# US 2021/0344644 A1 · Dynamically managing firewall ports of an enterprise network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344644 A1 - Document ID: US20210344644A1 - Status: Published application - Kind: A1 - Application number: 16/862,547 - Filed: 2020-04-29 - Published: 2021-11-04 - Earliest claimed: 2020-04-29 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Joseph Reyes; Hamza Yaswi; Venkidupathy Ramasamy - Web page: https://patentgrep.com/patent/US20210344644A1 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - G06N 20/00: Machine learning - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract An AI firewall engine dynamically manages firewall ports of an enterprise network to increase security. The AI firewall engine may begin with a baseline port profile configuration and then add firewall rules derived from natural language processing and machine learning from vendor recommended port requirements for an application. The AI firewall engine builds a dynamic port profile with rules that are applied to the firewalls. The AI firewall engine may then monitor system changes and dynamically updates the port profile and configurations on the firewalls. ## Claims ### Claim 1 An apparatus comprising: at least one processor; a memory coupled to the at least one processor; a firewall engine residing in the memory and executed by the at least one processor that dynamically manages a plurality of firewalls in an enterprise network system, wherein the firewall engine modifies baseline port profile configurations to build a dynamic port profile and applies the dynamic port profile to the plurality of firewalls in the enterprise network. ### Claim 2 (depends on 1) The apparatus of claim 1 wherein the firewall engine uses natural language processing to consider availability scans, change management, a change management database and vendor documents. ### Claim 3 (depends on 1) The apparatus of claim 1 wherein the firewall engine inspects system data flows to determine what changes to make to the dynamic port profile. ### Claim 4 (depends on 5) The apparatus of claim 5 wherein the fire wall engine uses a network monitoring technology to inspect system data flows chosen from the following: terminal access point monitoring; syslog and simple network monitoring protocol, switch point analyzer; and network monitoring software. ### Claim 5 (depends on 6) The apparatus of claim 6 wherein the firewall engine continues to monitor for system changes and dynamically updates the dynamic port profile including denying traffic. ### Claim 6 (depends on 5) The apparatus of claim 5 wherein the firewall engine continues to monitor for system changes and dynamically updates the dynamic port by using natural language processing to consider availability scans, change management, change management database and vendor documents. ### Claim 7 (depends on 5) The apparatus of claim 5 wherein the firewall engine continues to monitor for system changes and dynamically updates the dynamic port profile using pattern analysis. ### Claim 8 (depends on 5) The apparatus of claim 5 wherein the firewall engine continues to monitor for system changes and dynamically updates the dynamic port by using load per flow. ### Claim 9 A computer-implemented method executed by at least one processor for dynamically managing a plurality of firewalls in an enterprise network system comprising: providing a baseline port profile configuration; using machine learning and natural language processing to determine configuration needs; inspecting system data flows; building a dynamic port profile; and applying the dynamic port profile to the plurality of firewalls in the enterprise network. ### Claim 10 (depends on 9) The method of claim 9 wherein using natural language processing includes using availability scans, using change management, using change management database and using vendor documents. ### Claim 11 (depends on 9) The method of claim 9 wherein inspecting system data flows includes using a network monitoring technology to inspect system data flows is chosen from the following: terminal access point monitoring; syslog and simple network monitoring protocol, switch point analyzer; and network monitoring software. ### Claim 12 (depends on 9) The method of claim 9 further comprising continuing to monitor for system changes and dynamically updating the dynamic port profile. ### Claim 13 (depends on 12) The method of claim 12 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes using natural language processing to use availability scans, change management, change management database and vendor documents. ### Claim 14 (depends on 12) The method of claim 12 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes using pattern analysis. ### Claim 15 (depends on 12) The method of claim 12 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes using load per flow. ### Claim 16 (depends on 12) The method of claim 12 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes denying traffic. ### Claim 17 (depends on 12) The method of claim 12 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes determining when a current data rate exceeds an expected data rate by a threshold provided in a baseline port profile configuration. ### Claim 18 A computer-implemented method executed by at least one processor for dynamically managing a plurality of firewalls in an enterprise network system comprising: providing a baseline port profile configuration; using machine learning and natural language processing to determine configuration needs, including using availability scans, using change management, using change management database and using vendor documents; inspecting system data flows using a network monitoring technology to inspect system data flows chosen from the following: terminal access point monitoring; syslog and simple network monitoring protocol, switch point analyzer; and network monitoring software; building a dynamic port profile; applying the dynamic port profile to the plurality of firewalls in the enterprise network; and continuing to monitor for system changes using pattern analysis and dynamically updating the dynamic port profile using pattern and trend analysis. ### Claim 19 (depends on 18) The method of claim 18 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes using load per flow. ### Claim 20 (depends on 18) The method of claim 18 wherein continuing to monitor for system changes and dynamically updating the dynamic port profile includes denying traffic.