Firewall Insights Processing and Machine Learning

Abstract

A computer-implemented method (600) causes data processing hardware (204) to perform operations for training a firewall utilization model (402). The operations include receiving (602) firewall utilization data (352) for connection requests (28) received by a firewall during a utilization period. The firewall utilization data includes a hit count for each sub-rule (322) associated with at least one firewall rule (312). The operations also include generating (604) training data (432) based on the firewall utilization data. The training data includes unused sub-rules (432b) that did not have hits during the utilization period and hit sub-rules (432a) that had more than zero hits during the utilization period. The operations also include training (606) the firewall utilization model on the training data. The operations also include, for each sub-rule associated with at least one firewall rule, determining (608) a corresponding sub-rule utilization probability (452), the corresponding sub-rule utilization probability indicating the likelihood that the sub-rule will be used for future connection requests.

Description

Technical Field

[0001] This disclosure relates to firewall insight processing using machine learning. Background Art

[0002] A Virtual Private Cloud (VPC) is an on-demand, configurable pool of shared computing resources allocated within a public cloud environment. The VPC provides isolation for users from other cloud users. The VPC can execute one or more Virtual Machines (VMs), and the Virtual Machines (VMs) can communicate with a user's on-premises network or other remote resources via a Virtual Private Network (VPN). Due to the potential scale and complexity of the VPC, which can include any number of VMs, network gateways, load balancers, etc., operating and maintaining the VPC often requires a large amount of network configuration. For example, it is typically necessary to optimize firewall configuration by updating firewall rules. The complex nature of firewall rules makes it difficult for users to understand the rules being used and the effects of those rules. One problem that results is that it is difficult to maintain firewall rules over time. Rules that once made sense may no longer be useful when the operating environment changes. Summary of the Invention

[0003] One aspect of this disclosure provides a computer-implemented method that, when executed on data processing hardware, causes the data processing hardware to perform operations for training a firewall utilization model. The operations include receiving firewall utilization data for connection requests received by a firewall during a utilization period, the firewall utilization data including a hit count for each sub-rule in a set of sub-rules associated with at least one firewall rule during the utilization period. The operations further include generating training data based on the firewall utilization data, the training data including unused sub-rules corresponding to sub-rules that did not have hits during the utilization period and hit sub-rules corresponding to sub-rules that had more than zero hits during the utilization period. The operations also include training a firewall utilization model on the training data. The operations further include: for each sub-rule in the set of sub-rules associated with the at least one firewall rule, using the trained firewall utilization model to determine a corresponding sub-rule utilization probability, the corresponding sub-rule utilization probability indicating the likelihood that the sub-rule will be used for future connection requests.

[0004] Aspects of the present disclosure may include one or more of the following optional features. In some examples, the operations further include: determining a firewall attribute grouping of the at least one firewall rule, each firewall attribute grouping including at least one firewall attribute; and determining a first set of sub-rules associated with the at least one firewall rule based on the firewall attribute grouping.

[0005] In some embodiments, the operations further include receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period. In some configurations, the operations include filtering the plurality of firewall logs based on filtering criteria. In some examples, the operations include determining a second set of sub-rules associated with the plurality of firewall logs and generating the utilization data based on the first set of sub-rules and the second set of sub-rules. In some embodiments, the firewall attribute grouping includes at least three of a source attribute grouping, a destination attribute grouping, a port range, or an Internet Protocol (IP). In some examples, the source attribute grouping includes a source IP range, a source label, and a source service account. In some configurations, the destination attribute grouping includes a destination label and a destination service account.

[0006] In some configurations, the operations further include receiving firewall reachability insights from a reachability module, generating firewall utilization insights based on corresponding sub-rule utilization probabilities determined for each sub-rule, aggregating the firewall reachability insights and the firewall utilization insights, and generating firewall configuration recommendations based on the aggregated firewall reachability insights and the aggregated firewall utilization insights. In some examples, the operations include: determining firewall rule attributes that are not used during the utilization period; for each unused firewall rule attribute, aggregating the sub-rule utilization probabilities of all sub-rules including the unused firewall rule attribute; and determining the probability that the attribute will be hit in the future based on the aggregated sub-rule probabilities.

[0007] Another aspect of the present disclosure provides a system for training a firewall utilization model. The system includes data processing hardware and memory hardware communicatively coupled to the data processing hardware. The memory hardware stores instructions that, when executed by the data processing hardware, cause the data processing hardware to perform operations. The operations include receiving firewall utilization data of connection requests received by a firewall during a utilization period, the firewall utilization data including a hit count for each sub-rule in a set of sub-rules associated with at least one firewall rule during the utilization period. The operations further include generating training data based on the firewall utilization data, the training data including unused sub-rules corresponding to sub-rules that did not have hits during the utilization period and hit sub-rules corresponding to sub-rules that had more than zero hits during the utilization period. The operations also include training the firewall utilization model on the training data. The operations further include: for each sub-rule in the set of sub-rules associated with the at least one firewall rule, using the trained firewall utilization model to determine a corresponding sub-rule utilization probability, the corresponding sub-rule utilization probability indicating the likelihood that the sub-rule will be used for future connection requests.

[0008] Aspects of the present disclosure may include one or more of the following optional features. In some examples, the operations further include: determining a firewall attribute grouping for the at least one firewall rule, each firewall attribute grouping including at least one firewall attribute; and determining a first set of sub-rules associated with the at least one firewall rule based on the firewall attribute grouping.

[0009] In some embodiments, the operations further include receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period. In some configurations, the operations include filtering the plurality of firewall logs based on filtering criteria. In some examples, the operations include determining a second set of sub-rules associated with the plurality of firewall logs and generating the utilization data based on the first set of sub-rules and the second set of sub-rules. In some embodiments, the firewall attribute grouping includes at least three of a source attribute grouping, a target attribute grouping, a port range, or an Internet Protocol (IP). In some examples, the source attribute grouping includes a source IP range, a source label, and a source service account. In some configurations, the target attribute grouping includes a target label and a target service account.

[0010] In some configurations, the operations further include receiving firewall reachability insights from a reachability module, generating firewall utilization insights based on the respective sub-rule utilization probabilities determined for each sub-rule, aggregating the firewall reachability insights and the firewall utilization insights, and generating firewall configuration recommendations based on the aggregated firewall reachability insights and the aggregated firewall utilization insights. In some examples, the operations include: determining firewall rule attributes that were not used during the utilization; for each unused firewall rule attribute, aggregating the sub-rule utilization probabilities of all sub-rules including the unused firewall rule attribute; and determining the probability that the attribute will be hit in the future based on the aggregated sub-rule probabilities.

[0011] Another aspect of the present disclosure provides a computer program product encoded on a non-transitory computer-readable storage medium including instructions that, when executed by a data processing device, cause the data processing device to perform operations. The operations include receiving firewall utilization data for connection requests received by a firewall during a utilization period, the firewall utilization data including a hit count for each sub-rule in a set of sub-rules associated with at least one firewall rule during the utilization period. The operations further include generating training data based on the firewall utilization data, the training data including unused sub-rules corresponding to sub-rules that did not have hits during the utilization period and hit sub-rules corresponding to sub-rules that had more than zero hits during the utilization period. The operations also include training a firewall utilization model on the training data. The operations further include: for each sub-rule in the set of sub-rules associated with the at least one firewall rule, using the trained firewall utilization model to determine a respective sub-rule utilization probability, the respective sub-rule utilization probability indicating the likelihood that the sub-rule will be used for future connection requests.

