Programming security rules into network devices

Abstract

To provide security for a communication network in a communication system.SOLUTION: Various exemplary embodiments that support network security for a communication network are presented in the present specification. Various exemplary embodiments that support network security for a communication network may be configured to support programming of security functions, including security rules, into network devices. Various exemplary embodiments that support programming of security functions into network devices may be configured to support programming of security functions into high performance application-specific integrated circuits (ASICs) of the network device. Various exemplary embodiments that support programming of security functions into network devices may be configured to support programming of security functions into various types of network devices, such as routers, switches, servers, or the like.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] Various exemplary embodiments relate generally to communication systems and, more particularly, but not exclusively, to providing security to communication networks in communication systems. [Background technology]

[0002] A communication network may use various communication technologies to support various types of communication. Summary of the Invention

[0003] In at least some exemplary embodiments, the apparatus includes at least one processor and at least one memory that stores instructions, which when executed by the at least one processor, cause the apparatus to perform at least the following steps: receive, for a communication network including a network device, security rules based on a set of security policies, security attack sample information, and Internet information; receive, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; generate, for the network device, device-specific security rules based on a programming language based on compiling the security rules based on the network device information; and transmit the device-specific security rules to the network device. In at least some exemplary embodiments, the security rules are related to at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information. In at least some exemplary embodiments, the instructions, when executed by the at least one processor, cause the apparatus to perform at least the steps of receiving a set of security policies, security attack sample information, and Internet information, and generating security rules based on the set of security policies, the security attack sample information, and the Internet information.In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device-specific format supported by the network device. In at least some exemplary embodiments, the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed by the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some example embodiments, to generate device-specific security rules, the instructions, when executed by at least one processor, cause the apparatus to solve a constraint satisfaction problem including a set of inputs including at least one of a set of security policies, network device information, security goals associated with the security rules, or configuration constraints.In at least some exemplary embodiments, the instructions, when executed by the at least one processor, cause the apparatus to perform at least the step of compiling security rules taking into account at least a portion of the network device information to generate the device-specific security rules. In at least some exemplary embodiments, the network device configuration information includes a hardware capability of the network device, and the device-specific security rules are generated based on the hardware capability of the network device. In at least some exemplary embodiments, the device-specific security rules are generated in a manner that minimizes resource consumption at the network device. In at least some exemplary embodiments, the device-specific security rules are specified in a format supported by the network device as indicated in the network device configuration information. In at least some exemplary embodiments, the device-specific security rules are associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the feedback information includes network telemetry data of the network device for a set of traffic flows processed at the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some example embodiments, the instructions, when executed by at least one processor, cause the apparatus to perform at least the steps of receiving feedback information related to application of device-specific security rules at the network device, generating second device-specific security rules for the network device based on compilation of the security rules based on the feedback information, and transmitting the second device-specific security rules to the network device.In at least some exemplary embodiments, to generate the second device-specific security rule, the instructions, when executed by the at least one processor, cause the apparatus to perform at least the steps of determining validity of the device-specific security rule at the network device based on the feedback information, and generating the second device-specific security rule if the validity of the device-specific security rule at the network device is determined not to meet a threshold. In at least some exemplary embodiments, to generate the second device-specific security rule, the instructions, when executed by the at least one processor, cause the apparatus to perform at least the steps of compiling a security rule taking into account at least a portion of the feedback information. In at least some exemplary embodiments, the second device-specific security rule is a modified version of the device-specific rule, or the second device-specific security rule is a new security rule.

[0004] In at least some exemplary embodiments, the non-transitory computer-readable medium includes computer program instructions that, when executed by the device, cause the device to perform at least the following steps: receiving, for a communication network including a network device, security rules based on a set of security policies, security attack sample information, and Internet information; receiving, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; generating, for the network device, device-specific security rules based on a programming language based on compiling the security rules based on the network device information; and transmitting the device-specific security rules to the network device. In at least some exemplary embodiments, the security rules are related to at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information. In at least some exemplary embodiments, the computer program instructions, when executed by the device, cause the device to at least perform the steps of receiving a set of security policies, security attack sample information, and Internet information, and generating security rules based on the set of security policies, the security attack sample information, and the Internet information.In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device-specific format supported by the network device. In at least some exemplary embodiments, the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed by the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some example embodiments, to generate device-specific security rules, the computer program instructions, when executed by the device, cause the device to perform steps of solving a constraint satisfaction problem including at least a set of inputs including at least one of a set of security policies, network device information, security goals associated with the security rules, or configuration constraints.In at least some exemplary embodiments, the computer program instructions, when executed by the device, cause the device to perform at least a step of compiling security rules taking into account at least a portion of the network device information to generate the device-specific security rules. In at least some exemplary embodiments, the network device configuration information includes a hardware capability of the network device, and the device-specific security rules are generated based on the hardware capability of the network device. In at least some exemplary embodiments, the device-specific security rules are generated in a manner that minimizes resource consumption at the network device. In at least some exemplary embodiments, the device-specific security rules are specified in a format supported by the network device as indicated in the network device configuration information. In at least some exemplary embodiments, the device-specific security rules are associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the feedback information includes network telemetry data of the network device for a set of traffic flows processed at the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some example embodiments, the computer program instructions, when executed by the apparatus, cause the apparatus to perform at least the steps of receiving feedback information related to application of the device-specific security rules at the network device, generating second device-specific security rules for the network device based on compilation of the security rules based on the feedback information, and transmitting the second device-specific security rules to the network device.In at least some exemplary embodiments, to generate the second device-specific security rules, the computer program instructions, when executed by the apparatus, cause the apparatus to at least perform the steps of determining validity of the device-specific security rules at the network device based on the feedback information, and generating the second device-specific security rules if the validity of the device-specific security rules at the network device is determined not to meet a threshold. In at least some exemplary embodiments, to generate the second device-specific security rules, the computer program instructions, when executed by the apparatus, cause the apparatus to at least perform the steps of compiling security rules taking into account at least a portion of the feedback information. In at least some exemplary embodiments, the second device-specific security rules are modified versions of the device-specific rules, or the second device-specific security rules are new security rules.

[0005] In at least some exemplary embodiments, the method includes receiving, for a communication network including a network device, security rules based on a set of security policies, security attack sample information, and Internet information; receiving, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; generating, for the network device, device-specific security rules based on a programming language based on compiling the security rules based on the network device information; and transmitting the device-specific security rules to the network device. In at least some exemplary embodiments, the security rules are related to at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples, or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information. In at least some exemplary embodiments, the method includes receiving a set of security policies, security attack sample information, and Internet information, and generating security rules based on the set of security policies, the security attack sample information, and the Internet information. In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device specific format supported by the network device.In at least some exemplary embodiments, the at least one capability of the network device includes at least one of hardware capabilities supported by the network device, operating system capabilities supported by the network device, or programming language capabilities supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed at the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, generating the device-specific security rules includes solving a constraint satisfaction problem including a set of inputs including at least one of a set of security policies, network device information, security goals associated with the security rules, or configuration restrictions. In at least some exemplary embodiments, generating the device-specific security rules includes compiling the security rules taking into account at least a portion of the network device information. In at least some exemplary embodiments, the network device configuration information includes hardware capabilities of the network device, and the device-specific security rules are generated based on the hardware capabilities of the network device. In at least some exemplary embodiments, the device-specific security rules are generated in a manner that minimizes resource consumption at the network device.In at least some exemplary embodiments, the device-specific security rules are specified in a format supported by the network device as indicated in the network device configuration information. In at least some exemplary embodiments, the device-specific security rules are associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the feedback information includes network telemetry data of the network device for a set of traffic flows processed at the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the method includes receiving feedback information related to application of the device-specific security rules at the network device, generating second device-specific security rules for the network device based on compilation of the security rules based on the feedback information, and transmitting the second device-specific security rules to the network device. In at least some exemplary embodiments, generating the second device-specific security rules includes determining validity of the device-specific security rules at the network device based on the feedback information, and generating the second device-specific security rules if the validity of the device-specific security rules at the network device is determined not to meet a threshold. In at least some exemplary embodiments, generating the second device-specific security rules includes compiling security rules taking into account at least a portion of the feedback information. In at least some exemplary embodiments, the second device-specific security rules are modified versions of the device-specific rules, or the second device-specific security rules are new security rules.

