US 2014/0007216 A1Published application

Methods, systems, and computer readable media for adaptive packet filtering

AssigneeGreat Wall Systems

InventorDavid Ahn

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, systems, and computer readable media for adaptive packet filtering are disclosed. One method includes identifying at least one subset of rules and an ordered set of firewall packet filtering rules that defines a firewall policy such that the subset contains disjoint rules. Disjoint rules are defined as rules whose order can be changed without changing integrity of the firewall policy. Rules in the subset are sorted to statistically decrease the number of comparisons that will be applied to each packet that a firewall encounters. Packets are filtered at the firewall using the sorted rules in the subset by comparing each packet to each of the sorted rules in the subset until the packet is allowed or denied and ceasing the comparing for the packet in response to the packet being allowed or denied and thereby achieving sub-linear searching for packets filtered using the sorted rules in the subset.

Claims1

Dependent claims

A method, comprising:

identifying, from among a plurality of rules that define a packet filtering policy, one or more groups of disjoint rules, wherein each of the one or more groups of disjoint rules comprises at least two rules that when applied to a packet either allow the packet to continue toward its destination or prevent the packet from continuing towards its destination irrespective of an order in which the at least two rules are applied to the packet, a first of the at least two rules specifying a set of network addresses for which packets should be allowed to continue toward their respective destinations, and a second of the at least two rules specifying a set of network addresses for which packets should be prevented from continuing toward their respective destinations;
receiving a plurality of packets;
applying the first of the at least two rules to a first portion of the plurality of packets, the first portion of the plurality of packets having network addresses in the set of network addresses for which packets should be allowed to continue toward their respective destinations;
applying the second of the at least two rules to a second portion of the plurality of packets, the second portion of the plurality of packets having network addresses in the set of network addresses for which packets should be prevented from continuing toward their respective destinations;
allowing the first portion of the plurality of packets to continue toward their respective destinations;
and
preventing the second portion of the plurality of packets from continuing toward their respective destinations.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/940,240Filed 11 Jul 2013
Priority: 28 Aug 2009
Published: 2 Jan 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0263
Filtering policies: rule management
G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection

Family

Application61/237,974Us provisional application · filed 28 Aug 2009
Application12/871,806Continuation · filed 30 Aug 2010
Application13/940,240Continuation
US 2011/0055916 A1Published application
US 8,495,725 B2Related patent
US 2014/0007216 A1This patent

From the US filing history. Foreign family members aren’t listed.