[0012] This aspect of the present disclosure may include one or more of the following optional features. In some examples, the operations further include: determining a firewall attribute grouping for the at least one firewall rule, each firewall attribute grouping including at least one firewall attribute; and determining a first set of sub-rules associated with the at least one firewall rule based on the firewall attribute grouping.

[0013] In some examples, the operations further include receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period; filtering the plurality of firewall logs based on filtering criteria; determining a second sub-rule set associated with the plurality of firewall logs; and generating the utilization data based on the first sub-rule set and the second sub-rule set. In some embodiments, the operations further include: determining firewall rule attributes that are not used during the utilization; for each unused firewall rule attribute, aggregating the sub-rule utilization probabilities of all sub-rules including the unused firewall rule attribute; and determining the probability that the attribute will be hit in the future based on the aggregated sub-rule probabilities.

[0014] One or more embodiments of the present disclosure are set forth in the accompanying drawings and the following description. Other aspects, features, and advantages will be apparent from the specification, the drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a schematic diagram of an example system for using machine learning to process firewall insights.

[0016] Figure 2 is Figure 1 a schematic diagram of exemplary components of a virtual machine of the system.

[0017] Figure 3 is Figure 1 a schematic diagram of a log processing module of the system.

[0018] Figure 4A and 4B is Figure 1 a schematic diagram of a machine learning engine of the system.

[0019] Figure 5 is Figure 1 a schematic diagram of a rule aggregator of the system.

[0020] Figure 6 is a flowchart of an example arrangement of operations of a method for performing change impact simulation analysis.

[0021] Figure 7 is a schematic diagram of an exemplary computing device that can be used to implement the systems and methods described herein.

[0022] Like reference numerals in the various drawings indicate like elements. DETAILED DESCRIPTION

[0023] A firewall system allows a system administrator to allow or deny communication from a user device to a computing resource based on a set of firewall rules, and vice versa. The firewall system includes a set of firewall rules that define a list of acceptable attributes of a user device requesting access to a computing resource. That is, user devices that meet the list of acceptable attributes are allowed access to the computing resource, while user devices that do not meet the list of acceptable attributes are blocked from accessing the computing resource. In most cases, multiple combinations of attributes (e.g., sub-rules) meet the list of acceptable attributes defined by the firewall rules. For example, a firewall rule that includes three attribute groupings creates 27 possible combinations of attributes (e.g., sub-rules) that meet the firewall rule, where each attribute grouping has three acceptable attribute values. Here, a user device that includes an attribute combination that matches any one of the twenty-seven sub-rules meets the firewall rule and is allowed access to the computing resource.

[0024] Generally, machine learning is the process of implementing statistical techniques to provide a computer with the ability to learn without being manually programmed. The computer can have one or more training data sets and / or one or more feedback data sets, where the training data set is used to build an initial model and the feedback data set is used to adjust the model. Machine learning can be implemented to predict future events or outcomes using one or more models built based on historical occurrences or patterns. In the context of the present disclosure, machine learning can be used to optimize firewall configurations by predicting which firewall rules or firewall attributes are likely to be used in future connection requests.

[0025] In some embodiments, firewall analysis determines which firewall rules are being used to access a computing resource and which firewall rules are not being used to access the computing resource. However, it is often difficult to determine the specific attributes and / or sub-rules that are being used to meet a firewall rule because any one of the multiple attributes and / or sub-rules present can meet the firewall rule. Specifically, firewall rule level analysis can only determine that a firewall rule is being used to access a computing resource, but may not accurately determine which specific attribute and / or sub-rule is being used to meet the firewall rule. In some cases, a firewall rule includes unused attributes that allow access to a VM. For example, an unused attribute can include an attribute of a user device that allows access to a computing resource, however, in reality, none of the user devices accessing the computing resource include the specific unused attribute. Thus, a firewall rule that includes an unused attribute allows access to the computing resource more broadly than necessary and may pose a potential future security risk.

[0026] Embodiments of the present disclosure are directed to a method of executing a model to determine sub-rules and Attribute Level Insights for a user device accessing computing resources. The sub-rules and Attribute Level Insights provide information to a firewall system as to which sub-rules and attributes are actually used to access computing resources. The model predicts the likelihood of attributes and sub-rules being used in the future based on historical utilization data. Thus, the model can accurately determine which attributes and sub-rules of a user device are no longer needed and can be removed from the firewall rules.

[0027] In some embodiments, if an ingress allow rule is not hit within a predetermined utilization period (e.g., 50 days), the system reports, based on the model, the probability that the rule will not be hit in the future. If the ingress allow rule is hit during the utilization period, the system will report whether any attributes of the rule (e.g., Internet protocol range, port range, etc.) are unused (i.e., zero hits). For those unused attributes, the system will report, based on the model, the probability that they will not be hit in the future. The system also provides an explanation of how the prediction was made, e.g., any other similar rules with similar attributes that were also unused.

[0028] Reference Figure 1 , in some embodiments, example system 10 includes a user device 20 associated with a corresponding user 12 and communicates with a cloud network 200 via a network 30 (e.g., the Internet) and an internal network 40 (i.e., the local network that the user device 20 uses to connect to the network 30). The internal network 40 includes a network gateway 42 (e.g., a router) that serves as a forwarding host for the internal network 40. The user device 20 can correspond to any computing device, such as a desktop workstation, a laptop workstation, or a mobile device (e.g., a smart phone or a tablet). The user device 20 includes computing resources 22 (e.g., data processing hardware) and / or storage resources 24 (e.g., memory hardware).

[0029] The cloud network 200 can be a single computer, multiple computers, or a distributed system (e.g., a cloud environment) with scalable / elastic resources 202, which include computing resources 204 (e.g., data processing hardware) and / or storage resources 206 (e.g., memory hardware). Data storage (i.e., a remote storage device) can be overlaid on the storage resources 206 to allow one or more clients or computing resources 204 to use the storage resources 206 in a scalable manner. The cloud network 200 is configured to implement and execute one or more virtual machines (VMs) 250, 250a-n. The one or more VMs execute securely within a virtual private cloud (VPC) environment or VPC 208 associated with or operated by the user 12. The VPC 208 can include various other network elements, such as load balancers, gateways, front ends, and back ends.

[0030] In Figure 2 the example shown, the distributed system 200 includes a collection 210 of resources 110 (e.g., hardware resources 110h), a virtual machine monitor (VMM) 220, a VM layer 240 that executes one or more of the VMs 250, and an application layer 260. Each hardware resource 110h may include one or more physical central processing units (pCPUs) 204 (“physical processors 204”) and memory hardware 206. Although each hardware resource 110h is shown as having a single physical processor 204, any hardware resource 110h may include multiple physical processors 204. An operating system 212 may execute on the collection 210 of resources 110.

