NetTwin.
Trust the policy. Verify the packets.
Adversarial network verification that checks what a firewall actually does against what its policy promises.
The problem
Verify expected access decisions against actual TCP/UDP packet behavior and detect unintended access expansion from firewall-rule changes.
The approach
- Translated ordered ACL policies into Linux nftables rules and validated them in isolated network namespaces.
- Used boundary-aware adversarial test generation to identify policy deviations missed by baseline assertions.
- Built a mutation-based evaluation framework with seven policy mutation operators.
System architecture
Results & evidence
- Validated 43/43 real-firewall test cases across guest isolation, enterprise segmentation, and cloud microservices.
- Increased observable security-mutation detection recall from 33.3% to 100% (+66.7 percentage points) across 39 observable mutants.
- Collected rule-level packet counters and expected-versus-observed decision evidence.
What I’d change
My next priority is to evolve NetTwin from a benchmark-based research prototype into a scalable, automated network security verification tool. I plan to focus on importing real firewall configurations, automatically generating adversarial security tests, and validating network policies against actual Linux packet behavior. The goal is to make NetTwin practical for complex enterprise and telecom networks while preserving measurable, reproducible verification results.