[0006] In at least some exemplary embodiments, the apparatus includes means for receiving, for a communication network including the network device, security rules based on a set of security policies, security attack sample information, and Internet information; means for receiving, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; means for generating, for the network device, device-specific security rules based on a programming language based on compiling the security rules based on the network device information; and means for transmitting the device-specific security rules to the network device. In at least some exemplary embodiments, the security rules are related to at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples, or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information. In at least some exemplary embodiments, the method includes receiving a set of security policies, security attack sample information, and Internet information, and generating security rules based on the set of security policies, the security attack sample information, and the Internet information. In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device specific format supported by the network device.In at least some exemplary embodiments, the at least one capability of the network device includes at least one of hardware capabilities supported by the network device, operating system capabilities supported by the network device, or programming language capabilities supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed at the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the means for generating device-specific security rules includes means for solving a constraint satisfaction problem including a set of inputs including at least one of a set of security policies, network device information, security goals associated with the security rules, or configuration restrictions. In at least some exemplary embodiments, the means for generating the device-specific security rules includes means for compiling security rules taking into account at least a portion of the network device information. In at least some exemplary embodiments, the network device configuration information includes hardware capabilities of the network device, and the device-specific security rules are generated based on the hardware capabilities of the network device. In at least some exemplary embodiments, the device-specific security rules are generated in a manner that minimizes resource consumption at the network device.In at least some exemplary embodiments, the device-specific security rules are specified in a format supported by the network device as indicated in the network device configuration information. In at least some exemplary embodiments, the device-specific security rules are associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the feedback information includes network telemetry data of the network device for a set of traffic flows processed at the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the apparatus includes means for receiving feedback information related to application of the device-specific security rules at the network device, means for generating second device-specific security rules for the network device based on compilation of the security rules based on the feedback information, and means for transmitting the second device-specific security rules to the network device. In at least some exemplary embodiments, the means for generating the second device specific security rule includes means for determining validity of the device specific security rule at the network device based on the feedback information, and means for generating the second device specific security rule if the means for generating the second device specific security rule determines that validity of the device specific security rule at the network device does not meet a threshold. In at least some exemplary embodiments, the means for generating the second device specific security rule includes means for compiling a security rule taking into account at least a portion of the feedback information. In at least some exemplary embodiments, the second device specific security rule is a modified version of the device specific rule, or the second device specific security rule is a new security rule.

[0007] In at least some exemplary embodiments, the apparatus comprises at least one processor and at least one memory that stores instructions that, when executed by the at least one processor, cause the apparatus to perform at least the following steps: transmitting, by the network device, network device information including network device configuration information indicative of a configuration of the network device and network telemetry data of the network device; receiving, by the network device, a first device specific security rule configured based on the network device information and based on a programming language; performing, by the network device, application of the first device specific security rule at the network device; transmitting, by the network device based on the application of the first device specific security rule at the network device, feedback information associated with application of the first device specific security rule at the network device; receiving, by the network device, a second device specific security rule configured based on the feedback information; and performing, by the network device, application of the second device specific security rule at the network device. In at least some exemplary embodiments, at least one of the first device specific security rule or the second device specific security rule is based on a security rule. In at least some exemplary embodiments, the security rule is related to at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security rule is based on at least one of a set of security policies, attack sample information, and Internet information. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples, or security attack sample analysis information output based on an analysis of one or more security attack samples.In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information. In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device specific format supported by the network device. In at least some exemplary embodiments, the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed by the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the network device configuration information includes hardware capabilities of the network device, and the device-specific security rules are generated based on the hardware capabilities of the network device.In at least some exemplary embodiments, the first device-specific security rule and the second device-specific security rule are specified in a format supported by the network device indicated in the network device configuration information. In at least some exemplary embodiments, at least one of the first device-specific security rule or the second device-specific security rule is associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the second device-specific security rule is a modified version of the first device-specific security rule, or the second device-specific security rule is a new security rule.

[0008] In at least some exemplary embodiments, a non-transitory computer-readable medium includes computer program instructions that, when executed by the apparatus, cause the apparatus to at least: transmit, by the network device, network device information including network device configuration information indicative of a configuration of the network device and network telemetry data of the network device; receive, by the network device, a first device-specific security rule configured based on the network device information and based on a programming language; perform, by the network device, application of the first device-specific security rule at the network device; transmit, by the network device based on the application of the first device-specific security rule at the network device, feedback information associated with application of the first device-specific security rule at the network device; receive, by the network device, a second device-specific security rule configured based on the feedback information; and perform, by the network device, application of the second device-specific security rule at the network device. In at least some exemplary embodiments, at least one of the first device-specific security rule or the second device-specific security rule is based on a security rule. In at least some exemplary embodiments, the security rule is associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security rules are based on at least one of a set of security policies, attack sample information, and Internet information. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples, or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample.In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information. In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device specific format supported by the network device. In at least some exemplary embodiments, the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed by the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the network device configuration information includes hardware capabilities of the network device, and the device-specific security rules are generated based on the hardware capabilities of the network device. In at least some exemplary embodiments, the first device-specific security rules and the second device security rules are specified in a format supported by the network device indicated in the network device configuration information.In at least some exemplary embodiments, at least one of the first device-specific security rule or the second device-specific security rule is associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the second device-specific security rule is a modified version of the first device-specific rule, or the second device-specific security rule is a new security rule.

[0009] In at least some exemplary embodiments, the method includes: transmitting, by the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; receiving, by the network device, a first device-specific security rule configured based on the network device information and based on a program language; performing, by the network device, application of the first device-specific security rule at the network device; transmitting, by the network device based on the application of the first device-specific security rule at the network device, feedback information associated with the application of the first device-specific security rule at the network device; receiving, by the network device, a second device-specific security rule configured based on the feedback information; and performing, by the network device, application of the second device-specific security rule at the network device. In at least some exemplary embodiments, at least one of the first device-specific security rule or the second device-specific security rule is based on a security rule. In at least some exemplary embodiments, the security rule is related to at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security rule is based on at least one of a set of security policies, attack sample information, and Internet information. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information.In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device-specific format supported by the network device. In at least some exemplary embodiments, the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed by the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the network device configuration information includes a hardware capability of the network device, and the device specific security rules are generated based on the hardware capability of the network device. In at least some exemplary embodiments, the first device specific security rules and the second device security rules are specified in a format supported by the network device indicated in the network device configuration information.In at least some exemplary embodiments, at least one of the first device-specific security rule or the second device-specific security rule is associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the second device-specific security rule is a modified version of the first device-specific rule, or the second device-specific security rule is a new security rule.

[0010] In at least some exemplary embodiments, the apparatus includes means for transmitting, by the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; means for receiving, by the network device, a first device specific security rule configured based on the network device information and based on a program language; means for performing, by the network device, application of the first device specific security rule at the network device; means for transmitting, by the network device based on the application of the first device specific security rule at the network device, feedback information associated with the application of the first device specific security rule at the network device; means for receiving, by the network device, a second device specific security rule configured based on the feedback information; and means for performing, by the network device, application of the second device specific security rule at the network device. In at least some exemplary embodiments, at least one of the first device specific security rule or the second device specific security rule is based on a security rule. In at least some exemplary embodiments, the security rule is associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the security rule is based on at least one of a set of security policies, attack sample information, and Internet information. In at least some exemplary embodiments, the security attack sample information includes at least one of a set of security attack samples or security attack sample analysis information output based on an analysis of one or more security attack samples. In at least some exemplary embodiments, the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample. In at least some exemplary embodiments, the Internet information includes at least one of device information, topology information, or service information.In at least some exemplary embodiments, the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device-specific format supported by the network device. In at least some exemplary embodiments, the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device. In at least some exemplary embodiments, the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device. In at least some exemplary embodiments, the network telemetry data of the network device includes packet information regarding a set of traffic flows processed by the network device. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the network device configuration information includes a hardware capability of the network device, and the device specific security rules are generated based on the hardware capability of the network device. In at least some exemplary embodiments, the first device specific security rules and the second device security rules are specified in a format supported by the network device indicated in the network device configuration information.In at least some exemplary embodiments, at least one of the first device-specific security rule or the second device-specific security rule is associated with at least one of a distributed denial of service (DDoS) attack or a botnet attack. In at least some exemplary embodiments, the network telemetry data includes at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data. In at least some exemplary embodiments, the second device-specific security rule is a modified version of the first device-specific rule, or the second device-specific security rule is a new security rule.

[0011] In at least some example embodiments, the apparatus includes at least one processor and at least one memory that stores instructions that, when executed by the at least one processor, cause the apparatus to perform at least the following steps: receiving security rules based on a programming language and based on at least one of a set of security policies, security attack sample information, or Internet information; receiving, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; generating device-specific security rules for the network device based on compilation of the security rules based on at least a portion of the network device information; and, for the network device, initiating configuration of the network device using the device-specific security rules. In at least some example embodiments, the non-transitory computer-readable medium includes computer program instructions that, when executed by the device, cause the device to perform at least the following steps: receiving security rules based on a programming language and based on at least one of a set of security policies, security attack sample information, or Internet information; receiving, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device; generating device-specific security rules for the network device based on compilation of the security rules based on at least a portion of the network device information; and, for the network device, initiating configuration of the network device using the device-specific security rules.In at least some exemplary embodiments, the method includes receiving security rules based on a programming language and based on at least one of a set of security policies, security attack sample information, or Internet information, receiving, for the network device, network device information including network device configuration information indicative of a configuration of the network device and network telemetry data of the network device, generating device specific security rules for the network device based on a compilation of the security rules based on the programming language and based at least in part on the network device information, and initiating, for the network device, configuration of the network device using the device specific security rules. In at least some exemplary embodiments, the apparatus includes means for receiving security rules based on a programming language and based on at least one of a set of security policies, security attack sample information, or Internet information, receiving, for the network device, network device information including network device configuration information indicative of a configuration of the network device and network telemetry data of the network device, generating device specific security rules for the network device based on a compilation of the security rules based on at least in part on the network device information, and initiating, for the network device, configuration of the network device using the device specific security rules.

