openai) (4.66.4)\nRequirement already satisfied: typing-extensions<5,>=4.11 in /opt/conda/lib/python3.10/site-packages (from openai) (4.12.2)\nRequirement already satisfied: idna>=2.8 in /opt/conda/lib/python3.10/site-packages (from anyio<5,>=3.5.0->openai) (3.7)\nRequirement already satisfied: exceptiongroup>=1.0.2 in /opt/conda/lib/python3.10/site-packages (from anyio<5,>=3.5.0->openai) (1.2.0)\nRequirement already satisfied: certifi in /opt/conda/lib/python3.10/site-packages (from httpx<1,>=0.23.0->openai) (2024.6.2)\nRequirement already satisfied: httpcore==1.* in /opt/conda/lib/python3.10/site-packages (from httpx<1,>=0.23.0->openai) (1.0.5)\nRequirement already satisfied: h11<0.15,>=0.13 in /opt/conda/lib/python3.10/site-packages (from httpcore==1.*->httpx<1,>=0.23.0->openai) (0.14.0)\nRequirement already satisfied: annotated-types>=0.6.0 in /opt/conda/lib/python3.10/site-packages (from pydantic<3,>=1.9.0->openai) (0.7.0)\nRequirement already satisfied: pydantic-core==2.27.1 in /opt/conda/lib/python3.10/site-packages (from pydantic<3,>=1.9.0->openai) (2.27.1)\nDownloading openai-1.56.2-py3-none-any.whl (389 kB)\n\u001b[2K   \u001b[90m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\u001b[0m \u001b[32m389.9/389.9 kB\u001b[0m \u001b[31m8.0 MB/s\u001b[0m eta \u001b[36m0:00:00\u001b[0m:00:01\u001b[0m\n\u001b[?25hDownloading jiter-0.8.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (343 kB)\n\u001b[2K   \u001b[90m━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\u001b[0m \u001b[32m343.6/343.6 kB\u001b[0m \u001b[31m20.6 MB/s\u001b[0m eta \u001b[36m0:00:00\u001b[0m\n\u001b[?25hInstalling collected packages: jiter, openai\nSuccessfully installed jiter-0.8.0 openai-1.56.2\n","output_type":"stream"}],"execution_count":1},{"cell_type":"code","source":"from kaggle_secrets import UserSecretsClient\nuser_secrets = UserSecretsClient()\nOPENAI_API_KEY = user_secrets.get_secret(\"Open_AI\")","metadata":{"trusted":true,"execution":{"iopub.status.busy":"2024-12-05T08:05:59.945734Z","iopub.execute_input":"2024-12-05T08:05:59.946747Z","iopub.status.idle":"2024-12-05T08:06:00.236680Z","shell.execute_reply.started":"2024-12-05T08:05:59.946695Z","shell.execute_reply":"2024-12-05T08:06:00.235716Z"}},"outputs":[],"execution_count":2},{"cell_type":"code","source":"import openai\n\nopenai.api_key = OPENAI_API_KEY\nmodel = \"gpt-4o-mini\"\n\ndef generate_policy(policy_text, model=\"gpt-4o-mini\"):\n    \"\"\"\n    Converts natural language policy into an XML security policy.\n    Includes an example and IETF draft content for context.\n    \"\"\"\n    # Examples to guide the model\n    example_input1 = \"Block my son's computers from malicious websites.\"\n    example_output1 = \"\"\"\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cfi-policy\">\n    <name>block_web_security_policy</name>\n    <rules>\n        <name>block_web</name>\n        <condition>\n            <firewall-condition>\n                <source>Son's_PC</source>\n            </firewall-condition>\n            <url-condition>\n                <url-name>malicious_websites</url-name>\n            </url-condition>\n        </condition>\n        <actions>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </actions>\n    </rules>\n</i2nsf-cfi-policy>\n    \"\"\"\n\n    example_input2 = \"Block malicious VoIP/VoCN packets coming to a company.\"\n    example_output2 = \"\"\"\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cons-facing-interface\">\n    <name>\n        security_policy_for_blocking_malicious_voip_packets\n    </name>\n    <rules>\n        <name>Block_malicious_voip_and_vocn_packets</name>\n        <condition>\n            <voice>\n                <source-id>malicious-id</source-id>\n            </voice>\n            <firewall>\n                <destination>employees</destination>\n            </firewall>\n        </condition>\n        <action>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </action>\n    </rules>\n</i2nsf-cfi-policy>\n    \"\"\"\n\n    example_input3 = \"Mitigate flood attacks on a company web server.