[0031] In some examples, the VMM 220 corresponds to a hypervisor 220 (e.g., a compute engine), and the hypervisor 220 includes at least one of software, firmware, or hardware configured to create and execute the VMs 250. The computer (i.e., data processing hardware 204) associated with the VMM 220 that executes one or more of the VMs 250 may be referred to as a host machine, while each VM 250 may be referred to as a guest machine. Here, the VMM 220 or the hypervisor is configured to provide a corresponding guest operating system (OS) 212g with a virtual operating platform to each VM 250, and is configured to manage the execution of the corresponding guest OS 212g on the VM 250. As used herein, each VM 250 may be referred to as an “instance” or a “VM instance”. In some examples, multiple instances of various operating systems may share virtualized resources. For example, a first VM 250 of an operating system, a second VM 250 of an operating system, and an OS a third VM 250 of an operating system may all run on a single physical x86 machine.

[0032] The VM layer 240 includes one or more virtual machines 250. The distributed system 200 enables a user 12 to start a VM 250 as needed. The VM 250 emulates a real computer system and operates based on the computer architecture and functions of a real computer system or a hypothetical computer system, and may involve dedicated hardware, software, or a combination thereof. In some examples, the distributed system 200 authorizes and authenticates the user 12 before starting one or more VMs 250. An instance of software, or simply an instance, refers to a VM 250 hosted (executed thereon) on the data processing hardware 204 of the distributed system 200.

[0033] Each VM 250 may include one or more virtual central processing units (vCPUs) 252 ("virtual processors"). In the example shown, the first virtual machine 250a includes a first set 252a of one or more virtual processors 252, and the second virtual machine 250b includes a second set 252b of one or more virtual processors 252. Although the second set 252b shown includes only one virtual processor 252, any number of virtual processors 252 is possible. Each virtual processor 252 emulates one or more physical processors 204. For example, the first set 252a of one or more virtual processors 252 emulates a first set 204aa of one or more physical processors 204, and the second set 252b of one or more virtual processors 252 emulates a second set 204b of one or more physical processors 204. The application layer 260 includes software resources 110s, 110sa, 110sb (software applications) that can execute on the virtual machines 250.

[0034] Typically, each software instance (e.g., virtual machine 250) includes at least one virtual storage device 262, and the virtual storage device 262 provides volatile and non-volatile storage capacity for services on the physical memory hardware 206. For example, the storage capacity on the physical memory hardware 206 may include a permanent disk (PD), and the permanent disk is a number of physical disks (e.g., memory area 620 ( Figure 7 )) or random access memory (RAM) across the memory hardware 206 for storing data for the user 12 to provide volatile memory. More specifically, each virtual storage device 262 of the corresponding VM 250 moves data in a sequence of bytes or bits (blocks) to an associated physical block storage volume V on the memory hardware 206 to provide non-volatile storage. Thus, the storage capacity provided by the virtual storage device 262 of the corresponding VM instance 250 is mapped to the corresponding physical block storage volume V on the memory hardware 206. In some examples, the virtual storage device 262 supports random access to data on the memory hardware 206 and typically uses buffered I / O. Examples include hard disks, CD-ROM drives, and flash drives. Similarly, portions of the volatile memory (e.g., RAM) of the physical memory hardware 206 may be partitioned among the virtual storage devices 262.

[0035] A guest kernel 214g resides within the guest operating system 212g. The kernel is a computer program that is the core of an operating system with full access and control over the OS. That is, the kernel is an intermediate host between the application 110s and the hardware resources 110h of the host. Most modern computing systems divide virtual memory into a protected kernel space and a user space 216g. The kernel is typically retained in volatile memory within the protected kernel space and is isolated from the user space 216g. To enhance security and reliability, applications 110s and other software services typically execute within the guest user space 216g and lack the privileges necessary to interact with the protected kernel space.

[0036] Return reference Figure 1 , the cloud network 200 may also execute a firewall intelligent module 270, and the firewall intelligent module 270 includes a log processing module 300 ( Figure 3 ), a machine learning engine 400 ( Figure 4A and 4B ), and an aggregation module (500). The firewall intelligent module 270 obtains a plurality of firewall logs 302 generated by a firewall logger 280 of the system. Each firewall log 302 corresponds to a connection request 28 received from a user device 20. Each firewall log 302 includes a firewall rule 312 associated with the connection request 28.

[0037] Refer to Figure 3 , the log processing module 300 includes a firewall rule determiner 310, a sub-rule generator 320, a firewall log filter 330, a sub-rule mapper 340, and a hit counter 350. The log processing module 300 is configured to receive or obtain a first set of firewall logs 302 corresponding to a utilization period (e.g., the previous 50 days). The log processing module 300 uses the logs 302 to determine the firewall rules 312, sub-rules 322, and attributes 324 of the firewall, and then generates utilization data 352 including the hit counts of the firewall rules 312, sub-rules 322, and / or attributes 324.

[0038] The rule determiner 310 obtains multiple firewall logs 302 for a predetermined utilization period (e.g., the previous 50 days) from the firewall logger 280 of the distributed system 200. The rule determiner 310 is configured to determine firewall rules 312 based on the firewall logs 302. The firewall logs 302 include information about connection requests 28 from one or more user devices 20 that request access to the distributed system 200. In particular, the firewall logs 302 may include the traffic direction of the connection request 28 (e.g., ingress or egress), the firewall rule action of the connection request 28 (e.g., allow or block), the timestamp of the connection request 28, or any other information about the request. Each of the multiple firewall logs 302 may be generated in response to a triggering event, such as receiving, accepting, and / or rejecting a connection request 28 from the user device 20. The firewall logs 302 may also be generated at set time intervals (e.g., every hour, daily, weekly, etc.). The firewall logs 302 may be stored in the storage resource 206 of the distributed system 200 and / or the memory hardware 24 of the user device 20.

[0039] The rule determiner 310 determines firewall rules 312 that control access to the distributed system 200 based on the multiple firewall logs 302. The firewall rules 312 define the attributes 324 required for a connection request 28 from the user device 20 to the distributed system 200 in order for the user device 20 to access the distributed system 200. The attributes 324 of the connection request 28 from the user device 20 may be grouped into attribute groupings 314, 314a-d, including a source attribute grouping 314a, a target attribute grouping 314b, a port range attribute grouping 314c, and an IP protocol attribute grouping 314d.

[0040] The source attribute grouping 314a defines one or more attributes 324 of the source of the connection request 28 that accesses the distributed system 200. For example, when the user device 20 sends a connection request 28 to the distributed system 200 to access one of the computing resources 202, the user device 20 is the source. Here, each attribute 324 of the user device 20 represents one of the attributes 324 of the source attribute grouping 314a. The attributes 324 of the source attribute grouping 314a may include a source Internet protocol (IP) range, a source label, and a source service account. The firewall rules 312 may define one or more attribute values for each attribute 324 in the source attribute grouping 314a. For example, the attribute values of the source IP range attribute grouping 314a include specific values of the source IP range of the user device 20.

