Building a cooperative security fabric of hierarchically interconnected network security devices

A method comprising:

• dynamically constructing a cooperative security fabric (C SF) of a plurality of network security devices deployed within a protected network in a form of a tree, having a plurality of nodes, including a root node, one or more intermediate nodes and one or more leaf nodes, based on hierarchical interconnections among the plurality of network security devices by determining a relative upstream or downstream relationship among each network security device of the plurality of network security devices, wherein each node of a plurality of nodes within the CSF represents a network security device of the plurality of network security devices and each node of the CSF, except the root node and the one or more leaf nodes, includes both a parent node and one or more child nodes;
• establishing and maintaining, by backend daemons running within corresponding network security devices of the plurality of network security devices, a bi-directional tunnel between each parent node within the CSF and its respective child nodes through which queries and replies are communicated and through which periodic keep-alive messages and responses are exchanged;
• and
• enforcing, by forward daemons running within each of the plurality of network security devices, a CSF protocol that limits the issuance of query messages to those originated by a source network security device of the plurality of network security devices associated with an upstream node within the CSF and directed to a destination network security device of the plurality of network security devices associated with a downstream node within the CSF.