[0012] The teachings herein can be readily understood by considering the following detailed description in conjunction with the accompanying drawings. [Brief description of the drawings]

[0013] [Figure 1] 1 illustrates an example embodiment of a communication system including a network security system configured to provide network security functions for a communication network. [Diagram 2] 1 illustrates an example embodiment of a network security system configured to provide network security functions for a communications network. [Diagram 3] 1 illustrates an example embodiment of a network device of a communications network, where the network device is configured to support network security functions for the communications network under control of a network security system. [Figure 4] 1 illustrates an example embodiment of a communications system configured to support programming security features into network devices of a communications network. [Diagram 5] 1 illustrates an example embodiment of a communications system configured to support programming security features into network devices of a communications network. [Figure 6] 1 illustrates an example embodiment of a method for supporting programming security rules into network devices of a communications network. [Figure 7] 1 illustrates an example embodiment of a method for supporting programming security rules into network devices of a communications network. [Figure 8] 1 illustrates an example embodiment of a method for supporting programming security rules into network devices of a communications network. [Figure 9] 1 illustrates an example embodiment of a method for supporting programming security rules into network devices of a communications network. [Figure 10] 1 illustrates an exemplary embodiment of a computer suitable for use in performing various functions presented herein.

[0014] For ease of understanding, the same reference numbers have been used herein, wherever possible, to designate identical elements that are common to the various figures. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Various exemplary embodiments for supporting network security for a communication network are presented herein. Various exemplary embodiments supporting network security for a communication network may be configured to support programming security features, including security rules, into a network device. Various exemplary embodiments supporting programming security features into a network device may be configured to support programming security features into a high performance application specific integrated circuit (ASIC) of the network device. Various exemplary embodiments supporting programming security features into a network device may be configured to support programming security features into various types of network devices, such as routers, switches, servers, etc. (i.e., while presented herein primarily in the context of programming security rules into a router, it will be understood that the various exemplary embodiments presented herein may also be applied to programming security rules into various other types of network devices that may utilize security rules to provide security to a communication network). It will be understood that these and various other exemplary embodiments and advantages or potential advantages of exemplary embodiments supporting network security for a communication network, including supporting programming security features into a network device, may be further understood by reference to various figures, which are discussed further below.

[0016] FIG. 1 illustrates an example embodiment of a communication system including a network security system configured to provide network security functions for a communication network.

[0017] The communication system 100 includes a communication network 110, a network security system 120, and an external network 130. The communication network 110 can be any type of network, such as a telecommunications service provider network (e.g., a wired network, a wireless network, or a combination thereof), a data center network, an enterprise network, a content delivery network (CDN), or the like, as well as various combinations thereof. The network security system 120 is configured to support security for the communication network 110. The external network 130 may include various types of networks with which the communication network 110 may interact for various purposes, such as a telecommunications service provider network, a data center network, an enterprise network, the Internet, or the like, as well as various combinations thereof. It will be appreciated that the communication system 100 can include various other elements that can be arranged in various ways.

[0018] The communication network 110 may include any type of network for which security may be provided by the network security system 120. For example, the communication network 110 may include a wired communication network (e.g., a telephone network, a cable network, an Internet access network, an optical fiber network, etc.), a telecommunications service provider network, such as a cellular wireless communication network (e.g., a third generation (3G) cellular network, a fourth generation (4G) cellular network, a fifth generation (5G) cellular network, a sixth generation (6G) cellular network, etc.), as well as various combinations thereof. For example, the communication network 110 may include a data center network (e.g., including servers communicating through switches (e.g., top-of-rack (ToR) switches), routers, etc.). For example, the communication network 110 may include an enterprise network. It will be understood that the communication network 110 may be implemented in various other manners and may include any communication network for which security may be provided by the network security system 120.

[0019] The communications network 110 includes a set of communications resources 111. The communications resources 111 may be configured to support communications of the communications network 110. The communications resources 111 may include physical resources (e.g., physical equipment such as routers, switches, servers, enhanced services equipment, etc.) configured to support communications within the communications network 110, virtual resources (e.g., virtual machines (VMs), virtual containers (VCs), etc.) configured to support communications within the communications network 110 (e.g., based on network function virtualization (NFV) or other similar or related network virtualization capabilities providing virtualized network functions (VNFs)), etc., and may include various combinations thereof. The communications resources 111 may include processing resources, memory resources, storage resources, input / output resources, bandwidth resources, etc., as well as various combinations thereof. It will be appreciated that the communications resources 111 may include various other resources that may support communications of the communications network 110.

[0020] The communications network 110 includes a set of security resources 112. The security resources 112 may be configured to support security functions that provide security for the communications network 110. The security resources 112 may include physical resources (e.g., physical equipment such as servers, firewalls, enhanced services equipment, etc.) configured to support security functions for the communications network 110, virtual resources (e.g., VMs, VCs, etc.) configured to support security functions for the communications network 110, and the like, as well as various combinations thereof. The security resources 112 may include processing resources, memory resources, storage resources, input / output resources, bandwidth resources, and the like, as well as various combinations thereof. It will be appreciated that the security resources 112 may include various other resources that may be used to support security for the communications network 110. Although illustrated as standalone resources, it will be appreciated that at least a portion of the security resources 112 may be integrated within at least a portion of the communications resources 111 (e.g., hosted on a communications device of the communications resources 111, combined with a VNF of the communications resources 111, and the like, as well as various combinations thereof).

[0021] It will be understood that communications network 110 may include a variety of other types of resources, including various other types of resources configured to support communications within communications network 110, various other types of resources configured to support security for communications network 110, and the like, as well as various combinations thereof.

[0022] The network security system 120 may be configured to support various functions configured to enable the network security system 120 to provide network security functions 121 for the communication network 110. For example, the network security system 120 may be configured to support data processing capabilities to support analysis of large amounts of data, thereby providing scalability and robustness to support network security functions for various types of communications (e.g., cloud, IoT, 5G, etc., as well as various combinations thereof). For example, the network security system 120 may be configured to correlate large data sets associated with the communication network 110, infer hidden knowledge about the communication network 110 (including devices, services, and subscribers) based on the correlation of the data sets, and make the knowledge available for investigation (e.g., based on customized queries, on-the-fly visualization, etc., as well as various combinations thereof), thereby providing a holistic view of the communication network 110 (including, for example, peering, transit, service flows, etc., as well as various combinations thereof). For example, the network security system 120 may be configured to correlate real-time data collected from the communications network 110 with genomic data to provide complete insight into how the communications network delivers various services (e.g., internet-based applications and content services) to end systems and end users, where the genomic data may include information obtained by crawling or observing various devices or activities (e.g., internet-related activities, component-related data, etc., as well as various combinations thereof), information obtained based on a synthesis of multiple data sets, information obtained based on a mapping function, information obtained based on the use of machine learning (ML) and / or artificial intelligence (AI) functions, etc., as well as various combinations thereof.For example, network security system 120 may be configured to provide various types of insight into devices, services, and / or subscribers of communications network 110 at various levels of granularity, thereby supporting automation of network security functions for communications network 110. It will be appreciated that network security system 120 may be configured to support various other functions configured to enable network security system 120 to provide network security functions 121 for communications network 110.

[0023] Network security system 120 may be configured to support network security functions 121 for communication network 110, as described above. For example, network security functions may include various functions configured to support programming security functions including security rules into network devices (e.g., routers, switches, servers, etc., as well as various combinations thereof). For example, network security functions may include various functions configured to support programming security functions including security rules into high performance ASICs of network devices. For example, network security functions 121 may include security control functions (e.g., functions configured to control programming security functions including security rules into network devices). It will be understood that network security system 120 is configured to provide various other network security functions 121 for communication network 110.

[0024] The network security system 120 may be configured to provide network security functions 121 for the communications network 110 based on the network information 122 of the communications network 110. The network security system 120 may be configured to provide network security functions 121 for the communications network 110 based on an analysis of the network information 122 of the communications network 110. The network information 122 of the communications network 110 may include various types of information related to the operation of the communications network 110. For example, the network information 122 of the communications network 110 may include network information received from the communications network 110, network information received from one or more systems providing management functions for the communications network 110, and the like, as well as various combinations thereof. It will be appreciated that the network information 122 of the communications network 110 may include various other types of information related to the operation of the communications network 110.

[0025] As mentioned above, the network information 122 of the communications network 110 may include network information received from the communications network 110. For example, the network information received from the communications network 110 may include various types of network telemetry data that may be obtained from the communications network 110. For example, the network information received from the communications network 110 may include telemetry data from network devices (e.g., routers, switches, servers, etc.) deployed in the communications network 110. For example, the network information received from the communications network 110 may include network performance data, service APIs, log events, security events, etc., as well as various combinations thereof. For example, the network information received from the communication network 110 may include IP flow related data sets (e.g., IPFIX flow data), Border Gateway Protocol (BGP) data, Domain Name System (DNS) related data (e.g., DNSflow), Remote Authentication Dial-In User Service (RADIUS) / Authentication, Authorization, and Accounting (AAA) data, Simple Network Management Protocol (SNMP) data, IP Flow Information Export (IPFIX) data, GOOGLE Remote Procedure Call (gRPC) based data, packet samples which may be full packets or subsets of packet headers mirrored by a network device, and the like, as well as various combinations thereof. The network information received from the communication network 110 may include various other types of information that may be obtained from the communication network 110.