[0041] The target attribute grouping 314b defines one or more attributes of the requested target. For example, in the case where the user device 20 requests access to a specific computing resource 202, the specific computing resource 202 is the target. The target attribute grouping 314b may include a target label and the attributes 324 of the target service account. The firewall rule 312 may define one or more attribute values for each attribute 324 in the target attribute grouping 314b. For example, the attribute values of the target label attribute may include "receiver" and / or "receiver_tmp". Optionally, the firewall rule 312 may define one or more attribute values of the port range attribute grouping 314c and / or the IP protocol attribute grouping 314d associated with the connection request.

[0042] The user device 20 including one or more attribute values defined by the attribute grouping 314 of the firewall rule 312 is allowed to access the computing resource 202. In contrast, the user device 20 not including the attribute values defined by the attribute grouping 314 of the firewall rule 312 is denied access to the computing resource 202. In some examples, the firewall rule 312 requires the user device 20 to include a specific combination of one or more attribute values (e.g., the sub-rule 322) to access the computing resource 202. That is, the firewall rule 312 may require the user device 20 to include the attribute values that satisfy one or more of the source attribute grouping 314a, the target attribute grouping 314b, the port range attribute grouping 314c, and / or the IP protocol attribute grouping 314d. In some examples, the rule determiner 310 determines multiple firewall rules 312 for each firewall log 302 among the multiple firewall logs 302. The rule determiner 310 sends each firewall rule 312 to the sub-rule generator 320.

[0043] The sub - rule generator 320 is configured to generate all possible sub - rules 322 for each firewall rule 312 using the attribute groups 314. Each sub - rule 222 represents one of the acceptable combinations of the attribute values 324, 324a - d defined by the firewall rule 312. For example, an example firewall rule 312 can define the attribute values 324 including (i) a source IP range attribute 324a with acceptable attribute values “103.18.18.0 / 22” or “10.0.0.1”, (ii) a source label attribute 324a with an acceptable attribute value “sender”, (iii) a destination label attribute 324b with acceptable attribute values “receiver” and “receiver_tmp”, and (iv) a port range attribute 324c with acceptable attribute values “tep:100 - 120 and udp:200”. Here, the firewall rule 312 defines three attributes 324a (e.g., 103.18.18.0 / 22, 10.0.0.1, sender) in the source attribute group 314a, two attributes 324b (e.g., receiver, receiver_tmp) in the destination attribute group 314b, and two attributes 324c (e.g., tep:100 - 120, udp:200) in the port range attribute group 314c, for a total of 12 attribute - value combinations (i.e., 3×2×2). Each of the twelve combinations of acceptable attribute values defines a sub - rule 222. For example, (103.18.18.0 / 22, receiver and tep:100 - 120) is one of the sub - rules 322, and (sender, receiver and tep:100 - 120) is another one of the sub - rules 322 from the twelve possible sub - rules 322. The sub - rule generator 320 sends all possible sub - rules 322 associated with each firewall rule 312 to the hit counter 250.

[0044] In some examples, the sub - rule generator 320 is configured to execute a sub - rule generation function f 322 , to generate all combinations of the possible sub - rules 322 for a particular firewall rule 312. One example implementation of the sub - rule generation function f 322 includes a deep nested for - loop that enumerates all combinations of the possible sub - rules 322 for each repeating attribute 324 in the firewall rule 312. The sub - rule generation function f 322Iterate through each repeated attribute 324 in the iterative firewall rules 312 and enumerate all sub-rules 322 by flattening each repeated attribute 324. In the case where the actually repeated attribute 324 is empty, a dummy array containing a single dummy element can be used to enable iteration over the attribute 324 and generate all combinations for the remaining attributes 324 within the loop.

[0045] The firewall log filter 330 (also referred to herein as the log filter 330) is configured to filter a plurality of firewall logs 302 of a utilization period into filtered firewall logs 302F. The log filter 330 filters the plurality of firewall logs 302 into a subset of filtered firewall logs 302F based on filtering criteria 332, 332a-d. The filtering criteria 332 may include the requested traffic direction 332a (e.g., ingress or egress), the requested firewall rule action 332b (e.g., allow or block), the requested timestamp 332c, or any other information 332d regarding the request. For example, a filtering criteria 332 including the ingress traffic direction 332a will filter out all firewall logs 302 that do not include ingress traffic. The log filter 330 allows the user 12 or system administrator to filter the plurality of firewall logs 302 to consider only the firewall logs 302 that meet the desired filtering criteria 332. The log filter 330 sends the subset of filtered firewall logs 302F to the sub-rule mapper 240.

[0046] The sub-rule mapper 240 is configured to use the same sub-rule generation function f as the sub-rule generator 320 322To determine sub-rules 322, 322H of the filtered firewall logs 302F (e.g., firewall logs of interest). Thus, the sub-rule mapper 240 evaluates each filtered firewall log 302F to determine which firewall sub-rules 322H are used or hit by the corresponding connection requests 28. A hit sub-rule 322H is a specific sub-rule 322 used by the user device 20 to access the computing resource 202. That is, whenever the user device 20 accesses one of the computing resources 202 with a specific sub-rule 222, the sub-rule mapper 240 marks the specific sub-rule 222 as a hit. For example, the firewall rule 312 defines the allowable source label attribute 324a for "sender" and "sender_tmp" and the allowable port range attribute 324c for "tep:100 - 120" and "udp:200". In this example, the user device 20 including the (sender, tep:100 - 120) sub-rule 322 is allowed to access the computing resource 202. The sub-rule mapper 340 maps the sub-rule 322 of (sender, tep:100 - 120) as a hit sub-rule 322H because this specific sub-rule 322 is used to access the computing resource 202. The sub-rule mapper 340 sends each hit sub-rule 322H of the filtered firewall logs 302F to the hit counter 350.

[0047] The hit counter 350 is configured to generate utilization data 352 including a hit count for each sub-rule 322. In the illustrated example, the hit counter 350 generates utilization data 352 for each of the twelve sub-rules 322 identified by the sub-rule generator 320. In particular, the hit counter 350 receives all possible sub-rules 322 from the sub-rule generator 320 and the hit sub-rules 322H for the filtered firewall logs 302F from the sub-rule mapper 240. Thus, the hit counter 350 can determine which sub-rule 322 is used to access the computing resource 202 from all possible sub-rules 322 and hit sub-rules 322H. The hit counter 350 can also produce a count associated with each of the hit sub-rules 322H. The count represents the number of times the specific sub-rule 322, 322H has been used to access the computing resource 202. The hit counter 350 aggregates all sub-rules 322, hit sub-rules 322H, and counts them into the utilization data 352. The hit counter 350 can be executed at a desired periodic interval to generate new utilization data 352. For example, the hit counter 350 can generate utilization data 352 at a time interval (e.g., daily) or a volume interval (e.g., every 1000 filtered firewall logs 302F). The hit counter 350 can store the utilization data 352 in the storage resource 206 for training the model 402 and / or executing the model 402.

