Method and apparatus for optimizing a firewall

• US 20080005795A1
• Filed: 06/30/2006
• Published: 01/03/2008
• Est. Priority Date: 06/30/2006
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Wang, Jia, Acharya, Subrata, Greenberg, Albert Gordon, Ge, Zihui
• Granted Patent: US 7,966,655 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

Disclosed is a method and system for optimizing a first set of rules enforced by a firewall on network traffic. Characteristics of the network traffic are examined and these characteristics are used to generate a second set of rules. The first set of rules may have a different order than the second set of rules.

Claims

1. A method for optimizing a first set of rules enforced by a firewall receiving network traffic, said method comprising:

examining characteristics of said network traffic; and

automatically generating a second set of rules based on said examining.

2. The method of claim 1 further comprising enforcing, by said firewall, said second set of rules on said network traffic.

3. The method of claim 1 further comprising removing redundancies in said first set of rules.

4. The method of claim 1 further comprising generating a disjoint rule set from said first set of rules.

5. The method of claim 4 further comprising removing dependencies from said first set of rules.

6. The method of claim 5 further comprising creating new rules.

7. The method of claim 4 further comprising merging rules to generate a rule set based optimized set of rules.

8. The method of claim 7 wherein said generating a second set of rules further comprises performing at least one of hot caching, total reordering, default proxy, and online adaptation on said rule set based optimized set of rules.

9. The method of claim 8 wherein said performing online adaptation further comprises performing at least one of profile based reordering and anomaly detection and countermeasure.

10. The method of claim 1 wherein said second set of rules has a different order than said first set of rules.

11. A firewall enforcing a first set of rules on network traffic received by said firewall, said firewall comprising:

a traffic based optimizer configured to examine characteristics of said network traffic and automatically generate a second set of rules based on said examining,

said firewall configured to enforce said second set of rules on said network traffic.

12. The firewall of claim 11 further comprising a rule set based optimizer configured to remove redundancies in said first set of rules.

13. The firewall of claim 11 further comprising a rule set based optimizer configured to generate a disjoint rule set from said first set of rules.

14. The firewall of claim 13 wherein said rule set based optimizer is configured to remove dependencies from said first set of rules.

15. The firewall of claim 13 wherein said rule set based optimizer is configured to create new rules.

16. The firewall of claim 13 wherein said rule set based optimizer is configured to merge rules to generate a rule set based optimized set of rules.

17. The firewall of claim 16 wherein said traffic based optimizer is configured to perform at least one of hot caching, total reordering, default proxy, and online adaptation on said rule set based optimized set of rules to generate said second set of rules.

18. The firewall of claim 17 wherein said traffic based optimizer is configured to perform at least one of profile based reordering and anomaly detection and countermeasure on said rule set based optimized set of rules to generate said second set of rules.

19. The firewall of claim 11 wherein said first set of rules has a different order than said second set of rules.

20. A firewall enforcing a first set of rules on network traffic received by said firewall, said firewall comprising:

means for examining characteristics of said network traffic; and

means for automatically generating a second set of rules based on said examining.

21. The firewall of claim 20 further comprising means for removing redundancies in said first set of rules.

22. The firewall of claim 20 further comprising means for generating a disjoint rule set from said first set of rules.

23. The firewall of claim 22 further comprising means for removing dependencies from said first set of rules.

24. The firewall of claim 23 further comprising means for creating new rules.

25. The firewall of claim 22 further comprising means for merging rules to generate a rule set based optimized set of rules.

26. The firewall of claim 25 wherein said means for optimizing further comprises means for performing at least one of hot caching, total reordering, default proxy, and online adaptation on said rule set based optimized set of rules to generate said second set of rules.

27. The firewall of claim 26 wherein said means for performing online adaptation further comprises means for performing at least one of profile based reordering and anomaly detection and countermeasure.