[0026] The network information 122 of the communications network 110 may include network information received from one or more systems (omitted for clarity) providing management functionality for the communications network 110, as described above. For example, the network information received from the one or more systems providing management functionality for the communications network 110 may include various types of network-related data that may be obtained from various sources. For example, the network information received from the one or more systems providing management functionality for the communications network 110 may include information from one or more operations support systems (OSS) providing operations support for the communications network 110, information from one or more business support systems (BSS) providing business support for the communications network 110, and the like, as well as various combinations thereof. For example, the network information received from one or more systems providing management functionality for communications network 110 may include information from one or more customer care systems supporting communications network 110, information from one or more customer support and billing systems supporting communications network 110, information from one or more network monitoring systems supporting communications network 110 (e.g., service provider monitoring, data center monitoring, enterprise monitoring, etc.), information from one or more application monitoring systems monitoring applications associated with communications network 110, etc., as well as various combinations thereof. The network information received from one or more systems providing management functionality for communications network 110 may include various other types of information related to communications network 110.

[0027] It will be appreciated that the network security system 120 may be configured to provide network security functions 121 for the communications network 110 based on the use of various other types of information related to the communications network 110 .

[0028] The network security system 120 may be configured to provide network security functions 121 for the communication network 110 based on the use of one or more data genomes 125. The network security system 120 may be configured to provide network security functions 121 for the communication network 110 based on the analysis performed using one or more data genomes 125. The one or more data genomes 125 may include various types of genomes that may be used to support the security of the communication network 110. For example, the one or more data genomes may include a cloud genome 126, a security genome 127, etc., as well as various combinations thereof. The network security system 120 may be configured to use functions to provide various genome development, develop one or more data genomes 125, and use one or more data genomes 125 to support the security of the communication network 110. It will be appreciated that the network security system 120 may be configured to provide network security functions 121 for the communication network 110 based on the use of various other types of data genomes.

[0029] The network security system 120 may be configured to provide at least a portion of the network security functions 121 for the communications network 110 based on the use of the cloud genome 126. The cloud genome 126 may be configured to provide detailed Internet service delivery chain information. The cloud genome 126 may be configured to track, map, and analyze a large number of Internet endpoints to provide a dynamic supply map of the Internet. The cloud genome 126 may be configured to provide complete visibility as applications and content are delivered from various sources to the communications network 110 over the Internet and to subscribers via the communications network 110. It will be appreciated that the cloud genome 126 may include various other types of information and may be applied to support various other network security functions, and the like, as well as various combinations thereof.

[0030] The network security system 120 may be configured to provide at least a portion of the network security functions 121 for the communication network 110 based on the use of the security genome 127. The security genome 127 may be configured to provide detailed Internet security context information. The security genome 127 may be configured to operate as a cloud-based up-to-date data feed that tracks the security context of the Internet. The security genome 127 may be configured to provide detailed visibility into a large number of IPv4 and IPv6 addresses, track Internet traffic across a large number of categories, and deploy an extensive set of ML rules for automatic classification and accurate allocation of applications and flows to security-related traffic types and categories. The security genome 127 may be configured to "know" the complex security details of the Internet (e.g., details about previous security attacks, insecure servers, compromised IoT devices that can be used for security attacks, etc., as well as various combinations thereof). Security Genome 127 may be configured to provide a unique knowledge base that includes a previous history of global security activity, current information regarding Internet-related security (e.g., potential security threats, secure and insecure Internet sources, secure and insecure Internet destinations, secure and insecure traffic patterns, etc.), and the like, as well as various combinations thereof. Security Genome 127 may include information for various types of security attacks, such as distributed denial of service (DDoS) attacks, botnet attacks, and the like, as well as various combinations thereof. It will be appreciated that Cloud Genome 127 may include various other types of information and may be applied to support various other network security functions, and the like, as well as various combinations thereof.

[0031] It will be understood that the network security system 120 may be configured to provide one of the network security functions 121 for the communication network 110 based on the use of various other genomes that may be constructed to provide one of the network security functions 121 for the communication network 110.

[0032] The network security system 120 may be configured to provide network security functions 121 for the communications network 110 based on analysis of the network information 122 of the communications network 110 using one or more data genomes 125. The use of the one or more data genomes 125 to analyze the network information 122 of the communications network 110 provides deep, unique insights into various aspects of the communications network 110 (e.g., devices, services, customers, transit, peering, content consumption, etc., as well as various combinations thereof). The network security system 120 may be configured to analyze the network information 122 of the communications network 110 based on the one or more data genomes 125 to provide network security functions, such as security control functions, as well as one or more additional functions that may be used to support the security control functions (e.g., operational intelligence functions, cloud intelligence functions, subscriber intelligence functions, video analytics functions, etc., as well as various combinations thereof).

[0033] The network security system 120 may be deployed in a variety of ways. For example, the network security system 120 may be deployed as one or more devices deployed within the communications network 110 for which security is provided, as one or more devices deployed outside the communications network 110 for which security is provided, or the like, as well as various combinations thereof. For example, the network security system 120 may be deployed in a cloud (e.g., using software as a service or other suitable cloud-based deployment) communicatively connected to the communications network 110 for which security is provided. It will be appreciated that the network security system 120 may be deployed using various combinations of such deployment techniques. It will be appreciated that the network security system 120 may be deployed in a variety of other ways.

[0034] It will be appreciated that the communications system 100 may include various other elements (e.g., devices, resources, etc., as well as various combinations thereof) associated with providing security to the communications network 110 by the network security system 120.

[0035] FIG. 2 illustrates an example embodiment of a network security system configured to provide network security functions for a communications network.

[0036] The network security system 200 is configured to support various network security functions for a communication network. For example, the network security system 200 may be used as the network security system 120 of the communication system 100 of FIG. 1. The network security system 200 includes a processor 201, a memory 202, and an input / output (I / O) interface 203. The processor 201 is communicatively coupled to the memory 202 and the I / O interface 203. The processor 201 is configured to cooperate with the memory 202 and the I / O interface 203 to perform various types of processing to enable the network security system 200 to provide network security functions for the communication network. The memory 202 stores network security functions 210 and network security data 220. The network security functions 210 may include various functions related to supporting security for the communication network.

[0037] The security control functions 211 may be configured to provide various network security functions for the communications network. The security control functions 211 may be configured to support detection and mitigation of security attacks. The security control functions 211 may be configured to support detection and mitigation of various types of security attacks, including distributed denial of service (DDoS) attacks, botnet attacks, and the like, as well as various combinations thereof. The security control functions 211 may be configured to monitor the communications network using real-time analysis along with intelligence to recognize and stop security attacks, including inbound attacks against the communications network (e.g., external attacks launching from the Internet towards the communications network) and outbound attacks based on the communications network (e.g., internal attacks from hijacked or malicious devices within the communications network). The security control functions 211 may include security detection and mitigation functions, including DDoS detection and mitigation functions for detecting and mitigating DDoS attacks, botnet detection and mitigation functions for detecting and mitigating botnet attacks, and the like, as well as various combinations thereof. It will be appreciated that the security control functions 211 may include various other types of network security functions that may be provided for the communications network.

[0038] The security detection and mitigation functions may be configured to provide a robust and comprehensive attack protection scheme that can protect against various types of attack traffic (e.g., DDoS traffic, botnet traffic, etc., as well as various combinations thereof). The security detection and mitigation functions may be configured to provide efficient and scalable network-based security protection. The security detection and mitigation functions may be configured to make the communications network resistant to security threats by automating security monitoring and detection in combination with network-based protection and automatic mitigation. The security detection and mitigation functions may be configured to provide a robust and comprehensive attack protection scheme based on various combinations of detection capabilities and advanced packet processing features of high performance network devices. The security detection and mitigation functions may be configured to create enhanced protection for various infrastructure elements, systems, subscribers, users, etc., as well as various combinations thereof. The security detection and mitigation functions may be configured to provide additional flexibility for protection based on the use of protection groups, which may be used to prioritize various groups of infrastructure elements, systems, subscribers, users, etc., as well as various combinations thereof. The security detection and mitigation functions may be configured to detect and stop attack traffic before it can impact services or customers. Security detection and mitigation capabilities can be configured to leverage the rich telemetry and programmability of IP networks to provide improved detection with complete traffic visibility and improved scalability for delivering overall network security.