[0048] The firewall intelligent module 270 further includes a machine learning engine 400, which is configured to train and execute a firewall utilization model 402 to inform and assist a network administrator in determining which firewall rules 312 or attributes 324 are being utilized. Generally, the rule-level utilization analysis performed by the firewall intelligent module 270 shows which firewall rules 312 are being actively used. However, since the sub-rules 322 are in an OR relationship with each other, the rule-level analysis cannot guarantee the use of each sub-rule 322. Therefore, there may be broader rules 312 than necessary, which may allow unwanted requests in the future. To detect this problem, the firewall intelligent module 270 performs utilization analysis at a finer level: sub-rules. At the sub-rule level, the firewall intelligent module 270 can determine which sub-rules 322 are actually hit and thus which attributes 324 are required.

[0049] Although the sub-rule-level utilization data 352 is more useful than the rule-level data, it is not sufficient to take actions on the firewall rules 312. For example, a sub-rule 322 may have zero hits on a given day but may be required in the future. Therefore, even with the sub-rule-level utilization data 352, it is not easy for the network administrator to decide whether the existing firewall rules 312 need to be modified.

[0050] To inform and assist the network administrator, the firewall intelligent module 270 implements the machine learning engine 400 to derive rule-level and attribute-level insights from the utilization data 352. The machine learning engine 400 can determine the probability that a specific attribute 324 will be hit in the future based on historical sub-rule utilization patterns. In this way, unwanted attributes 324 can be safely inferred and reported to the network administrator so that they can make informed decisions to modify the firewall rules 312.

[0051] The machine learning engine 400 can be implemented as a machine learning engine and includes a prediction module 410 ( Figure 4A ) and a training module 420 ( Figure 4B ). Generally, the prediction module 410 is configured to predict the future hit probabilities of unused rules 312, sub-rules 322, and / or attributes 324. Based on the prediction, the prediction module 410 outputs training data 432 and utilization insights 484, 494 for subsequent iterations of the firewall utilization model 402. The training module 420 receives the training data 414 from the prediction module 410 and trains the firewall utilization model 402 for use by the prediction module 410 in subsequent iterations of determining the hit probabilities of unused rules 312, sub-rules 322, and attributes 324.

[0052] The prediction module 410 includes a training data generator 430 that receives utilization data 352 and uses the utilization data 352 to generate training data 432. The training data generator 430 converts each sub - rule 322 into a feature vector and associates each sub - rule with labels such as "hit" (hit count > 0) and "miss" (hit count = 0). The labeled training data 432 is used by the training module 420 to train a new or existing firewall utilization model 402.

[0053] Referring Figure 4B , the training module 420 receives the labeled training data 432 from the training data generator 430 and uses the training data 432 to build and train one or more firewall utilization models 402. Generally, the training module 420 performs a training process to train the firewall utilization model 402 on the training data 432. The training process can include the implementation of one or more machine - learning algorithms and / or statistical analyses for identifying trends or patterns in the training data 432, which can then be used to predict future hits of the firewall sub - rules 322. The training module 420 can also use machine - learning and statistical analyses to fine - tune and / or adjust the parameters of the firewall utilization model 402. Here, the training module 420 can continuously improve the determination of the predicted hits of the firewall sub - rules 322. Machine - learning can include, for example, supervised learning, unsupervised learning, semi - supervised learning, transduction, reinforcement learning, and other learning algorithms. For example, machine - learning algorithms can include AODE, artificial neural networks, Bayesian algorithms, case - based reasoning, decision - tree algorithms, Gaussian process regression, regression analysis, fuzzy algorithms, and / or custom machine - learning algorithms that incorporate aspects of any machine - learning algorithm.

[0054] As described above, an example firewall sub - rule 322 can have seven attributes 324: source range 324a, source label 324a, source service account 324a, target label 324b, target service account 324b, port range 324c, and IP protocol 324d. However, for training and inference purposes, the sub - rule 322 can be represented as a 3 - tuple (source attribute, target attribute, port - range attribute) because, by definition, at most one of the three source - related attributes 324a is non - empty and at most one of the two target - related attributes 324b is non - empty.

[0055] Some source and target attributes 324 are only meaningful for the specific network 200 to which they belong. These are the source label 324a, source range 324a, and target label 324b. Thus, when using these attribute values 324a, 324b for inference or training, the training module 420 prepends a "network" identifier to distinguish these attributes 324 from the same attributes 324 defined in an external network. For example, if the source range is "10.0.0.1", it is converted to "network_identifier:10.0.0.1". However, if it is an external source range, such as '210.10.10.10.10', it remains as is. If the'source' is empty, it is assumed to be '0.0.0.0 / 0' because an empty source means no restriction on incoming connections. If the 'target' is empty, it is assumed to be 'network_identifier:**every_VM_in_network**' (any unique string after the network prefix can be used).

[0056] During training, the training module 420 combines all possible values of the attributes 324 of "source" and "target" observed in the training data 432 to create a source-target vocabulary. Similarly, the training module 420 creates a port range vocabulary 422. Later, these vocabularies are used to convert string attribute values into one-hot encoded feature vectors. By concatenating these three sparse vectors, the training module 420 obtains a feature representation for each sub-rule 322.

[0057] In Figure 4B the example of, the firewall exploitation model 402 is shown as a neural network. The input layer 404 receives the training data 432 described above. The next layer 406 is the embedding layer 406, which maps the feature vectors to lower-dimensional features. The ELU (exponential linear unit) layer 408 is configured to capture feature non-linearity. The computational layer 409 determines the inner product of the output of the ELU layer 408 to create associations between different attributes 324. The output layer of the firewall exploitation model 402 is a sigmoid that maps the result to a value between 0 and 1, which can be interpreted as the future hit probability.

[0058] Once the firewall exploitation model 402 is trained, the training module 420 executes a two-step framework to evaluate and validate the performance of the firewall exploitation model 402. In the initial step, the firewall exploitation model 402 is evaluated by determining whether the firewall exploitation model 402 meets the performance criteria to ensure that the firewall exploitation model 402 is ready to be used in the production network 200. Once the firewall exploitation model 402 is in the production network 200 (e.g., Figure 4AIn some embodiments, the firewall utilization model 402 is evaluated periodically (e.g., daily) while the firewall rules are implemented in the blocks 450 - 490 to determine whether the predicted sub - rule utilization accurately reflects the actual sub - rule utilization. In some embodiments, multiple firewall utilization models 402 are trained and ranked for execution by the machine learning engine 400. Thus, when the performance of the current firewall utilization model 402 drops below a threshold performance value, the current firewall utilization model 402 can be replaced by one of the ranked firewall utilization models 402.

[0059] Continuing to refer Figure 4A , the prediction module 410 executes the current iteration of the trained firewall utilization model 402. The firewall utilization model 402 is configured to predict the future hit probabilities of the firewall rules 312, sub - rules 322, and attributes 324 based on rule utilization data (e.g., utilization data 352). The future hit probability represents the likelihood that a particular firewall rule 312, sub - rule 222, and attribute 324 will be used or hit by a connection request 28 in the future.

