# US 2020/0396207 A1 · Permitting firewall traffic as exceptions in default traffic denial environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0396207 A1 - Document ID: US20200396207A1 - Status: Published application - Kind: A1 - Application number: 16/443,487 - Filed: 2019-06-17 - Published: 2020-12-17 - Earliest claimed: 2019-06-17 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Girish M. MOTWANI; Yair TOR; Sinead C. O'DONOVAN; Murali K. SANGUBHATLA; Andrey TERENTYEV; Madhusudhan RAVI - Web page: https://patentgrep.com/patent/US20200396207A1 ## CPC - H04L 63/0263: {Rule management} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 18/217: {Validation; Performance evaluation; Active pattern learning techniques} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A solution for firewall auto-learning in in zero trust environments, such as cloud environments, includes: based at least on a first trigger event, determining a first set of restricted dependencies for a cloud service firewall to learn for a first application; during a first learning phase, learning a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules; and operating the firewall with the first set of verified rules for the first application. Some examples include receiving a set of constraints, such as a selection from a set of preset constraints and/or a custom constraint. Some examples include retraining based at least on a second trigger event and/or learning rules for a second application. ## Claims ### Claim 1 A system for permitting firewall traffic as exceptions in default traffic denial environments, the system comprising: a processor; and a computer-readable medium storing instructions that are operative when executed by the processor to: based at least on a first trigger event, determine a first set of restricted dependencies for a cloud service firewall to analyze for a first application, the first set of restricted dependencies for traffic associated with the cloud service firewall; during a first analysis phase, analyze a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies for traffic that includes a preset constraint on permitted traffic; receive an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules; and operate the cloud service firewall with the first set of verified rules for the first application. ### Claim 2 (depends on 1) The system of claim 1 wherein the instructions are further operative to: based at least on a second trigger event, determine a second set of restricted dependencies for the cloud service firewall to analyze for the first application; during a second analysis phase, analyze a second set of candidate rules corresponding to at least a portion of the second set of restricted dependencies; receive an indication of verifying, blocking, or tailoring one or more candidate rules within the second set of candidate rules, to generate a second set of verified rules, the second set of verified rules different from the first set of verified rules; and operate the cloud service firewall with the second set of verified rules for the first application. ### Claim 3 (depends on 2) The system of claim 2 wherein the first trigger event and the second trigger event each comprises an event selected from the list consisting of: a user input and an update to the first application. ### Claim 4 (depends on 1) The system of claim 1 wherein the instructions are further operative to: based at least on a third trigger event, determine a third set of restricted dependencies for the cloud service firewall to learn for a second application; during a third analysis phase, analyze a third set of candidate rules corresponding to at least a portion of the third set of restricted dependencies; receive an indication of verifying, blocking, or tailoring one or more candidate rules within the third set of candidate rules, to generate a third set of verified rules; and operate the cloud service firewall with the third set of verified rules for the second application. ### Claim 5 (depends on 1) The system of claim 1 wherein the instructions are further operative to: receive a set of constraints for the first set of restricted dependencies. ### Claim 6 (depends on 5) The system of claim 5 wherein receiving a set of constraints for the first set of restricted dependencies comprises receiving at least one input selected from the list consisting of: a selection from a set of preset constraints and a custom constraint. ### Claim 7 (depends on 1) The system of claim 1 wherein the first set of restricted dependencies comprises at least one dependency selected from the list consisting of: an application dependency and a network dependency. ### Claim 8 (depends on 1) The system of claim 1 wherein the instructions are further operative to: determine whether, from among the first set of restricted dependencies, a dependency was not exercised; and based at least on determining that a dependency was not exercised, generate an alert identifying that a dependency was not exercised. ### Claim 9 (depends on 1) The system of claim 1 wherein the instructions are further operative to: during the first analysis phase, generate logs from analyzing the first set of candidate rules; and prior to receiving an indication of verifying, blocking, or tailoring one or more candidate rules, present the logs for evaluation. ### Claim 10 A method of permitting firewall traffic as exceptions in default traffic denial environments, the method comprising: based at least on a first trigger event, determining a first set of restricted dependencies for a cloud service firewall to analyze for a first application; during a first analysis phase, analyzing a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies that includes a preset constraint on permitted traffic; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules; and operating the cloud service firewall with the first set of verified rules for the first application. ### Claim 11 (depends on 10) The method of claim 10 further comprising: based at least on a second trigger event, determining a second