[0039] The security detection and mitigation function may be configured to provide real-time attack detection while orchestrating various attack mitigation options. The security detection and mitigation function may be configured to detect threat patterns in real-time (e.g., based on Internet security context and a network-wide view of traffic, including anomalous patterns or disproportionate traffic volume for certain traffic types). The security detection and mitigation function may be configured to dynamically detect new types of attacks as attacks evolve over time. The security detection and mitigation function may be configured to combine network information (e.g., telemetry, DNS, BGP, etc., and various combinations thereof) and genomic data (e.g., security genomic data) to provide big data IP analytics in a manner that supports attack detection and mitigation. The security detection and mitigation function may be configured to correlate the network information and the security genomic data to rapidly and accurately drive agile network-based attack mitigation using IP router or security device resources. The security detection and mitigation function may be configured to apply advanced AI / ML algorithms to calculate optimal mitigation strategies for a particular attack or combination of attacks, and to initiate the optimal mitigation strategies in real-time to neutralize the attack. The security detection and mitigation functionality can be configured to drop, isolate, and remove attack traffic without affecting legitimate traffic. The security detection and mitigation functionality can be configured to automate various aspects of attack protection, including providing optimized automated mitigation so that attacks can be automatically mitigated, as well as supporting extensive reporting and customization options that enable optimization, streamlining, and automation of security workflows.

[0040] It will be appreciated that the security control function 211 may be configured to support a variety of other capabilities for providing security for the communications network.

[0041] The network security data 220 may include network information 221, data genome 222, network security results data 223, and other security data 229, as described above. The network information 221 may correspond to the network information 122 of the network management system 120 of FIG. 1 and thus may include various types of information related to the communications network being managed by the network management system 200. The data genome 222 may correspond to the data genome 125 of the network management system 120 of FIG. 1 and thus may include various types of information that may be used to support management of the communications network by the network management system 200 (e.g., cloud genome, security genome, etc., as well as various combinations thereof). The network security results data 223 may include any data generated in connection with providing security of the communications network by the network management system 200 (e.g., input information, analysis result information, insights, control data supporting control of elements to support network security, feedback information received from network devices that provide network security based on device-specific security rules, etc., as well as various combinations thereof). Other security data 229 may include various other types of data that may be used to provide security for a communications network by network security system 200 and / or generated in conjunction therewith. It will be appreciated that network security data 220 may include various other types of data that may be used to provide security for a communications network by network security system 200 and / or generated in conjunction therewith. Although presented primarily with respect to an exemplary embodiment in which network security data 220 is maintained within memory 202, it will be appreciated that at least a portion of network security data 220 may additionally or alternatively be maintained using one or more other elements (e.g., remotely located memory, internal or external storage elements, internal or external databases, etc., as well as various combinations thereof).

[0042] It will be appreciated that network security system 200 may include various other elements and may be configured to support various other types of network security functions, and the like, including various combinations thereof.

[0043] FIG. 3 illustrates an example embodiment of a network device of a communication network, where the network device is configured to support network security functions for the communication network under the control of a network security system.

[0044] The network device 300 may be any network device configured to be deployed in a communication network where a network security system is providing network security and to support network security functions for providing network security to the communication network under the control of the network security system. For example, the network device 300 may be a network communication device configured to support communication in the communication network while also supporting network security functions, a network security element dedicated to supporting network security functions for the communication network, and the like, as well as various combinations thereof. For example, the network device 300 may be a router, a switch, a gateway, a firewall, an enhanced services appliance, and the like, as well as various combinations thereof. For example, the network device 300 may be used as a network device of the communication network 110 of the communication system 100 of FIG. 1. It will be appreciated that the network device 300 may include various other types of devices or elements configured to be deployed in a communication network where a network security system is providing network security and to support network security functions for providing network security to the communication network under the control of the network security system.

[0045] Network device 300 includes a processor 301, a memory 302, and an input / output (I / O) interface 303. Processor 301 is communicatively coupled to memory 302 and I / O interface 303. Processor 301 is configured to perform various types of processing in cooperation with memory 302 and I / O interface 303 to enable network device 300 to provide network security functionality for a communications network. Memory 302 stores network security functionality 310 and network security data 320. Network security functionality 310 may include various network security functions related to providing security for a communications network. Network security data 320 may include various types of data related to providing security for the communications network, including network security configuration data 321 related to a configuration of network device 300 to support network security features, network security results data 322 obtained based on application of the network security features by network device 300 (e.g., feedback information received from network device 300 after application of the network security features by network device 300, results information determined based on an analysis of the application of the network security features by network device 300 (e.g., types of traffic that are dropped and / or passed as the system applies and refines security rules, amounts of traffic that are dropped and / or passed as the system applies and refines security rules, etc., as well as various combinations thereof), and other security related data 329. Processor 301 may be configured to access network security features 310 and network security data 320 from memory 302 and perform network security features 310 based on portions of network security data 320 to provide security for the communications network.It will be appreciated that the processor 301, memory 302, and I / O interface 303 may be configured to support various other functions to enable the network device 300 to support network security functions for a communications network under the control of a network security system for the communications network.

[0046] It will be appreciated that the network device 300 may include various other elements and be configured to support various other types of network security functions, and the like, as well as various combinations thereof.

[0047] Various exemplary embodiments may be configured to support automatic learning of security features of a network device and automatic programming of the learned security features into the network device, including the network device's high performance ASIC. The security features may include relatively simple security features (e.g., simple block filters for blocking traffic based on IP addresses, ports, and / or protocols, etc.) and / or more complex security features (e.g., blocking DDoS or botnet attacks, discovering and filtering malicious payloads, etc., as well as various combinations thereof). The security features may be specified in the form of security rules that are applied to provide the security features. It will be appreciated that supporting such automatic learning and programming of security features, including complex security features for the network device, enables the network device to support the security features while eliminating the need to use dedicated hardware (e.g., custom field programmable gate array (FPGA) / deep learning processor unit (DPU) hardware) to support the more complex security features for the network device (although it will be appreciated that in at least some cases such dedicated hardware may still be deployed for various complementary and / or supplementary purposes).

[0048] Various exemplary embodiments may be configured to program security functions, including simple and complex security functions, into network devices. Various exemplary embodiments may be configured to program security functions into a diverse set of network devices of a communications network (e.g., different types of network devices, network devices from different vendors, network devices supporting different capabilities, network devices having different configurations, network devices having different capabilities, etc., as well as various combinations thereof). Various exemplary embodiments may be configured to program security functions into ASICs of network devices, including high performance ASICs of network devices. Various exemplary embodiments may be configured to program security functions into network devices in a manner that achieves security performance (e.g., based on false positive rate, false negative rate, latency, and other metrics) equal to or even better than conventional FPGA / DPU-based security appliances, thereby eliminating the need for deployment of such conventional FPGA / DPU-based security appliances to provide security to a communications network (however, it will be understood that at least some such conventional FPGA / DPU-based security appliances may also be used for various purposes).

[0049] Various exemplary embodiments may be configured to support dynamic programming of security functionality into network devices based on the use of dynamic programming capabilities configured to continuously solve constraint satisfaction / optimization problems. Various exemplary embodiments may be configured to support dynamic programming of security functionality into network devices based on the use of dynamic programming capabilities configured to continuously solve constraint satisfaction / optimization problems across multiple inputs including security goals to be achieved (e.g., block DDoS, block botnets, etc.), network device configuration information (e.g., network device type, network device model, network device hardware capabilities, network device operating system (OS) capabilities, network device programming language capabilities (e.g., NetConf vs. FlowSpec, etc.), network device capacity, etc. (e.g., available CPU, filter memory, etc.)), network telemetry data (e.g., mirror packets, IPFIX, etc.), other inputs (e.g., user-specified policies, configuration restrictions, etc.), etc., as well as various combinations thereof. Various exemplary embodiments may be configured to support dynamic programming of security functionality into network devices based on the use of various other dynamic programming capabilities.

[0050] Various exemplary embodiments may be configured to support dynamic programming of security features into network devices based on the use of various automatic learning and optimization capabilities. Various exemplary embodiments may be configured to leverage security attack sample information based on a global library of security attack samples to automatically train a security learning / optimization engine while being continuously updated with real-world attacks, thereby achieving a high level of automatic learning and training based on various machine learning capabilities. Various exemplary embodiments may be configured to provide a continuous automatic loop that supports automatic learning and automatic optimization of security attack detection and mitigation strategies to accommodate communication networks of dynamic network devices (e.g., a diverse set of network devices that may dynamically change over time) depending on the nature and scale of the security attack. Various exemplary embodiments may be configured to support dynamic programming of security features into network devices based on the use of various other automatic learning and / or optimization capabilities.

[0051] Various exemplary embodiments may be configured to support dynamic programming of security features into network devices based on the use of a high-level language configured to support various aspects of programming security features into network devices. The high-level language may be hardware independent when describing security features and network-wide security processing logic, thereby enabling specification of optimal multi-vendor solutions for both individual network devices and entire communication networks (across a diverse set of heterogeneous network devices). The high-level language may be configured to support specification of security rules in a declarative or descriptive language (e.g.: "if protocol type is 6, source port is less than 1024, and port_range_analysis is positive for TCP flooding, then consider this attack a TCP attack"). The high-level language may be configured to support compilation of security rules between languages ​​or language versions (e.g., the target language / version may or may not be device specific, the target language may be in an abstract form, or the like). The high level language may be configured to support different levels of training / optimization, including directly or indirectly supporting a wide range of network devices (wherein indirectly may be based on the use of a server that can format the appropriate device language / protocol to be supported, may be based on device independent optimization, or the like). The high level language may be configured to support real-time feeding of security rules to a training / learning engine, implementation of security rules on software and / or hardware, etc., as well as various combinations thereof. The high level language may be configured to support various other aspects of the exemplary embodiments for supporting dynamic programming of security features into network devices.