[0060] The prediction module 410 can include a sub - rule probability generator 450, an attribute probability generator 460, and a rule probability generator 470. The sub - rule probability generator 450 is configured to generate sub - rule utilization probabilities 452 for each sub - rule 322 based on the utilization data 352 and the firewall utilization model 402. That is, based on all possible sub - rules 322, the hit sub - rule 322H, and the count associated with the hit sub - rule 322H, the sub - rule probability generator 450 determines the likelihood that a particular sub - rule 222 will be hit in the future. In some examples, the sub - rule probability generator 450 generates sub - rule utilization probabilities 452 only for unused sub - rules 322. In other examples, the sub - rule probability generator 450 generates sub - rule utilization probabilities 452 for all possible sub - rules 322. The sub - rule probability generator 450 sends the sub - rule utilization probabilities 452 for each sub - rule 322 to the attribute probability generator 460 and the firewall rule probability generator 470.

[0061] The attribute probability generator 460 is configured to generate attribute probabilities 462 that represent the likelihood that a particular attribute 324 of the firewall rule 312 will be used in the future. The attribute probability generator 460 generates the attribute probabilities 462 based on the aggregation of the sub - rule utilization probabilities 452. That is, for each attribute 324 that was not used during the utilization period, the attribute probability generator 460 aggregates the sub - rule utilization probabilities 452 of all sub - rules 322 that include the particular attribute 324. The attribute utilization probability 462 can be expressed as:

[0062]

[0063] In Equation (1), P(attribute value ) represents the probability 462 that a specific attribute 324 is used, represents the probability that the first sub - rule 222 including the specific attribute 324 is not used, and represents the probability that the nth sub - rule 222 including the specific attribute 324 is not hit. Thus, by aggregating the sub - rule utilization probabilities 452 of each sub - rule 322 of the sub - rules 322 including the specific attribute 324, the attribute probability generator 460 determines the probability 462 that the specific attribute 324 will be used in the future. The attribute probability generator 460 sends each attribute utilization probability 462 to the attribute comparator 480.

[0064] The attribute comparator 480 is configured to identify attributes 324 that are similar to each unused attribute (i.e., an attribute with zero hits). In particular, for each attribute 324, the attribute comparator 480 determines a similarity score 482 that represents the similarity between a specific attribute 324 and an unused attribute 324. The attribute comparator 480 determines the attribute similarity score 482 by comparing the attribute utilization probabilities 462 of each attribute 324. In particular, the attribute comparator 480 determines that attributes 324 with similar attribute probabilities 462 include similar attribute information.

[0065] In some examples, the prediction module 410 can determine attributes 324 that can be eliminated from the firewall rules 312 based on the attribute probabilities 462 and the similarity scores 482. For example, an attribute 324 including an attribute probability 462 that fails to meet a threshold can be eliminated from the firewall rules 312 because the likelihood of being hit in the future is low. In another example, an attribute 324 including a similarity score 482 that meets a threshold can be eliminated because the attribute 324 is a copy of another attribute 324. That is, an attribute 324 can be similar enough to another of the attributes 324 such that the attribute 324 does not need to be included in the firewall rules 312. The similarity score 482 and the attribute probability 462 can be stored as unused attribute insights 484, and network administrators can use the attribute insights 484 to modify the attributes 324.

[0066] The rule probability generator 470 is configured to generate a rule probability 472 that represents the likelihood that each firewall rule 312 will be hit in the future. That is, for each firewall rule 312 that is not used during the utilization period, the rule probability generator 470 aggregates the sub - rule utilization probabilities 452 of all possible sub - rules 322 of the firewall rule 312. The firewall rule probability 472 can be expressed as:

[0067]

[0068] In equation (2), P(rule) represents the probability that a firewall rule is used, represents the probability that the first sub - rule 222 of firewall rule 312 is not used, and represents the probability that the nth sub - rule 222 of firewall rule 312 is not used. The firewall rule probability generator 470 sends each rule probability 472 to the firewall rule comparator 490.

[0069] The firewall rule comparator 490 is configured to find rules 312 that are similar to each unused rule 312. In particular, for each firewall rule 312, the firewall rule comparator 490 determines a rule similarity score 492 by comparing the attributes 324 between firewall rules 312. When firewall rules have a common threshold number of attributes 324, the firewall rule comparator 490 determines that the firewall rules are similar, resulting in a high rule similarity score 492 for the corresponding firewall rules 312. The rule probability generator 470 and the rule comparator 490 compile and store the corresponding rule probabilities 472 and rule similarity scores 492 as unused rule insights 494. Overall, the unused rule insights 494 and the unused attribute insights 484 can be referred to as Utilization Insight 484, 494.

[0070] Returning to Figure 1 , the firewall intelligence module 270 may also include an aggregation module 500 ( Figure 5 ), and the aggregation module 500 is configured to aggregate the recommended firewall configurations provided by each of the prediction module 410 (i.e., using the trained firewall utilization model 402) and a reachability module 540 that operates independently of the machine learning engine 400. For example, the reachability module 540 provides reachability insights 542 related to shadowed firewall rules 312 (i.e., rules that overlap with other rules) and unused firewall rules 312 that have not been hit over a period of time (e.g., 50 days), while the machine learning engine 400 provides utilization insights 484, 494 that predict the probability that unused rules 312 or attributes 324 will be used in the future.

[0071] Different types of insights 542, 484, 494 may lead to conflicts. For example, the utilization insights 484, 494 generated by the prediction module 410 include the sub - rules 322 of all firewall rules 312, and all firewall rules 312 may need to be modified to filter out the unused and shadow rules identified by the reachability insights 542. Additionally, some rules 312 may have overlapping behavior where they are shadowed and not used. These overlapping rules 312 may need to be combined.

[0072] As Figure 5 shown, the reachability analyzer 510 of the aggregation module 500 polls the reachability module 540 to obtain reachability insights 542, which include unused rule insights 542a and shadow rule insights 542b. The utilization insights 484, 494 generated by the machine learning engine 400 are obtained using the analyzer 520. Then the rule aggregator 530 groups all the insights 542, 484, 494 based on the firewall rules 312. In one configuration, the rule aggregator 530 sorts the different insights 542, 484, 494 using a specific sorting criterion such as shadow rules > unused rules > sub - rule utilization to group the insights 542, 484, 494. Then, the aggregation module 500 presents the highest - ranked insights 542, 484, 494 of each firewall rule 312 to the system administrator as firewall configuration suggestions 532. Thus, in the case where the firewall rules 312 include shadow insights 542 and utilization insights 484, the rule aggregator 530 can generate the firewall configuration suggestions 532 based only on the shadow insights 542. Although the aggregation module 500 is shown in Figure 1 as being incorporated as part of the firewall intelligence module 270, the aggregation module 500 can operate independently of the firewall intelligence module 270.

[0073] Figure 6 is a flowchart of an exemplary arrangement of operations of a method 600 for processing firewall insights using machine learning. The method 600 includes, at operation 602, receiving firewall utilization data 352 for connection requests 28 received by the firewall during a utilization period, where the firewall utilization data 352 includes the hit count of each sub - rule 322 of a set of sub - rules 322 associated with at least one firewall rule during the utilization period. At operation 604, the method 600 includes generating training data 432 based on the firewall utilization data 352, where the training data 432 includes unused sub - rules 322 corresponding to sub - rules 322 that did not have hits during the utilization period, and hit sub - rules 322H corresponding to sub - rules 322H that had more than zero hits during the utilization period. At operation 606, the method 600 further includes training a firewall utilization model 402 on the training data 432. At operation 608, the method 600 includes: for each sub - rule 322 in the set of sub - rules 322 associated with at least one firewall rule, using the trained firewall utilization model 402 to determine a corresponding sub - rule utilization probability 452, indicating the likelihood that the sub - rule 322 will be used for future connection requests 28.

