SYSTEM AND METHOD FOR APPLYING RULE SETS AND RULE INTERACTIONS

• US 20090327198A1
• Filed: 09/03/2009
• Published: 12/31/2009
• Est. Priority Date: 10/12/2005
• Status: Active Grant

• Current Assignee: Marlow Technologies, Llc
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Farah, Jeffrey
• Granted Patent: US 7,844,563 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06N 5/025 Extracting rules from data
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

Described is a system and method for determining relationships between a plurality of existing rules in a rule set, wherein the relationships include cause interactions and effect interactions among the existing rules, creating a representation of the relationships including the cause interactions and effect interactions, receiving a new rule to be inserted into the rule set and determining if a conflict is created by insertion of the new rule in the rule set.

Claims

1. A method, comprising:

determining relationships between a plurality of existing rules in a rule set of a firewall used to screen the incoming data of the network, wherein the relationships include cause interactions and effect interactions among the existing rules;

creating a representation of the relationships including the cause interactions and effect interactions;

receiving a new rule to be inserted into the rule set;

inserting further relationships between the new rule and the existing rules into the representation to create a modified representation; and

determining, based on the modified representation, if a conflict is created by insertion of the new rule in the rule set.

2. The method of claim 1, wherein the determining of the conflict includes:

determining further cause interactions and further effect interactions of the new rule with the existing rules.

3. The method of claim 1, further comprising:

adding the new rule to the rule set when the new rule can be added without conflict.

4. The method of claim 1, wherein the rule set includes parameters used to determine when the rule set is invoked.

5. The method of claim 1, wherein each rule of the rule set is placed with a cause and effect pairing making a rule node to create the cause interactions and effect interactions.

6. The method of claim 1, wherein the representation is a di-graph.

7. The method of claim 6, wherein the di-graph includes vertices where each vertex represents a rule of the rule set and the effects.

8. The method of claim 6, wherein the di-graph includes arcs where each arc represents one of the cause interactions and the effect interactions.

9. The method of claim 1, wherein the new rule is a change to one of the existing rules.

10. The method of claim 1, further comprising:

indicating the conflict created by the new rule with the existing rules.

11. The method of claim 1, further comprising:

suggesting, when the conflict is identified, a new replacement for the new rule within the rule set.

12. The method of claim 1, wherein the representation is provided in a visual format.

13. A system for screening incoming data of a network, comprising:

means for determining relationships between a plurality of existing rules in a rule set of a firewall used to screen the incoming data of the network, wherein the relationships include cause interactions and effect interactions among the existing rules;

means for creating a representation of the relationships including the cause interactions and effect interactions;

means for receiving a new rule to be inserted into the rule set;

means for inserting further relationships between the new rule and the existing rules into the representation to create a modified representation; and

means for determining, based on the modified representation, if a conflict is created by insertion of the new rule in the rule set.

14. The system of claim 13, wherein the means for determining of the conflict determines further cause interactions and further effect interactions of the new rule with the existing rules.

15. The system of claim 13, further comprising:

means for adding the new rule to the rule set when the new rule can be added without conflict.

16. The system of claim 13, wherein the rule set includes parameters used to determine when the rule set is invoked.

17. The system of claim 13, wherein each rule of the rule set is placed with a cause and effect pairing making a rule node to create the cause interactions and effect interactions.

18. The system of claim 13, wherein the representation is a di-graph.

19. The system of claim 18, wherein the di-graph includes vertices where each vertex represents a rule of the rule set and the effects.

20. The system of claim 18, wherein the di-graph includes arcs where each arc represents one of the cause interactions and the effect interactions.