[0052] It will be appreciated that these exemplary embodiments for supporting dynamic programming of security functionality into network devices, as well as various other exemplary embodiments for supporting dynamic programming of security functionality into network devices, may be further understood by considering various aspects of a communications system configured to support programming of security functionality into network devices of a communications network, as presented with respect to FIG.

[0053] FIG. 4 illustrates an example embodiment of a communications system configured to support programming security features into network devices of a communications network.

[0054] As shown in FIG. 4, the communication system 400 includes a communication network 410 , a security attack sample database 420 , a security policy database 430 , an Internet information database 440 , and a network security system 450 .

[0055] The communications network 410 includes various network devices 411, including network devices that may be configured by the network security system 450 to provide network security for the communications network 410 (e.g., based on programming security features into the network devices of the communications network 410). For example, the communications network 410 may include network devices such as routers, switches, servers, and the like, as well as various combinations thereof.

[0056] The security attack sample database 420 maintains security attack samples that may be used by the network security system 450 to determine device-specific security rules for the network devices 411 of the communication network 410 and to program the device-specific security rules onto the network devices 411 of the communication network 410 to provide security for the communication network 410. The security attack sample database 420 may receive continuous updates of real-world security attack samples (e.g., DDoS attack samples, botnet attack samples, etc., as well as various combinations thereof) from various sources of such real-world security attack samples (e.g., network providers, service providers, cloud providers, regulators, national security organizations, security companies, security experts, etc., as well as various combinations thereof). The security attack samples are samples of security attacks that have occurred, and each security attack sample may include security attack information that describes the security attack (e.g., the attack type of the attack, the date and time of the attack, the location of the attack, one or more characteristics of the attack, the resolution of the attack, etc., as well as various combinations thereof). The security attack sample database 420 may additionally or alternatively include security attack sample information, which may include security attack samples, information from the security attack samples, information derived from analysis of the security attack samples, etc., as well as various combinations thereof. The security attack sample database 420 may correspond to the security genome 127 of the communication system 100 of FIG.

[0057] The security policy database 430 maintains security policies that can be used by the network security system 450 to determine device-specific security rules for the network devices 411 of the communication network 410 and to program the device-specific security rules onto the network devices 411 of the communication network 410 to provide security for the communication network 410. The security policy database 430 can maintain security policies that are comprised of high-level security rules. The high-level security rules are general-purpose security rules and are not device-specific security rules. The high-level security rules can include security rules generated by human security engineers. The high-level security rules can specify a security goal to be achieved, one or more parameters that can be used for detection of a security attack, one or more actions that can be initiated for mitigation of the security attack once detected, and the like, as well as various combinations thereof. The high-level security rules can be high-level security rules for various types of security attacks (e.g., DDoS attacks, botnet attacks, and the like), as well as various combinations thereof.

[0058] The internet information database 440 maintains internet information that may be used by the network security system 450 to determine device-specific security rules for the network devices 411 of the communication network 410 and to program the device-specific security rules onto the network devices 411 of the communication network 410 to provide security for the communication network 410. The internet information database 440 may maintain internet information describing various aspects of the internet. For example, the internet information may include internet topology information, internet device information, internet service information, and the like, as well as various combinations thereof. The internet information database 440 may correspond to the cloud genome 126 of the communication system 100 of FIG. 1.

[0059] Network security system 450 is configured to provide network security for communication network 410. Network security system 450 is configured to provide network security for communication network 410 based on attack sample database 420, security policy database 430, and internet information database 440. Network security system 450 is configured to provide network security for communication network 410 by determining device specific security rules for network devices 411 of communication network 410 and programming the device specific security rules onto network devices 411 of communication network 410 to provide security for communication network 410.

[0060] As shown in FIG. 4, the communication system 400 supports a process for programming security features into the network devices 411 of the communication network 410 by the network security system 450, as shown by the sequence of steps 491-497. In step 491, the network security system 450 receives security attack sample information from the security attack sample database 420. In step 492, the network security system 450 receives security policies from the security policy database 430. In step 493, the network security system 450 receives Internet information from the Internet information database 440. In step 494, the network security system 450 receives network information from the communication network. For example, the network information may include network device configuration information (e.g., vendor, model, capabilities (e.g., hardware capabilities, software capabilities, etc.), capacity, etc., as well as various combinations thereof), device telemetry, etc., as well as various combinations thereof. In step 495, the network security system 450 configures one or more network devices 411 of the communication network 410 with the device-specific security rules. The network security system 450 determines device-specific security rules based on the attack samples, the security policies, the Internet information, and the network information. The network security system 450 compiles the device-specific security rules and programs one or more network devices 411 with the device-specific security rules. In step 496, the network security system 450 receives updated network information from the communication network 410 based on application of the device-specific security rules by the one or more network devices 411 of the communication network 410.In step 497, the network security system 450 configures one or more network devices 411 of the communications network 410 with updated device-specific security rules determined based on updated network information from the communications network 410 (and possibly also based on one or more of existing or new attack samples, existing or new security policies, and / or existing or new Internet information). The one or more network devices configured in step 497 may be the same one or more network devices 411 as the network devices configured in step 495 and / or may include one or more network devices 411 different from the network devices configured in step 495. It will be appreciated that the steps may be performed to support automated optimization of security functions supported by the network devices 411 as new information becomes available (e.g., based on new attack samples, newly defined security policies, new Internet information, real-time feedback from the network devices 411, etc., as well as various combinations thereof), thereby continually optimizing the security capabilities of the communications network 410 as the security situation evolves over time.

[0061] Although the programming of the network devices of the communications network 410 to provide security to the communications network 410 is presented primarily as being provided based on the performance of a particular sequence of steps, it will be understood that it may be provided based on the performance of steps in a different order, based on the performance of fewer or more steps, etc., as well as various combinations thereof.

[0062] FIG. 5 illustrates an exemplary embodiment of a communications system configured to support programming security features into routers of a communications network.

[0063] 5, the communication system 500 includes a security rule learning system 510 and a communication network 520. The security rule learning system 510 includes a security rule learning controller 511, a security attack sample database 512, an Internet information database 513, and a high-level security rule database 514. The communication network 520 includes a set of routers 521 (illustratively, there are four routers 521-A, 521-B, 521-C, and 521-D, but it will be understood that there may be fewer or more routers 521) and a set of servers 522 (illustratively, two servers 522-1 and 522-2 are supported, but it will be understood that there may be fewer or more servers 522). The security rule learning system 510 is configured to program the router 521 with router-specific security rules configured to provide security rules that can be acted upon by the server 522 of the communication network 520 based on information obtained by the server 522 from the router 521 to protect the communication network 520. As shown in Figure 5, the communication system 500 supports a process for programming security features into the router 521 of the communication network 520, as shown by the sequence of steps 591-599.

[0064] In step 591, the security rule learning controller 511 receives security attack sample information from a security attack sample database 512. The security attack sample database 512 may receive continuous updates of real-world security attack samples (e.g., DDoS attack samples, botnet attack samples, etc., as well as various combinations thereof) from various sources of such real-world security attack samples (e.g., network providers, service providers, cloud providers, regulators, national security organizations, security companies, security experts, etc., as well as various combinations thereof). A security attack sample is a sample of a security attack that has occurred, and each security attack sample may include security attack information that describes the security attack (e.g., an attack type of the attack, a date and time of the attack, a location of the attack, one or more characteristics of the attack, a resolution of the attack, etc., as well as various combinations thereof). The security attack sample database 512 may also, or alternatively, include security attack sample information including security attack samples, information from the security attack samples, information derived from analysis of the security attack samples, etc., as well as various combinations thereof. The security attack sample database 512 may correspond to the security genome 127 of the communication system 100 of FIG.

[0065] In step 592, the security rule learning controller 511 receives Internet information from an Internet information database 513. The Internet information database 513 can receive continuous updates of Internet information from the Internet. The Internet information can include Internet topology information, Internet device information, Internet service information, and the like, as well as various combinations thereof. The Internet information database 513 can correspond to the cloud genome 126 of the communication system 100 of FIG. 1.

[0066] In step 593, the security rule learning controller 511 receives a set of high-level security rules from the high-level security rule database 514. The high-level security rules are generic security rules and are not device-specific security rules. The high-level security rules may include security rules generated by human security engineers. The high-level security rules may specify a security goal to be achieved, one or more parameters that may be used for detection of a security attack, one or more actions that may be initiated for mitigation of the security attack once detected, and the like, as well as various combinations thereof. The high-level security rules may be high-level security rules for various types of security attacks (e.g., DDoS attacks, botnet attacks, and the like), as well as various combinations thereof.

[0067] In step 594, the security rule learning controller 511 generates a set of security rules for the communication network 520 and provides the security rules to the set of servers 522 of the communication network 520. The security rule learning controller 511 generates a set of security rules for the communication network 520 based on the high-level security rules, the Internet information, and the security attack sample information. The security rule learning controller 511 can compile security rules for the communication network 520 from the high-level security rules based on an analysis of the Internet information and the security attack sample information to generate a set of security rules for the communication network 520. If the high-level security rules define parameters, the security rule learning controller 511 can compile security rules for the communication network 520 from the high-level security rules by determining a configuration of the parameters based on an analysis of the Internet information and the security attack sample information. In this manner, the set of servers 522 receive the security rules from the security rule learning controller 511.