[0074] Figure 7FIG. 0 is a schematic diagram of an exemplary computing device 700 that can be used to implement the systems and methods described herein. Computing device 700 is used to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely exemplary and are not intended to limit the implementation of the invention described and / or claimed in this document.

[0075] Computing device 700 includes a processor 710, a memory 720, a storage device 730, a high-speed interface / controller 740 connected to the memory 720 and a high-speed expansion port 750, and a low-speed interface / controller 760 connected to a low-speed bus 770 and the storage device 730. Each of the components 710, 720, 730, 740, 750, and 760 is interconnected using various buses and can be suitably mounted on a common motherboard or otherwise installed. The processor 710 can process instructions for execution within the computing device 700, including instructions stored in the memory 720 or on the storage device 730, to display graphical information of a graphical user interface (GUI) on an external input / output device (such as a display 780 coupled to the high-speed interface 740). In other embodiments, multiple processors and / or multiple buses, as well as multiple memories and memory types, can be suitably used. Additionally, multiple computing devices 700 can be connected, each providing a portion of the necessary operations (such as, for example, as a server farm, a set of blade servers, or a multi-processor system).

[0076] The memory 720 stores information non-transitorily within the computing device 700. The memory 720 can be a computer-readable medium, a volatile memory unit, or a non-volatile memory unit. The non-transitory memory 720 can be a physical device for temporarily or permanently storing programs (such as sequences of instructions) or data (such as program state information) used by the computing device 700. Examples of non-volatile memory include (but are not limited to) flash memory and read-only memory (ROM) / programmable read-only memory (PROM) / erasable programmable read-only memory (EPROM) / electrically erasable programmable read-only memory (EEPROM) (such as, typically, for firmware, such as a boot program). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase change memory (PCM), and magnetic disks or tapes.

[0077] The storage device 730 can provide mass storage for the computing device 700. In some embodiments, the storage device 730 is a computer-readable medium. In various different embodiments, the storage device 730 can be a floppy disk device, a hard disk device, an optical disk device, or a magnetic tape device, a flash memory or other similar solid-state memory device, or an array of devices, including devices in a storage area network or other configurations. In additional embodiments, a computer program product is tangibly embodied in an information carrier. The computer program product includes instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer or machine-readable medium, such as the memory 720, the storage device 730, or the memory on the processor 710.

[0078] The high-speed controller 740 manages the bandwidth-intensive operations of the computing device 700, while the low-speed controller 760 manages the less bandwidth-intensive operations. This assignment of responsibilities is merely exemplary. In some embodiments, the high-speed controller 740 is coupled to the memory 720, the display 780 (e.g., via a graphics processor or accelerator), and the high-speed expansion port 750, which can accept various expansion cards (not shown). In some embodiments, the low-speed controller 760 is coupled to the storage device 730 and the low-speed expansion port 790. The low-speed expansion port 790, which can include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet), can be coupled to one or more input / output devices, such as a keyboard, a pointing device, a scanner, or a networking device, such as a switch or a router, for example, via a network adapter.

[0079] The computing device 700 can be implemented in many different forms, as shown in the figure. For example, it can be implemented as a standard server 700a or multiple times as a laptop computer 700b in a group of such servers 700a, or as part of a rack server system 700c.

[0080] The various implementations of the systems and techniques described herein can be implemented in digital electronic and / or optical circuits, integrated circuits, specially designed ASICs (application-specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include implementations in one or more computer programs executable and / or interpretable on a programmable system, the programmable system including at least one programmable processor, which can be dedicated or general-purpose and is coupled to receive and transmit data and instructions from a storage system, at least one input device, and at least one output device.

[0081] A software application (i.e., software resource) can be computer software that causes a computing device to perform tasks. In some examples, a software application may be referred to as an "application", "app", or "program". Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and gaming applications.

[0082] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and can be implemented in high-level procedural and / or object-oriented programming languages and / or in assembly / machine language. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, non-transitory computer-readable medium, apparatus, and / or device (e.g., a disk, optical disk, memory, programmable logic device (PLD)) that provides machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal that provides machine instructions and / or data to a programmable processor.

[0083] The processes and logical flows described in this specification can be performed by one or more programmable processors (also referred to as data processing hardware) executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logical flows can also be performed by special-purpose logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit). For example, processors suitable for executing computer programs include general and special purpose microprocessors, and any one or more processors of any type of digital computer. Generally, a processor will receive instructions and data from a read only memory or a random access memory or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include or be operatively coupled to receive data from or transfer data to one or more mass storage devices for storing data, such as magnetic disks, magneto-optical disks, or optical disks. However, a computer need not have such devices. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special-purpose logic circuitry.

[0084] To provide for interaction with a user, one or more aspects of the present disclosure may be implemented on a computer having a display device such as, for example, a CRT (cathode ray tube), an LCD (liquid crystal display) monitor, or a touch screen for displaying information to the user and, optionally, also having a keyboard and a pointing device such as a mouse or a trackball by which the user can provide input to the computer. Other types of devices may also be used to provide for interaction with the user; for example, feedback provided to the user may be any form of sensory feedback such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form including, but not limited to, sound, voice, or tactile input. Additionally, the computer may interact with the user by sending documents to and receiving documents from the device used by the user; for example, by sending a web page to a web browser on a client device of the user in response to a request received from the web browser.

[0085] A variety of implementations have been described. However, it should be understood that various modifications may be made without departing from the spirit and scope of the present disclosure. Accordingly, other implementations are within the scope of the appended claims.

Claims

1. A computer-implemented method (600), characterized in that When executed on data processing hardware (204), cause the data processing hardware (204) to perform operations for training a firewall utilization model (402), the operations including: Obtain (602) firewall utilization data (352) of connection requests (28) received by a firewall during a utilization period, the firewall utilization data (352) including a hit count for each sub - rule in a set of sub - rules (322) associated with at least one firewall rule (312) during the utilization period; Generate (604) training data (432) based on the firewall utilization data (352), the training data (432) including unused sub - rules (322) corresponding to sub - rules (322) having zero hits during the utilization period and hit sub - rules (322) corresponding to sub - rules (322) having more than zero hits during the utilization period; Train (606) the firewall utilization model (402) on the training data (432); and For each sub - rule in the set of sub - rules (322) associated with the at least one firewall rule (312), use the trained firewall utilization model (402) to determine (608) a corresponding sub - rule utilization probability (462), the corresponding sub - rule utilization probability (462) indicating the likelihood that the sub - rule will be used for future connection requests (28), The operations further include: Determine a firewall attribute grouping (314) of the at least one firewall rule (312), each firewall attribute grouping (314) including at least one attribute (324); Determine a first set of sub - rules (322) associated with the at least one firewall rule (312) based on the firewall attribute grouping (314); Receive a plurality of firewall logs (302) associated with connection requests (28) received by the firewall during the utilization; Filter the plurality of firewall logs (302) based on a filtering criterion (332); Determine a second set of sub - rules (322H) associated with the plurality of firewall logs (302); and Generate the firewall utilization data (352) based on the first set of sub - rules (322) and the second set of sub - rules (322H).

