Automated policy builder

• US 8,959,571 B2
• Filed: 10/27/2011
• Issued: 02/17/2015
• Est. Priority Date: 10/29/2010
• Status: Active Grant

• Current Assignee: F5 Networks, Inc. (F5 Incorporated)
• Original Assignee: F5 Networks, Inc. (F5 Incorporated)
• Inventors: Dan, Ephraim
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US13/283,512
• Publication Number:
  US 20120278851A1
• Time in Patent Office: 1,209 Days
• Field of Search: 726 1- 5, 713167-168
• US Class Current: 726/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method and machine readable medium for automated policy building in a policy module of a network traffic management device is disclosed. Parsed network traffic data is received at a policy builder of a network traffic management device. The received network traffic data is analyzed in accordance with one or more threshold conditions specified by a user, via a user interface, for an existing policy. The existing policy is modified by the policy builder if the one or more threshold conditions for the network traffic have been met.

Claims

1. A method of automated policy building, the method comprising:

receiving, by a network traffic management device, network traffic, the received network traffic comprising network traffic from one or more applications;

collecting, by the network traffic management device, statistical data based on the received network traffic;

analyzing, by the network traffic management device, the collected statistical data based on the received network traffic, the analysis comprising learning network traffic usage by the one or more applications;

determining, by the network traffic management device, when the analyzed collected statistical data based on the received network traffic meets one or more threshold conditions for an existing policy;

modifying, by the network traffic management device, the existing policy to be applied to the received network traffic upon determining that the one or more threshold conditions for the received network traffic have been met, wherein the modification of the existing policy is based at least in part on the analysis of the network traffic usage by the one or more applications.

2. The method of claim 1, further comprising storing data relating to the modification of the policy, wherein the modified policy is enforced on the network traffic.

3. The method of claim 1, further comprising:

receiving, by the network traffic management device, one or more input values associated with the one or more threshold conditions.

4. The method of claim 3, wherein at least one of the one or more input values associated with the one or more threshold conditions are associated with a sensitivity rule in accordance with the existing policy.

5. The method of claim 4, further comprising receiving input to set the threshold condition over an adjustable range of values for the existing policy.

6. The method of claim 1, further comprising:

receiving parsed network traffic at the policy builder, wherein the policy builder previously modified the existing policy;

analyzing the received network traffic in accordance with one or more threshold conditions; and

modifying the already modified policy again upon determining that the one or more threshold conditions for the network traffic have been met.

19. The method of claim 1, wherein the analyzing of the received network traffic further comprises:

performing, network traffic management device, an aggregation and classification procedure on the received network traffic.

7. A non-transitory machine readable medium having stored thereon instructions for automated policy building, comprising machine executable code which, when executed by at least one machine, causes the machine to:

receive network traffic, the received network traffic comprising network traffic from one or more applications;

collect statistical data based on the received network traffic;

analyze the collected statistical data based on the received network traffic, the analysis comprising learning network traffic usage by the one or more applications;

determine when the analyzed collected statistical data based on the received network traffic meets one or more threshold conditions for an existing policy; and

modify the existing policy to be applied to the received network traffic upon determining that the one or more threshold conditions have been met, wherein the modification of the existing policy is based at least in part on the analysis of the network traffic usage by the one or more applications.

8. The machine readable medium of claim 7, wherein the machine is further configured to store data relating to the modification of the policy, wherein the modified policy is enforced on the network traffic.

9. The machine readable medium of claim 7, wherein the machine is further configured to receive input values associated with the one or more threshold conditions.

10. The machine readable medium of claim 9, wherein at least one of the one or more input values associated with the one or more threshold conditions are associated with a sensitivity rule in accordance with the existing policy.

11. The machine readable medium of claim 10, wherein the machine is further configured to receive input to set the threshold condition over an adjustable range of values for the existing policy.

12. The machine readable medium of claim 7, wherein the machine is further configured to:

receive parsed network traffic at the policy builder, wherein the policy builder previously modified the existing policy;

analyze the received network traffic in accordance with one or more threshold conditions; and

modify the already modified policy again upon determining that the one or more threshold conditions for the network traffic have been met.

20. The machine readable medium of claim 7, wherein the analysis further comprises performing an aggregation and classification procedure performed on the received network traffic.

13. A network traffic management device comprising:

a network interface configured to receive and transmit network traffic over one or more networks, wherein the network interface receives network traffic;

a memory configured to store instructions for automated policy building in processor executable code; and

a processor configured to execute the stored executable code which causes the processor to;

receive the network traffic, the received network traffic comprising network traffic from one or more applications;

collect statistical data based on the received network traffic;

analyze the collected statistical data based on the received network traffic, the analysis comprising learning network traffic usage by the one or more applications;

determine when the analyzed collected statistical data based on the received network traffic meets one or more threshold conditions for an existing policy; and

modify the existing policy to be applied to the received network traffic upon determining that the one or more threshold conditions for the network traffic have been met, wherein the modification of the existing policy is based at least in part on the analysis of the network traffic usage by the one or more applications.

14. The network traffic management device of claim 13, wherein the processor is further configured to store data relating to the modification of the policy, wherein the modified policy is enforced on the network traffic.

15. The network traffic management device of claim 13, wherein the processor is further configured to receive input values associated with the one or more threshold conditions.

16. The network traffic management device of claim 15, wherein at least one of the one or more input values associated with the one or more threshold conditions are associated with a sensitivity rule in accordance with the existing policy.

17. The network traffic management device of claim 16, wherein the processor is further configured to receive input to set the threshold condition over an adjustable range of values of the existing policy.

18. The network traffic management device of claim 13, wherein the processor is further configured to:

receive parsed network traffic at the policy builder, wherein the policy builder previously modified the existing policy;

analyze the received network traffic in accordance with one or more threshold conditions; and

modify the already modified policy again upon determining that the one or more threshold conditions for the network traffic have been met.

21. The network traffic management device of claim 13, wherein the processor is further configured for the analysis to perform an aggregation and classification procedure performed on the received network traffic.