[0068] At step 595, the set of servers 522 receives router configuration information from router 521. The router configuration information for router 521 may include an indication of the vendor of router 521, an indication of the router model of router 521, an indication of a set of capabilities supported by router 521 (e.g., hardware capabilities, software capabilities (e.g., programming languages ​​supported), etc.), an indication of the capacity of router 521, an indication of status information related to router 521 (e.g., router status of router 521, one or more component statuses of one or more components of the router, etc., as well as various combinations thereof), etc. Although the router configuration information is shown only as being received from router 521-B, it will be understood that the router configuration information may be received from any of the routers 521 in communication network 520. Although presented primarily with respect to an exemplary embodiment in which router configuration information is received from router 521, it will be understood that at least a portion of router 521's router configuration information may also, or alternatively, be received from one or more other sources of such router configuration information (e.g., one or more management systems to which router configuration information is provided from router 521).

[0069] At step 596, the set of servers 522 receives router telemetry data from routers 521. The router telemetry data for routers 521 may include one or more of packet mirroring traffic from routers 521, IPFIX data from routers 521, SNMP traps from routers 521, gRPC data from routers 521, and the like, as well as various combinations thereof. Although the router telemetry data is shown only as being received from router 521-C, it will be understood that the router telemetry data may be received from any of the routers 521 in the communications network 520. Although presented primarily with respect to an exemplary embodiment in which router telemetry data is received from routers 521, it will be understood that at least a portion of the router telemetry data for routers 521 may additionally or alternatively be received from one or more other sources of such router telemetry data (e.g., one or more management systems to which the router telemetry data is provided from routers 521).

[0070] In step 597, the set of servers 522 detects a security event in the communication network 520 based on the set of security rules received from the security rule learning controller 511. The security event may be detected based on parameters specified by the set of security rules. The security event may be any type of security event that may be detected based on the set of security rules (e.g., a DDoS attack event, a botnet attack event, etc., as well as various combinations thereof).

[0071] In step 598, the set of servers 522 generates router-specific security rules for one or more of the routers 521 and provides the router-specific security rules to the one or more routers 521. The set of servers 522 may generate the router-specific security rules in response to detection of a security event in the communication network. It will be appreciated that the router-specific security rules may be generated for the router 521 and provided to the router 521 under various other conditions, such as periodically for the communication network 520 (e.g., to ensure that the router 521 remains configured with the most relevant router-specific security rules), in response to one or more conditions detected in the communication network 520 (e.g., a topology change in the communication network 520, a failure detected in the communication network 520, suspicious activity detected in the communication network 520, etc.), as well as various combinations thereof.

[0072] The set of servers 522 may generate router-specific security rules based on the set of security rules received from the security rule learning controller 511. The set of servers 522 may generate router-specific security rules based on router configuration information, router telemetry data, and the like, as well as various combinations thereof. The set of servers 522 may generate router-specific security rules based on modification of the set of security rules to form router-specific security rules. The set of servers 522 may generate router-specific security rules based on modification of the set of security rules based on router configuration information and / or router telemetry data to form router-specific security rules. It will be appreciated that router-specific security rules may be generated in a variety of other manners.

[0073] The set of servers 522 can generate rule-specific security rules for one or more of the routers 521 of the communication network 520. The router-specific security rules may be generated for one or more routers 521 for which a security event has been detected and / or for one or more routers 521 not associated with a security event, for one or more routers 521 for which router configuration information has been received and / or for which router configuration information has not been received, for one or more routers 521 for which router telemetry data has been received and / or from one or more routers 521 for which router telemetry data has not been received, etc., as well as various combinations thereof. Although illustrated with respect to generating router-specific security rules for router 521-D and providing the router-specific security rules to router 521-D, it will be understood that router-specific security rules may be generated and provided for any of the routers 521 in the communication network 520.

[0074] The set of servers 522 can generate router-specific security rules using one or more rule programming languages. The set of servers 522 can generate router-specific security rules for router 521 using one or more programming languages ​​that compile security rules and output router-specific security rules usable by router 521 determined from router configuration information of router 521. For example, router-specific security rules can be defined using one or more of NetConf, YANG, CLI, and the like, as well as various combinations thereof. It will be appreciated that router-specific security rules can be specified using any other suitable rule specification language that can be supported by router 521.

[0075] In step 599, the set of servers 522 uses the feedback from router 521 to dynamically adjust various aspects of the generation of router-specific security rules for router 521. The set of servers 522 can use the feedback from router 521 to dynamically adjust one or more of the router-specific rules for router 521, dynamically adjust the processing logic used by the set of servers 522 to generate router-specific security rules for router 521, etc., as well as various combinations thereof. The feedback from router 521 can include various types of feedback provided by router 521 and that can be used by the set of servers 522 to evaluate the validity of router-specific security rules previously provided to router 521. For example, the feedback information received from router 521 may include traffic information related to traffic being received at router 521 (e.g., packets or packet samples, packet flows or packet flow samples, etc., as well as various combinations thereof), and the traffic information may be evaluated by the set of servers 522 to determine the validity of router-specific security rules previously provided to router 521 (e.g., based on a determination that bad traffic that needs to be dropped is still being received at router 521, one or more of the router-specific security rules for one or more of routers 521 may be adjusted accordingly and provided to router 521 for use by router 521 to continue to mitigate the security event).For example, the feedback information received from router 521 may include operational parameters of router 521 related to the handling of traffic at router 521, which may be evaluated by the set of servers 522 to determine the validity of router-specific security rules previously provided to router 521 (e.g., based on a determination that the operational parameters indicate an unexpected or abnormal load on router 521, one or more of the router-specific security rules for one or more of routers 521 may be adjusted accordingly and provided to router 521 for use by router 521 to continue to mitigate security events). It will be appreciated that various other types of feedback information may be received from the set of routers 521 by the set of servers 522 for use by the set of servers to dynamically adjust the router-specific security rules for router 521 to continue to address existing security events, to better prepare for potential future security events, and the like, or various combinations thereof. Although feedback information is shown only as being received from router 521-D (which is the router for which the router-specific security rules have been provided), it will be appreciated that feedback information may be received from any of the routers 521 in communication network 520. Although the feedback information is presented primarily with respect to an exemplary embodiment in which the feedback information is received from router 521, it will be understood that at least a portion of the router configuration information of router 521 may also, or alternatively, be received from one or more other sources of such feedback information (e.g., one or more management systems to which feedback information is provided from router 521).

[0076] Although the programming of router 521 to provide security for communications network 520 is presented primarily as being provided based on the performance of a particular sequence of steps, it will be understood that it may be provided based on the performance of steps in a different order, based on the performance of fewer or more steps, etc., as well as various combinations thereof.

[0077] Although the exemplary embodiment of FIG. 5 is presented primarily with respect to programming a particular type of network device (i.e., a router) to provide security for a communications network, it will be understood that it may be adapted for use in programming various other types of network devices (e.g., switches, servers, firewalls, enhanced services equipment, etc.) to provide security for a communications network.

[0078] FIG. 6 illustrates an exemplary embodiment of a method for supporting programming security rules into network devices of a communication network. Although presented herein as primarily performed sequentially, it will be understood that at least a portion of the functions of method 600 may be performed simultaneously or in a different order than that shown in FIG. 6. At block 601, method 600 begins. At block 610, for a communication network including a network device, a set of security policies, security attack sample information, and security rules based on Internet information are received. At block 620, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device is received. At block 630, device-specific security rules for the network device are generated based on compiling the security rules based on the network device information, the device-specific security rules being based on a programming language. At block 640, the device-specific security rules are transmitted to the network device. At block 699, method 600 ends.

[0079] FIG. 7 illustrates an exemplary embodiment of a method for supporting programming of security rules into network devices of a communication network. Although presented herein as primarily performed sequentially, it will be appreciated that at least a portion of the functions of method 700 may be performed simultaneously or in a different order than depicted in FIG. 7. At block 701, method 700 begins. At block 710, network device transmits network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device. At block 720, network device receives device-specific security rules configured based on the network device information, the device-specific security rules being based on a programming language. At block 730, network device performs application of the device-specific security rules at the network device. At block 799, method 700 ends.

[0080] FIG. 8 illustrates an exemplary embodiment of a method for supporting programming security rules into a network device of a communication network. Although presented herein as primarily performed sequentially, it will be understood that at least some of the functions of method 800 may be performed simultaneously or in a different order than that shown in FIG. 8. At block 801, method 800 begins. At block 810, for a communication network including a network device, a set of security policies, security attack sample information, and security rules based on Internet information are received. At block 820, for the network device, network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device is received. At block 830, based on compiling the security rules based on the network device information, a first device-specific security rule is generated for the network device, the first device-specific security rule being based on a programming language. At block 840, the first device-specific security rule is transmitted toward the network device. At block 850, feedback information associated with application of the first device-specific security rule at the network device is received. At block 860, second device specific security rules are generated for the network device based on compiling the security rules based on the feedback information. At block 870, the second device specific security rules are transmitted toward the network device. At block 899, the method 800 ends.