2. The computer-implemented method (600) according to claim 1, wherein, The firewall attribute grouping (314) includes at least three of a source attribute grouping (314a), a target attribute grouping (314b), a port range (314c), or an Internet Protocol (IP) (314d).

3. The computer-implemented method (600) according to claim 2, wherein, The firewall attribute grouping (314) includes the source attribute grouping (314a); and The source attribute grouping (314a) includes: A source IP range (324a); A source label (324a); and A source service account (324a).

4. The computer-implemented method (600) according to claim 2, wherein, The firewall attribute grouping (314) includes the target attribute grouping (314b); and The target attribute grouping (314b) includes: A target label (324b); and A target service account (324b).

5. The computer-implemented method (600) according to any one of claims 1-4, characterized in that, The operations further include: Receive firewall reachability insights (542) from a reachability module (540); Generate firewall utilization insights (484) based on corresponding sub-rule utilization probabilities (462) determined for each sub-rule; Aggregate the firewall reachability insights (542) and the firewall utilization insights (484); and Generate firewall configuration recommendations (532) based on the aggregated firewall reachability insights (542) and the aggregated firewall utilization insights (484).

6. The computer-implemented method (600) according to any one of claims 1-4, characterized in that, The operations further include: Determine firewall rule attributes (324) that were not used during the utilization; For each unused firewall rule attribute (324), aggregate the sub-rule utilization probabilities of all sub-rules (322) including the unused firewall rule attribute (324); and Determine the probability (462) that the attribute (324) will be hit in the future based on the aggregated sub-rule probabilities (472).

7. A system for training a firewall insight model, characterized in that, The system includes: Data processing hardware (204); and Memory hardware (24, 206) in communication with the data processing hardware (204), the memory hardware (24, 206) storing instructions that, when executed by the data processing hardware (204), cause the data processing hardware (204) to perform the following operations: Obtain (602) firewall utilization data (352) for connection requests (28) received by a firewall during a utilization period, the firewall utilization data (352) including a hit count for each sub-rule in a set of sub-rules (322) associated with at least one firewall rule (312) during the utilization period; Generate (604) training data (432) based on the firewall utilization data (352), the training data (432) including unused sub-rules (322) corresponding to sub-rules (322) that had zero hits during the utilization period and hit sub-rules (322) corresponding to sub-rules (322) that had more than zero hits during the utilization period; Train (606) a firewall utilization model (402) on the training data (432); and For each sub-rule in the set of sub-rules (322) associated with the at least one firewall rule (312), use the trained firewall utilization model (402) to determine (608) a corresponding sub-rule utilization probability (462), the corresponding sub-rule utilization probability (462) indicating the likelihood that the sub-rule will be used for future connection requests (28), The operations further include: Determine a firewall attribute grouping (314) for the at least one firewall rule (312), each firewall attribute grouping (314) including at least one attribute (324); Determine a first set of sub-rules (322) associated with the at least one firewall rule (312) based on the firewall attribute grouping (314); Receive a plurality of firewall logs (302) associated with connection requests (28) received by the firewall during the utilization; Filter the plurality of firewall logs (302) based on a filtering criterion (332); Determine a second set of sub-rules (322H) associated with the plurality of firewall logs (302); and Generate the firewall utilization data (352) based on the first set of sub-rules (322) and the second set of sub-rules (322H).

8. The system according to claim 7, wherein The firewall attribute grouping (314) includes at least three of a source attribute grouping (314a), a destination attribute grouping (314b), a port range (314c), or an Internet Protocol (IP) (314d).

9. The system according to claim 8, wherein The firewall attribute grouping (314) includes the source attribute grouping (314a); and The source attribute (314a) grouping includes: A source IP range; A source label (324a); and A source service account (324a).

10. The system according to claim 8, wherein The firewall attribute grouping (314) includes the destination attribute grouping (314b); and The destination attribute grouping (314b) includes: A destination label (324b); and A destination service account (324b).

11. The system according to claim 7, wherein The operation further includes: Receiving firewall reachability insights (542) from a reachability module (540); Generating firewall utilization insights (484) based on a respective sub-rule utilization probability (462) determined for each sub-rule; Aggregating the firewall reachability insights (542) and the firewall utilization insights (484); and Generating firewall configuration recommendations (532) based on the aggregated firewall reachability insights (542) and the aggregated firewall utilization insights (484).

12. The system according to any one of claims 7-11, characterized in that, The operation further includes: Determining firewall rule attributes (324) that were not used during the utilization period; For each unused firewall rule attribute (324), aggregating the sub-rule utilization probabilities of all sub-rules (322) including the unused firewall rule attribute (324); and Determining the probability (462) that an attribute (324) will be hit in the future based on the aggregated sub-rule probabilities (472).

13. A computer program product encoded on a non-transitory computer-readable storage medium including instructions, characterized in that, When executed by a data processing device, the instructions cause the data processing device to perform the following operations: Obtain (602) firewall utilization data (352) for connection requests (28) received by a firewall during a utilization period, the firewall utilization data (352) including a hit count for each sub-rule in a set of sub-rules (322) associated with at least one firewall rule (312) during the utilization period; Generate (604) training data (432) based on the firewall utilization data (352), the training data (432) including unused sub-rules (322) corresponding to sub-rules (322) having zero hits during the utilization period and hit sub-rules (322) corresponding to sub-rules (322) having more than zero hits during the utilization period; Train (606) a firewall utilization model (402) on the training data (432); And For each sub - rule in the set of sub - rules (322) associated with the at least one firewall rule (312), a trained firewall exploitation model (402) is used to determine (608) a corresponding sub - rule exploitation probability (462), where the corresponding sub - rule exploitation probability (462) indicates the likelihood that the sub - rule will be used for a future connection request (28). The operations further include: Determining a firewall attribute grouping (314) of the at least one firewall rule (312), where each firewall attribute grouping (314) includes at least one attribute (324); Based on the firewall attribute grouping (314), determining a first set of sub - rules (322) associated with the at least one firewall rule (312); Receiving a plurality of firewall logs (302) associated with connection requests (28) received by the firewall during the exploitation; Filtering the plurality of firewall logs (302) based on a filtering criterion (332); Determining a second set of sub - rules (322H) associated with the plurality of firewall logs (302); and Generating the firewall exploitation data (352) based on the first set of sub - rules (322) and the second set of sub - rules (322H).

14. The computer program product according to claim 13, wherein, The operations further include: Determining firewall rule attributes (324) that were not used during the exploitation; For each unused firewall rule attribute (324), aggregating the sub - rule exploitation probabilities of all sub - rules (322) including the unused firewall rule attribute (324); and Based on the aggregated sub - rule probabilities (472), determining the probability (462) that the attribute (324) will be hit in the future.

Images