US 11,539,750 B2 · Systems and methods for network security memory reduction via distributed rulesets

Abstract

The present disclosure describes systems and methods for reducing rule set sizes via statistical redistribution throughout a plurality of network security appliances. A rule set may be generated for each security appliance that includes (i) a first set of rules based on known attacks, identified as rules for mandatory inclusion in the rule set; and (ii) a subset of the second set of rules, identified as rules for potential inclusion in the rule set, selected randomly according to a distribution percentage, score, or weight for each potentially included rule. Higher scored rules, which may be more likely vectors for potential attack, may be distributed to a greater number of appliances; while lower scored rules that may be less likely or represent more speculative attacks may be distributed to fewer appliances.

Claims16

Dependent claims

A method for providing distributed rule sets for network security appliances, comprising:

generating, by a management server, from a rule database comprising a plurality of packet processing rules, each packet processing rule associated with a distribution percentage, a first rule set for a first security appliance, the first rule set comprising a first subset of the packet processing rules each associated with a 100% distribution percentage and a second subset of the packet processing rules associated with distribution percentages less than 100%;
generating, by the management server, a second rule set for a second security appliance, the second rule set comprising the first subset of the packet processing rules and a third subset of the packet processing rules associated with distribution percentages less than 100%, the packet processing rules of the third subset different from the packet processing rules of the second subset;
and
transmitting, by the management server, the first rule set to the first security appliance and the second rule set to the second security appliance.

1 more element

A system for providing distributed rule sets for network security appliances, comprising:

a management server comprising a processor executing a rule distributor, a network interface in communication with a first security appliance and a second security appliance, and a storage device comprising a rule database comprising a plurality of packet processing rules, each packet processing rule associated with a distribution percentage;
wherein the rule distributor is configured to generate a plurality of rulesets having a common subset and a different subset by:
generating a first rule set for a first security appliance, the first rule set comprising a first subset of the packet processing rules associated with a 100% distribution percentage and a second subset of the packet processing rules associated with distribution percentages less than 100%, and
generate a second rule set for a second security appliance, the second rule set comprising the first subset of the packet processing rules associated with the 100% distribution percentage and a third subset of the packet processing rules associated with distribution percentages less than 100%, the packet processing rules of the third subset different from the packet processing rules of the second subset;
and
wherein the network interface is configured to transmit the first rule set to the first security appliance and the second rule set to the second security appliance.

3 more elements

Dependencies are inferred from the claim text.

Systems and methods for network security memory reduction via distributed rulesets

Life of this patent

Systems and methods for network security memory reduction via distributed rulesets

Life of this patent

Abstract

Claims16