# US 2018/0324218 A1 · Learning network topology and monitoring compliance with security goals

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0324218 A1
- Document ID: US20180324218A1
- Status: Published application
- Kind: A1
- Application number: 15/855,897
- Filed: 2017-12-27
- Published: 2018-11-08
- Earliest claimed: 2017-05-08
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Michael Xie; Robert A. May; Ling Clarke
- Web page: https://patentgrep.com/patent/US20180324218A1

## CPC

- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0263: {Rule management}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/06: Authentication
- H04W 24/02: Arrangements for optimising operational condition
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Systems and methods for monitoring compliance with security goals by a network or part thereof are provided. According to one embodiment, a topology of a network segment of a private network is discovered by a network security device associated with the private network. Security policies implemented by one or more network security devices that form part of the network segment are learned by the network security device. Compliance with a security goal associated with the network segment is then determined by the network security device by: (i) analyzing traffic passing through the network segment; (ii) analyzing respective system configurations of the one or more network security devices; and (iii) evaluating performance of the security policies based on the traffic.

## Claims

### Claim 1

A method comprising:
discovering, by a network security device of a private network, a topology of a network segment of the private network;
learning, by the network security device, security policies implemented by one or more network security devices that form part of the network segment; and
determining, by the network security device, whether the one or more network security devices are compliant with a security goal associated with the network segment by:
analyzing traffic passing through the network segment;
analyzing respective system configurations of the one or more network security devices; and
evaluating performance of the security policies based on the traffic.

### Claim 2 (depends on 1)

The method of claim 1, wherein the security goal specifies at least one security rule and wherein the method further comprises when the security policies do not comply with the at least one security rule, then reporting, by the network security device, issues highlighting reasons for non-compliance.

### Claim 3 (depends on 2)

The method of claim 2, further comprising generating, by the network security device, at least one recommendation for a change proposed to be made to the security polices based on the issues.

### Claim 4 (depends on 3)

The method of claim 3, further comprising generating, by the network security device, recommendations for configuration optimization of the at least one network segment or a part thereof based on said analyzing respective system configurations of the one or more network security devices.

### Claim 5 (depends on 2)

The method of claim 2, further comprising reporting, by the network security device, findings regarding performance of the security polices with respect to said analyzing traffic passing through the network segment.

### Claim 6 (depends on 3)

The method of claim 3, wherein the at least one recommendation is pre-stored in a recommendation database.

### Claim 7 (depends on 2)

The method of claim 2, wherein when the security polices do not comply with the at least one security rule, then causing, by the network device, the security polices to be updated so as to comply with the at least one security rule.

### Claim 8 (depends on 1)

The method of claim 1, wherein the security goal is assigned to the network segment based on any or a combination of user-based assignment, goals associated with other similar network segments and attributes of the network segment.

### Claim 9 (depends on 1)

The method of claim 1, wherein the private network comprises a plurality of network security devices, and wherein said discovering includes dynamically constructing a cooperative security fabric (CSF) of the plurality of network security devices in a form of a tree, having a plurality of nodes, including a root node, one or more intermediate nodes and one or more leaf nodes, based on hierarchical interconnections among the plurality of network security devices by determining a relative upstream or downstream relationship among each network security device of the plurality of network security devices, wherein each node of a plurality of nodes within the CSF represents a network security device of the plurality of network security devices and each node of the CSF, except the root node and the one or more leaf nodes, includes both a parent node and one or more child nodes.

### Claim 10 (depends on 9)

The method of claim 9, wherein the network security devices are selected from one or a combination of a firewall, a gateway, an intrusion prevention systems (IPS), an intrusion detection system (IDS), and a Unified Threat Management (UTM) appliance.