US 8,949,418 B2Granted

Firewall event reduction for rule use counting

AssigneeInternational Business Machines Corporation

InventorsRory F. Bray, Cezar P. Grzelak, Jason D. Keirstead

Life of this patent

Estimating the term…

Loading patent…

Abstract

An illustrative embodiment of a method for firewall rule use counting receives log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector, generates a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network, a source port and protocol list and a destination port and protocol list for each respective device, a unique object for each log data set received; a mapping database comprising an entry for each log data set received associated with the unique object; and feeds each entry in the mapping database through a topology model to also generate a reference to a unique firewall rule on a respective device in the plurality of devices. A count associated with the unique firewall rule is incremented using a count of logs stored associated with the respective unique object and a report is generated.

Claims13

Dependent claims

A computer program product for firewall rule use counting, the computer program product comprising:

one or more computer recordable-type data storage devices containing computer executable program code stored thereon, where the computer executable program code when executed on a computer causes the computer to:
receive log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector;
generate a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network;
generate a source port and protocol list and a destination port and protocol list for each respective device in the plurality of devices;
generate a unique object for each log data set received;
generate a mapping database comprising an entry for each log data set received associated with the unique object;
feed each entry in the mapping database through a topology model representative of the particular network;
generate a reference to a unique firewall rule on a respective device in the plurality of devices;
increment a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object;
and
generate a report.

8 more elements

An apparatus for firewall rule use counting, the apparatus comprising:

a communications fabric;
one or more computer recordable data storage devices connected to the communications fabric;
a memory connected to the communications fabric, where the memory contains computer executable program code;
a communications unit connected to the communications fabric;
an input/output unit connected to the communications fabric;
and
one or more processors connected to the communications fabric, where the one or more processors execute the computer executable program code to direct the apparatus to:
receive log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector;
generate a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network;
generate a source port and protocol list and a destination port and protocol list for each respective device in the plurality of devices;
generate a unique object for each log data set received;
generate a mapping database comprising an entry for each log data set received associated with the unique object;
feed each entry in the mapping database through a topology model representative of the particular network;
generate a reference to a unique firewall rule on a respective device in the plurality of devices;
increment a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object;
and
generate a report.

14 more elements

Dependencies are inferred from the claim text.