US 2022/0191173 A1 · SYSTEMS AND METHODS FOR PERFORMING DYNAMIC FIREWALL RULE EVALUATION

Abstract

A firewall rule evaluation service scores firewall rules based on characteristics of logical objects that fall within ranges of Internet Protocol (IP) addresses corresponding to the firewall rules. Firewall rule scoring criteria may cause scores to be assigned to individual firewall rules based on an inverse relationship to quantities of discrete Autonomous Systems as well as aggregate numbers of and/or severity scores for threat intelligence flagged IP addresses granted access by individual firewall rules. The firewall rule evaluation service may further determine firewall rule recommendations for replacing firewall rules spanning multiple IP prefixes for different Autonomous Systems with more narrowly defined firewall rules that precisely encompass IP prefixes corresponding to single autonomous systems or multiple related Autonomous Systems (e.g., Autonomous Systems operated by a single trustworthy entity).

Claims20

Dependent claims

A computer-implemented method, comprising:

receiving firewall rule data that defines a firewall rule having a firewall rule Internet Protocol (IP) address range that spans from a starting IP address to an ending IP address;
receiving Autonomous System Number (ASN) data that defines associations between ASN IP address ranges and corresponding Autonomous Systems, wherein individual Autonomous Systems correspond one or more IP networks that are operating in accordance with individual network routing policies;
identifying, based on the firewall rule data and the ASN data, a subset of individual Autonomous Systems having individual ASN IP address ranges that are at least partially encompassed within the firewall rule IP address range for the firewall rule;
and
determining a rule score for the firewall rule based on a number of Autonomous Systems within the subset of individual Autonomous Systems that are identified as having the individual ASN IP address ranges that are at least partially encompassed within the firewall rule IP address range.

2 more elements

A system comprising:

one or more processing units;
and
a computer-readable storage medium having computer-executable instructions stored thereupon, which, when executed by the one or more processing units, cause the one or more processing units to:
receive firewall rule data that defines a firewall rule having a firewall rule Internet Protocol (IP) address range;
receive logical object data that defines associations between individual logical objects and at least one of:
IP address ranges that span from a starting IP address to an ending IP address, or
discrete IP addresses;
identify, based on the firewall rule data and the logical object data, a subset of logical objects that are at least partially encompassed within the firewall rule IP address range for the firewall rule;
and
determine a rule score for the firewall rule based on a number of individual logical objects that are included within the subset of logical objects identified as being at least partially encompassed within the firewall rule IP address range.

7 more elements

Dependencies are inferred from the claim text.

Systems and methods for performing dynamic firewall rule evaluation

Life of this patent

Systems and methods for performing dynamic firewall rule evaluation

Life of this patent

Abstract

Claims20