\"\n    example_output3 = \"\"\"\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cons-facing-interface\">\n    <name>security_policy_for_ddos_attacks</name>\n    <rules>\n        <name>1000_packets_per_second</name>\n        <condition>\n            <firewall>\n                <destination>webservers</destination>\n            </firewall>\n            <ddos>\n                <rate-limit>\n                    <packet-rate-threshold>1000</packet-rate-threshold>\n                </rate-limit>\n            </ddos>\n        </condition>\n        <action>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </action>\n    </rules>\n</i2nsf-cfi-policy>\n    \"\"\"\n\n    # Load additional context from I2NSF's official IETF draft\n    ietf_context = \"\"\"\n    The I2NSF schema follows an Event-Condition-Action (ECA) model. XML policies can have the following headers:\n    \n  +--rw i2nsf-cfi-policy* [name]\n  |  +--rw name                   string\n  |  +--rw language?              string\n  |  +--rw priority-usage?        identityref\n  |  +--rw resolution-strategy?   identityref\n  |  +--rw rules* [name]\n     |  +--rw name         string\n     |  +--rw priority?    uint8\n     |  +--rw event\n     |  |  +--rw system-event*   identityref\n     |  |  +--rw system-alarm*   identityref \n     |  +--rw condition\n\t |\t|  +--rw firewall\n\t\t |  |  +--rw source*                     union\n\t\t |  |  +--rw destination*                union\n\t\t |  |  +--rw transport-layer-protocol?   identityref\n\t\t |  |  +--rw range-port-number* [start end]\n\t\t |  |  |  +--rw start    inet:port-number\n\t\t |  |  |  +--rw end      inet:port-number\n\t\t |  |  +--rw icmp\n\t\t |  |     +--rw message*   identityref\n\t |\t|  +--rw ddos\n\t\t |  |  +--rw rate-limit\n\t\t |  |     +--rw packet-rate-threshold?   uint64\n\t\t |  |     +--rw byte-rate-threshold?     uint64\n\t\t |  |     +--rw flow-rate-threshold?     uint64\n\t |\t|  +--rw anti-virus\n\t\t |  |  +--rw profile*   string\n\t\t |  |  +--rw exception-files*   string\n\t |\t|  +--rw payload\n\t\t |  |  +--rw content*   -> /threat-prevention/payload-content/name\n\t |\t|  +--rw url-category\n\t\t |  |  +--rw url-name?   -> /endpoint-groups/url-group/name\n\t |\t|  +--rw voice\n\t\t |  |  +--rw source-id*        -> /endpoint-groups/voice-group/name\n\t\t |  |  +--rw destination-id*   -> /endpoint-groups/voice-group/name\n\t\t |  |  +--rw user-agent*       string\n\t |  |  +--rw context\n\t\t |  |  +--rw time\n\t\t |  |  |  +--rw start-date-time?   yang:date-and-time\n\t\t |  |  |  +--rw end-date-time?     yang:date-and-time\n\t\t |  |  |  +--rw period\n\t\t |  |  |  |  +--rw start-time?   time\n\t\t |  |  |  |  +--rw end-time?     time\n\t\t |  |  |  |  +--rw day*          day\n\t\t |  |  |  |  +--rw date*         int8\n\t\t |  |  |  |  +--rw month* [start end]\n\t\t |  |  |  |     +--rw start    string\n\t\t |  |  |  |     +--rw end      string\n\t\t |  |  |  +--rw frequency?         enumeration\n\t\t |  |  +--rw application\n\t\t |  |  |  +--rw protocol*   identityref\n\t\t |  |  +--rw device-type\n\t\t |  |  |  +--rw device*   identityref\n\t\t |  |  +--rw users\n\t\t |  |  |  +--rw user* [id]\n\t\t |  |  |  |  +--rw id      uint32\n\t\t |  |  |  |  +--rw name?   string\n\t\t |  |  |  +--rw group* [id]\n\t\t |  |  |     +--rw id      uint32\n\t\t |  |  |     +--rw name?   string\n\t\t |  |  +--rw geographic-location\n\t\t |  |     +--rw source\n\t\t |  |     |  +--rw country?   -> /endpoint-groups/location-group/country\n\t\t |  |     |  +--rw region?    -> /endpoint-groups/location-group/region\n\t\t |  |     |  +--rw city?      -> /endpoint-groups/location-group/city\n\t\t |  |     +--rw destination\n\t\t |  |        +--rw country?   -> /endpoint-groups/location-group/country\n\t\t |  |        +--rw region?    -> /endpoint-groups/location-group/region\n\t\t |  |        +--rw city?      -> /endpoint-groups/location-group/city\n\t |  |  +--rw threat-feed\n\t\t |  |  +--rw name*   -> /threat-prevention/threat-feed-list/name\n     |  +--rw action\n\t |  |  +--rw primary-action\n\t\t |\t|  +--rw action    identityref\n\t\t |\t|  +--rw limit?    decimal64\n\t |\t|  +--rw secondary-action\n         |\t|  +--rw log-action?   identityref\n\t +--rw endpoint-groups\n\t |  +--rw user-group* [name]\n\t |  |  +--rw name                              string\n\t |     +--rw mac-address*                      yang:mac-address\n\t |     +--rw (match-type)\n\t\t |     +--:(ipv4)\n\t\t |     |  +--rw (ipv4-range-or-prefix)?\n\t\t |     |     +--:(prefix)\n\t\t |     |     |  +--rw ipv4-prefix*          inet:ipv4-prefix\n\t\t |     |     +--:(range)\n\t\t |     |        +--rw range-ipv4-address* [start end]\n\t\t |     |           +--rw start    inet:ipv4-address-no-zone\n\t\t |     |           +--rw end      inet:ipv4-address-no-zone\n\t\t |     +--:(ipv6)\n\t\t |        +--rw (ipv6-range-or-prefix)?\n\t\t |           +--:(prefix)\n\t\t |           |  +--rw ipv6-prefix*          inet:ipv6-prefix\n\t\t |           +--:(range)\n\t\t |              +--rw range-ipv6-address* [start end]\n\t\t |                 +--rw start    inet:ipv6-address-no-zone\n\t\t |                 +--rw end      inet:ipv6-address-no-zone\n\t |  +--rw device-group* [name]\n\t |  |  +--rw name                              string\n\t\t|  +--rw (match-type)\n\t\t |  |  +--:(ipv4)\n\t\t |  |  |  +--rw (ipv4-range-or-prefix)?\n\t\t |  |  |     +--:(prefix)\n\t\t |  |  |     |  +--rw ipv4-prefix*          inet:ipv4-prefix\n\t\t |  |  |     +--:(range)\n\t\t |  |  |        +--rw range-ipv4-address* [start end]\n\t\t |  |  |           +--rw start    inet:ipv4-address-no-zone\n\t\t |  |  |           +--rw end      inet:ipv4-address-no-zone\n\t\t |  |  +--:(ipv6)\n\t\t |  |     +--rw (ipv6-range-or-prefix)?\n\t\t |  |        +--:(prefix)\n\t\t |  |        |  +--rw ipv6-prefix*          inet:ipv6-prefix\n\t\t |  |        +--:(range)\n\t\t |  |           +--rw range-ipv6-address* [start end]\n\t\t |  |              +--rw start    inet:ipv6-address-no-zone\n\t\t |  |              +--rw end      inet:ipv6-address-no-zone\n\t\t|  +--rw application-protocol*             identityref\n\t |  +--rw location-group* [country region city]\n\t |  |  +--rw country                           string\n\t\t|  +--rw region                            string\n\t\t|  +--rw city                              string\n\t\t|  +--rw (match-type)\n\t\t |     +--:(ipv4)\n\t\t |     |  +--rw (ipv4-range-or-prefix)?\n\t\t |     |     +--:(prefix)\n\t\t |     |     |  +--rw ipv4-prefix*          inet:ipv4-prefix\n\t\t |     |     +--:(range)\n\t\t |     |        +--rw range-ipv4-address* [start end]\n\t\t |     |           +--rw start    inet:ipv4-address-no-zone\n\t\t |     |           +--rw end      inet:ipv4-address-no-zone\n\t\t |     +--:(ipv6)\n\t\t |        +--rw (ipv6-range-or-prefix)?