# ADLBiLSTM: A Semantic Generation Algorithm for Multi-Grammar Network Access Control Policies
## 3 The Semantic Generation Algorithm  
Current semantic generation methods mainly rely on compilers, which are typically only suitable for a single grammar or single vendor and require manual configuration. Therefore, they are difficult to adapt to environments with multiple grammar configurations. However, natural language processing has made significant progress in dealing with unstructured data, as it can convert unstructured text into structured data, enabling further utilization of these data. This is consistent with the goals we need to achieve in our task. Therefore, we can consider utilizing natural language processing techniques to design improved semantic generation methods and better adapt them to environments with multiple grammar configurations.  
In this section, we present our proposed model, named ADLBiLSTM. The proposed model is shown in Figure 1 and can be divided into three layers based on the bottom-up function, which are the self-attention layer, the DL-BiLSTM layer and the CRF layer. Firstly, the self-attention layer is used to capture the correlation between the input vectors \(a_{i}\) (\(a_{i}\) is obtained from input after word embedding) and weights the original inputs; the output \(x_{i}\) is a rule that combines the importance of the whole utterance, and \(x_{i}\) serves as the input to the next DL-BiLSTM layer. Then, the DL-BiLSTM layer obtains the contextual features from the input vector \(x_{i}\) and computes the score matrix of the labels input to the next layer. Finally, the score matrix is used as an input to the CRF layer for joint training with the feature scores of the CRF layer to restrict the label range to obtain the final label output. The final output of the model is the semantics of the input security policy.  
To illustrate more specifically how this model can be applied to the semantic generation of security policies, we can use the ACL statement \"access-list acl extended permit tcp any 2.178.0.0 0.0.0.255\" as an example. This statement defines an access control rule that permits TCP traffic from any source address (\"any\") to the IP address range 2.178.0.0 /24 (defined by the IP address 2.178.0.0 and subnet mask 0.0.0.255).  
When we input this ACL statement into the ADLBiLSTM model, the model first converts the text into vector representations through word embeddings. Then, the self-attention layer captures the correlations between these vectors (e.g., the association between \"permit tcp any 2.178.0.0\"), and weights the original input, where in this case, permit and tcp have higher importance, followed by \"any 2.178.0.0 0.0.0.255\". Next, the DL-BiLSTM layer extracts contextual features from the weighted inputs and calculates a score matrix for labels, which will compute the label scores for each word in the security policy. Finally, the CRF layer performs joint training based on the score matrix and its own feature scores, outputting the final label sequence. This layer considers not only the final semantic generation result but also whether the semantics are reasonable. For example, in this case, it learns that the statement is valid when \"any\" represents the source address (sub_network) and 2.178.0.0 represents the destination address (obj_network_netadd).  
These three layers are described in detail below.