Rule swapping in a packet network

• US 9,674,148 B2
• Filed: 10/23/2015
• Issued: 06/06/2017
• Est. Priority Date: 01/11/2013
• Status: Active Grant

• Current Assignee: Centripetal Networks, Inc.
• Original Assignee: Centripetal Networks, Inc.
• Inventors: Rogers, Steven, Ahn, David K., Moore, Sean
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US14/921,718
• Publication Number:
  US 20160197882A1
• Time in Patent Office: 592 Days
• CPC Class Codes: G06N 5/02 Knowledge representation; Symbolic representation
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

In some variations, first and second rule sets may be received by a network protection device. The first and second rule sets may be preprocessed. The network protection device may be configured to process packets in accordance with the first rule set. Packets may be received by the network protection device. A first portion of the packets may be processed in accordance with the first rule set. The network protection device may be reconfigured to process packets in accordance with the second rule set. A second portion of the packets may be processed in accordance with the second rule set.

Claims

1. A method comprising:

preprocessing, by a network device, a first rule set and a second rule set;

configuring the network device to process packets in accordance with the first rule set;

receiving, after the preprocessing and the configuring, by the network device, a plurality of packets;

processing, by the network device, a first portion of the plurality of packets in accordance with the first rule set;

signaling the network device to process packets in accordance with the second rule set; and

responsive to the signaling;

ceasing processing of one or more packets;

caching the one or more packets;

reconfiguring the network device to process packets in accordance with the second rule set;

signaling completion of reconfiguration to process packets in accordance with the second rule set; and

responsive to the signaling completion of reconfiguration, processing the one or more cached packets in accordance with the second rule set.

2. The method of claim 1, further comprising:

storing, by the network device, configuration information for processing packets in accordance with the first rule set;

reconfiguring, by the network device, the network device to process packets in accordance with the first rule set based on the stored configuration information; and

processing, after the reconfiguring, by the network device, a second portion of the plurality of packets in accordance with the first rule set.

3. The method of claim 1, further comprising:

storing, by the network device, the first rule set and the second rule set in a memory buffer; and

dynamically adjusting, by the network device, a size of the memory buffer based on at least one of a size of the first rule set or a size of the second rule set.

4. The method of claim 1, wherein the signaling the network device to process packets in accordance with the second rule set is responsive to the network device receiving a message invoking the second rule set.

5. The method of claim 1, wherein the signaling the network device to process packets in accordance with the second rule set is responsive to one or more detected network conditions indicating a network attack.

6. The method of claim 1, wherein the preprocessing comprises merging a plurality of rules included in at least one of the first rule set or the second rule set into a single rule.

7. The method of claim 1, wherein the preprocessing comprises separating a rule included in at least one of the first rule set or the second rule set into a plurality of rules.

8. The method of claim 1, wherein the preprocessing comprises reordering one or more rules included in at least one of the first rule set or the second rule set.

9. A system comprising:

a plurality of processors; and

a memory comprising instructions that when executed by at least one processor of the plurality of processors cause the system to;

preprocess a first rule set and a second rule set;

configure the system to process packets in accordance with the first rule set;

receive, after the preprocess and the configure, a plurality of packets;

process a first portion of the plurality of packets in accordance with the first rule set;

signal to process packets in accordance with the second rule set; and

responsive to the signal to process packets in accordance with the second rule set;

cease processing of one or more packets;

cache the one or more packets;

reconfigure the system to process packets in accordance with the second rule set;

signal completion of reconfiguration to process packets in accordance with the second rule set; and

responsive to the signal of completion of reconfiguration, process the one or more cached packets in accordance with the second rule set.

10. The system of claim 9, wherein the instructions, when executed by the at least one processor, further cause the system to:

store configuration information for processing packets in accordance with the first rule set;

reconfigure the system to process packets in accordance with the first rule set based on the stored configuration information; and

process, after the reconfiguring, a second portion of the plurality of packets in accordance with the first rule set.

11. The system of claim 9, wherein the instructions, when executed by the at least one processor, further cause the system to:

store the first rule set and the second rule set in a memory buffer; and

dynamically adjust a size of the memory buffer based on at least one of a size of the first rule set or a size of the second rule set.

12. The system of claim 9, wherein the instructions, when executed by the at least one processor, cause the system to signal to process packets in accordance with the second rule set in response to the system receiving a message invoking the second rule set.

13. The system of claim 9, wherein the instructions, when executed by the at least one processor, cause the system to signal to process packets in accordance with the second rule set in response to one or more detected network conditions indicating a network attack.

14. The system of claim 9, wherein the instructions to preprocess the first rule set and the second rule set comprise instructions to merge a plurality of rules included in at least one of the first rule set or the second rule set into a single rule.

15. The system of claim 9, wherein the instructions to preprocess the first rule set and the second rule set comprise instructions to separate a rule included in at least one of the first rule set or the second rule set into a plurality of rules.

16. The system of claim 9, wherein the instructions to preprocess the first rule set and the second rule set comprise instructions to reorder one or more rules included in at least one of the first rule set or the second rule set.

17. One or more non-transitory computer-readable media comprising instructions that when executed by a computing system cause the computing system to:

preprocess a first rule set and a second rule set;

configure the computing system to process packets in accordance with the first rule set;

receive a plurality of packets;

process a first portion of the plurality of packets in accordance with the first rule set;

signal to process packets in accordance with the second rule set; and

responsive to the signal to process packets in accordance with the second rule set;

cease processing of one or more packets;

cache the one or more packets;

reconfigure the computing system to process packets in accordance with the second rule set;

signal completion of reconfiguration to process packets in accordance with the second rule set; and

responsive to the signal of completion of reconfiguration, process the one or more cached packets in accordance with the second rule set.

18. The one or more non-transitory computer-readable media of claim 17, wherein the instructions, when executed by the computing system, cause the computing system to:

store configuration information for processing packets in accordance with the first rule set;

reconfigure the computing system to process packets in accordance with the first rule set based on the stored configuration information; and

process, after the reconfiguring, a second portion of the plurality of packets in accordance with the first rule set.

19. The one or more non-transitory computer-readable media of claim 17, wherein the instructions, when executed by the computing system, cause the computing system to:

store the first rule set and the second rule set in a memory buffer; and

dynamically adjust a size of the memory buffer based on at least one of a size of the first rule set or a size of the second rule set.

20. The one or more non-transitory computer-readable media of claim 17, wherein the instructions to preprocess the first rule set and the second rule set comprise:

instructions to merge a first plurality of rules included in at least one of the first rule set or the second rule set into a single rule;

instructions to separate a rule included in at least one of the first rule set or the second rule set into a second plurality of rules;

or instructions to reorder one or more rules included in at least one of the first rule set or the second rule set.