\n\t\t |           +--:(prefix)\n\t\t |           |  +--rw ipv6-prefix*          inet:ipv6-prefix\n\t\t |           +--:(range)\n\t\t |              +--rw range-ipv6-address* [start end]\n\t\t |                 +--rw start    inet:ipv6-address-no-zone\n\t\t |                 +--rw end      inet:ipv6-address-no-zone\n\t |  +--rw url-group* [name]\n\t |  |  +--rw name    string\n\t |\t|  +--rw url*    inet:uri\n\t |  +--rw voice-group* [name]\n\t |  |  +--rw name      string\n\t |  |  +--rw sip-id*   inet:uri\n\t +--rw threat-prevention\n     |  |  +--rw name      string\n     |  |  +--rw ioc*      string\n     |  |  +--rw format    identityref\n\n\n    \"\"\"\n\n    # Combine all elements into the prompt\n    prompt = f\"\"\"\n    You are an expert in XML schema and I2NSF security policies. Convert the following natural language input into an XML security policy compliant with the I2NSF schema. Use the Event-Condition-Action (ECA) format and ensure the XML is valid. Use the provided example and format as context. Try to add the appropiate header to the XML depending of the needs of the user.\n\n    Here is a few examples for reference:\n    Input: {example_input1}\n    Output: {example_output1}\n\n    Input: {example_input2}\n    Output: {example_output2}\n\n    Input: {example_input3}\n    Output: {example_output3}\n\n    Additional Context:\n    {ietf_context}\n\n    Now, generate the XML for the following input:\n    Input: {policy_text}\n\n    Output:\n    \"\"\"\n    \n    response = openai.chat.completions.create(\n        model=model,\n        messages=[\n            {\"role\": \"system\", \"content\": \"You are an XML schema and I2NSF policy expert.\"},\n            {\"role\": \"user\", \"content\": prompt}\n        ]\n    )\n    \n    return response.choices[0].message.content\n\n# Example usage\npolicy_text = \"Block packets coming from Buenos Aires, Argentina but allow packets coming from Lima, Peru.\"\nxml_policy = generate_policy(policy_text, model)\n\nprint(\"Generated XML Policy:\")\nprint(xml_policy)\n","metadata":{"trusted":true,"execution":{"iopub.status.busy":"2024-12-05T08:06:00.238127Z","iopub.execute_input":"2024-12-05T08:06:00.238478Z","iopub.status.idle":"2024-12-05T08:06:06.916250Z","shell.execute_reply.started":"2024-12-05T08:06:00.238431Z","shell.execute_reply":"2024-12-05T08:06:06.915253Z"}},"outputs":[{"name":"stdout","text":"Generated XML Policy:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cfi-policy\">\n    <name>block_packets_from_buenos_aires_allow_lima</name>\n    <rules>\n        <name>Block_packets_from_Buenos_Aires</name>\n        <condition>\n            <firewall>\n                <source>\n                    <geographic-location>\n                        <source>\n                            <country>Argentina</country>\n                            <city>Buenos Aires</city>\n                        </source>\n                    </geographic-location>\n                </source>\n            </firewall>\n        </condition>\n        <actions>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </actions>\n    </rules>\n    <rules>\n        <name>Allow_packets_from_Lima</name>\n        <condition>\n            <firewall>\n                <source>\n                    <geographic-location>\n                        <source>\n                            <country>Peru</country>\n                            <city>Lima</city>\n                        </source>\n                    </geographic-location>\n                </source>\n            </firewall>\n        </condition>\n        <actions>\n            <primary-action>\n                <action>allow</action>\n            </primary-action>\n        </actions>\n    </rules>\n</i2nsf-cfi-policy>\n```\n","output_type":"stream"}],"execution_count":3},{"cell_type":"markdown","source":"# Examples","metadata":{}},{"cell_type":"markdown","source":"## INPUT: \"Block SNS access during office hours with a weekly frequency (9am-5pm; Monday-Friday)\"","metadata":{}},{"cell_type":"markdown","source":"Generated XML Policy:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cfi-policy\">\n    <name>block_sns_access_during_office_hours</name>\n    <rules>\n        <name>block_sns_access</name>\n        <condition>\n            <time>\n                <frequency>weekly</frequency>\n                <period>\n                    <start-time>09:00</start-time>\n                    <end-time>17:00</end-time>\n                    <day>Monday</day>\n                    <day>Tuesday</day>\n                    <day>Wednesday</day>\n                    <day>Thursday</day>\n                    <day>Friday</day>\n                </period>\n            </time>\n            <url-category>\n                <url-name>SNS</url-name>\n            </url-category>\n        </condition>\n        <actions>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </actions>\n    </rules>\n</i2nsf-cfi-policy>\n```","metadata":{}},{"cell_type":"markdown","source":"## INPUT: \"Block access to Youtube, X and Instagram during school hours to all PCs within 128.0.0.0-128.0.0.255 IPv4 ranges.\"","metadata":{}},{"cell_type":"markdown","source":"Generated XML Policy:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cfi-policy\">\n    <name>block_social_media_during_school_hours</name>\n    <rules>\n        <name>Block_youtube_x_instagram</name>\n        <condition>\n            <firewall>\n                <source>\n                    <range-ipv4-address>\n                        <start>128.0.0.0</start>\n                        <end>128.0.0.255</end>\n                    </range-ipv4-address>\n                </source>\n            </firewall>\n            <url-category>\n                <url-name>Youtube</url-name>\n            </url-category>\n            <url-category>\n                <url-name>X</url-name>\n            </url-category>\n            <url-category>\n                <url-name>Instagram</url-name>\n            </url-category>\n            <context>\n                <time>\n                    <period>\n                        <start-time>08:00:00</start-time>\n                        <end-time>15:00:00</end-time>\n                    </period>\n                </time>\n            </context>\n        </condition>\n        <actions>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </actions>\n    </rules>\n</i2nsf-cfi-policy>\n```","metadata":{}},{"cell_type":"markdown","source":"## INPUT: \"Block packets coming from Buenos Aires, Argentina but allow packets coming from Lima, Peru.\"","metadata":{}},{"cell_type":"markdown","source":"Generated XML Policy:\n```xml\n<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n<i2nsf-cfi-policy\n    xmlns=\"urn:ietf:params:xml:ns:yang:ietf-i2nsf-cfi-policy\">\n    <name>block_packets_buenos_aires_allow_lima</name>\n    <rules>\n        <name>block_buenos_aires_packets</name>\n        <condition>\n            <firewall>\n                <source>\n                    <geographic-location>\n                        <source>\n                            <country>Argentina</country>\n                            <city>Buenos Aires</city>\n                        </source>\n                    </geographic-location>\n                </source>\n            </firewall>\n        </condition>\n        <action>\n            <primary-action>\n                <action>drop</action>\n            </primary-action>\n        </action>\n    </rules>\n    <rules>\n        <name>allow_lima_packets</name>\n        <condition>\n            <firewall>\n                <source>\n                    <geographic-location>\n                        <source>\n                            <country>Peru</country>\n                            <city>Lima</city>\n                        </source>\n                    </geographic-location>\n                </source>\n            </firewall>\n        </condition>\n        <action>\n            <primary-action>\n                <action>allow</action>\n            </primary-action>\n        </action>\n    </rules>\n</i2nsf-cfi-policy>\n```","metadata":{}}]}