set of restricted dependencies for the cloud service firewall to analyze for the first application; during a second analysis phase, analyzing a second set of candidate rules corresponding to at least a portion of the second set of restricted dependencies; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the second set of candidate rules, to generate a second set of verified rules, the second set of verified rules different from the first set of verified rules; and operating the cloud service firewall with the second set of verified rules for the first application. ### Claim 12 (depends on 11) The method of claim 11 wherein the first trigger event and the second trigger event each comprises an event selected from the list consisting of: a user input and an update to the first application. ### Claim 13 (depends on 10) The method of claim 10 further comprising: based at least on a third trigger event, determining a third set of restricted dependencies for the cloud service firewall to analyze for a second application; during a third analysis phase, analyzing a third set of candidate rules corresponding to at least a portion of the third set of restricted dependencies; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the third set of candidate rules, to generate a third set of verified rules; and operating the cloud service firewall with the third set of verified rules for the second application. ### Claim 14 (depends on 10) The method of claim 10 further comprising: receiving a set of constraints for the first set of restricted dependencies. ### Claim 15 (depends on 14) The method of claim 14 wherein receiving a set of constraints for the first set of restricted dependencies comprises receiving at least one input selected from the list consisting of: a selection from a set of preset constraints and a custom constraint. ### Claim 16 (depends on 10) The method of claim 10 wherein the first set of restricted dependencies comprises at least one dependency selected from the list consisting of: an application dependency and a network dependency. ### Claim 17 (depends on 10) The method of claim 10 further comprising: determining whether, from among the first set of restricted dependencies, a dependency was not exercised; and based at least on determining that a dependency was not exercised, generating an alert identifying that a dependency was not exercised. ### Claim 18 (depends on 10) The method of claim 10 further comprising: during the first analysis phase, generating logs from analyzing the first set of candidate rules; and prior to receiving an indication of verifying, blocking, or tailoring one or more candidate rules, presenting the logs for evaluation. ### Claim 19 One or more computer storage devices having computer-executable instructions stored thereon for permitting firewall traffic as exceptions in default traffic denial environments, which, on execution by a computer, cause the computer to perform operations comprising: receiving a set of constraints for a first set of restricted dependencies, wherein receiving a set of constraints for the first set of restricted dependencies comprises receiving at least one input selected from the list consisting of: a selection from a set of preset constraints and a custom constraint; based at least on a first trigger event, determining the first set of restricted dependencies for a cloud service firewall to analyze for a first application, wherein the first trigger event comprises an event selected from the list consisting of: a user input and an update to the first application, and wherein the first set of restricted dependencies comprises at least one dependency selected from the list consisting of: an application dependency and a network dependency; during a first analysis phase, analyzing a first set of candidate rules corresponding to at least a portion of the first set of restricted dependencies; during the first analysis phase, generating logs from analyzing the first set of candidate rules; and determining whether, from among the first set of restricted dependencies, a dependency was not exercised; based at least on determining that a dependency was not exercised, generating an alert identifying that a dependency was not exercised; presenting the logs for evaluation; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the first set of candidate rules, to generate a first set of verified rules; operating the cloud service firewall with the first set of verified rules for the first application; based at least on a second trigger event, determining a second set of restricted dependencies for the cloud service firewall to analyze for the first application, wherein the second trigger event comprises an event selected from the list consisting of: a user input and an update to the first application; during a second analysis phase, analyzing a second set of candidate rules corresponding to at least a portion of the second set of restricted dependencies; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the second set of candidate rules, to generate a second set of verified rules, the second set of verified rules different from the first set of verified rules; operating the cloud service firewall with the second set of verified rules for the first application; based at least on a third trigger event, determining a third set of restricted dependencies for the cloud service firewall to analyze for a second application; during a third analysis phase, analyzing a third set of candidate rules corresponding to at least a portion of the third set of restricted dependencies; receiving an indication of verifying, blocking, or tailoring one or more candidate rules within the third set of candidate rules, to generate a third set of verified rules; and operating the cloud service firewall with the third set of verified rules for the second application. ### Claim 20 (depends on 19) The one or more computer storage devices of claim 19 wherein the operations further comprise: receiving instructions for the first set of candidate rules to learn and deny or to learn and allow.