I2NSF NSF monitoring YANG data model

A processor-implemented method for a security controller comprising a processor to monitor in an Interface to Network Security Functions (I2NSF) system, the method comprising:

• receiving, by the processor, a first security policy of a high-level from an I2NSF user via a consumer-facing interface, the first security policy including a policy triggered in a specific event occurring in the I2NSF;
• translating, by the processor, the first security policy into a second security policy of a low-level;
• transmitting, by the processor, to a Network Security Function (NSF), a packet including the second security policy, for configuring the second security policy to the NSF;
• and
• receiving, by the processor, monitoring data from the NSF via an NSF monitoring interface,
• wherein an information model of the monitoring data for the NSF specifies a list of events that can trigger event-condition-action (ECA) policy,
• wherein the ECA policy represents a model for designing a policy rule of the I2NSF system,
• wherein the policy rule of the I2NSF system includes an event clause related to a change in a system, a condition clause for determining whether the policy rule of the I2NSF system can be executed or not, and an action clause being used to control and monitor aspects of the NSF to handle packets or flows when the event clause and the condition clause are satisfied, and
• wherein the monitoring data includes time stamp information, a vendor name, an NSF name, and severity indicating a level of a log.