[0081] FIG. 9 illustrates an exemplary embodiment of a method for supporting programming security rules into a network device of a communication network. Although presented herein as primarily performed sequentially, it will be appreciated that at least some of the functions of method 900 may be performed simultaneously or in a different order than that illustrated in FIG. 7. At block 901, method 900 begins. At block 910, the network device transmits network device information including network device configuration information indicating a configuration of the network device and network telemetry data of the network device. At block 920, the network device receives a first device-specific security rule configured based on the network device information, the first device-specific security rule being based on a programming language. At block 930, the network device performs application of the first device-specific security rule at the network device. At block 940, the network device transmits feedback information associated with application of the first device-specific security rule at the network device based on application of the first device-specific security rule at the network device. At block 950, the network device receives a second device-specific security rule configured based on the feedback information. At block 960, application of the second device specific security rules is performed at the network device by the network device. At block 999, the method 900 ends.

[0082] Various illustrative embodiments for supporting network security may provide various advantages or potential advantages.

[0083] For example, various exemplary embodiments for supporting network security may be configured to provide dynamic, robust, scalable, and cost-effective network security solutions based on programming security features into network devices.

[0084] For example, various exemplary embodiments supporting network security may be configured to program security features into network devices based on the use of automation and compilation, including configuration-specific (e.g., capability-specific capabilities, such as hardware-specific capabilities) determination at runtime.

[0085] For example, various exemplary embodiments that support network security may be configured to program security features into network devices in a network that includes a heterogeneous mix of network devices (e.g., a mix of network devices with different vendors, models, capabilities, configuration options, etc., as well as various combinations thereof).

[0086] For example, various exemplary embodiments supporting network security may be configured to program security capabilities into network devices in a dynamically changing network, such as where a network provider may periodically change the mix of network devices, thereby allowing security to dynamically evolve with the network (as opposed to where dedicated security appliances are deployed and remain consistent until the appliance is upgraded or replaced).

[0087] For example, various exemplary embodiments that support network security may be configured to program security functions into network devices even when the security functions on the network devices share various resources with a dynamic set of forwarding and policy functions.

[0088] For example, various exemplary embodiments for supporting network security may be configured to program security functions into network devices to eliminate the need for security traffic inspection functions (e.g., DPI or other traffic inspection functions) and policy enforcement functions to be co-located within the same device, thus allowing the security traffic inspection functions and policy enforcement functions to be separated and decomposed.

[0089] For example, various exemplary embodiments for supporting network security may be configured to program security functions, including complex security functions, into a network device in a manner that may obviate the need to use dedicated hardware (e.g., custom FPGA / DPU hardware) on the network device to support more complex security functions for the network device (although it will be understood that in at least some cases, such dedicated hardware may still be deployed to provide security for a communications network).

[0090] For example, various exemplary embodiments supporting network security may be configured to program security functions into network devices in a manner that enables the network devices to replace various custom security equipment that would otherwise need to be deployed within the network to support a particular type of (generally more complex) security function (e.g., security function providing performance protection against DDoS, botnets, etc.) within the network (it will be understood that in at least some cases such customer security appliances may still be deployed to provide security for the communications network).

[0091] For example, various example embodiments supporting network security may be configured to program security functions into network devices in a manner that obviates the need to rely on relatively expensive network security features (e.g., probes, deep packet inspection (DPI), FPGA / DPU-based security appliances, etc.) to support network security (although it will be understood that at least some such network security features may also be applied to provide security for communications networks).

[0092] For example, various exemplary embodiments for supporting network security may be configured to program security functions into network devices in a manner that achieves security performance (e.g., based on false positive rate, false negative rate, latency, and other metrics) equal to or even better than traditional FPGA / DPU-based security appliances, thereby eliminating the need for deployment of custom-built FPGA / DPU security appliances (although it will be understood that at least some such custom-built FPGA / DPU security appliances may also be used for a variety of reasons).

[0093] It will be appreciated that the various illustrative embodiments for supporting network security may provide a variety of other advantages or potential advantages.

[0094] FIG. 10 illustrates an exemplary embodiment of a computer suitable for use in performing various functions presented herein.

[0095] Computer 1000 includes a processor 1002 (e.g., a central processing unit (CPU), a processor, a processor core of a processor, a subset of a processor core of a processor, a set of processor cores of a processor, etc.) and memory 1004 (e.g., random access memory (RAM), read only memory (ROM), etc.). In at least some exemplary embodiments, computer 1000 may include at least one processor and at least one memory that stores instructions that, when executed by the at least one processor, cause computer 1000 to perform various functions presented herein.

[0096] The computer 1000 may also include a cooperating element 1005. The cooperating element 1005 may be a hardware device. The cooperating element 1005 may be a process that can be loaded into the memory 1004 and executed by the processor 1002 to implement various functions presented herein (wherein, for example, the cooperating element 1005 (including associated data structures) may be stored on a non-transitory computer-readable medium such as a storage device or other suitable type of storage element (e.g., magnetic drive, optical drive, etc.)). The cooperating element 1005 may be a security compiler configured to compile secure rules according to various exemplary embodiments presented herein.

[0097] The computer 1000 may also include one or more input / output devices 1006. The input / output devices 1006 may include one or more of user input devices (e.g., a keyboard, keypad, mouse, microphone, camera, etc.), user output devices (e.g., a display, speakers, etc.), one or more network communication devices or elements (e.g., input ports, output ports, receivers, transmitters, transceivers, etc.), one or more storage devices (e.g., tape drives, floppy drives, hard disk drives, compact disk drives, etc.), and the like, as well as various combinations thereof.

[0098] It will be appreciated that computer 1000 may represent a general architecture and functionality suitable for implementing the functional elements described herein, portions of the functional elements described herein, and the like, as well as various combinations thereof. For example, computer 1000 may provide a general architecture and functionality suitable for implementing one or more elements presented herein.

[0099] It will be understood that at least some of the functionality presented herein may be implemented in software (e.g., via implementation of the software on one or more processors for execution (e.g., via execution by one or more processors) on a general-purpose computer to provide a special-purpose computer, etc.) and / or in hardware (e.g., using a general-purpose computer, one or more application specific integrated circuits, and / or any other hardware equivalents).

[0100] It will be understood that at least some of the functionality presented herein may be implemented in hardware, for example, as circuitry that cooperates with a processor to perform various functions. Portions of the functionality / elements described herein may be implemented as a computer program product, where computer instructions, when processed by a computer, adapt the operation of the computer such that the methods and / or techniques described herein are invoked or otherwise provided. Instructions for invoking the various methods may be stored on fixed or removable media (e.g., non-transitory computer-readable media), transmitted via a data stream in a broadcast or other signal-bearing medium, and / or stored in memory within a computing device that operates according to the instructions.

[0101] It will be understood that the term "non-transient" as used herein is a limitation of the medium itself (i.e., tangible as opposed to a signal) as opposed to a limitation of data storage persistence (e.g., RAM vs. ROM).

[0102] As used herein, the terms "at least one of " and "at least one of " and similar phrases, when a list of two or more elements is joined by "and" or "or", will be understood to mean at least any one of the elements, or at least any two or more of the elements, or at least all of the elements.

[0103] As used herein, the term "or" will be understood to refer to a non-exclusive "or" unless otherwise indicated (e.g., use of "or otherwise" or "or in the alternative").

[0104] While various embodiments incorporating the teachings presented herein have been shown and described in detail herein, it will be understood that those skilled in the art could readily devise many other various embodiments which still incorporate these teachings.

Claims

1. At least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least: receiving a security rule for a communication network including the network device, the security rule being based on a set of security policies, security attack sample information, and Internet information; receiving network device information for the network device, the network device information including network device configuration information indicative of a configuration of the network device and network telemetry data for the network device; generating programming language based device specific security rules for the network device based on compiling the security rules based on the network device information; sending the device specific security rules to the network device; An apparatus for executing the above-mentioned procedure.

2. 2. The apparatus of claim 1, wherein the security rules relate to at least one of a distributed denial of service (DDoS) attack or a botnet attack.

3. The apparatus of claim 1 , wherein the security attack sample information includes at least one of a set of security attack samples or security attack sample analysis information output based on an analysis of one or more security attack samples.

4. The apparatus of claim 1 , wherein the security attack sample information is based on at least one actual distributed denial of service (DDoS) attack sample.

5. 10. The apparatus of claim 1, wherein the Internet information includes at least one of device information, topology information, or service information.

6. The instructions, when executed by the at least one processor, cause the device to at least: receiving the set of security policies, the security attack sample information, and the Internet information; 2. The apparatus of claim 1, further comprising: a step of generating the security rules based on the set of security policies, the security attack sample information, and the Internet information.

7. 2. The apparatus of claim 1, wherein the network device configuration information includes at least one of an indication of a vendor of the network device, an indication of at least one capability of the network device, an indication of a capacity of the network device, or an indication of at least one device-specific format supported by the network device.

8. 2. The apparatus of claim 1, wherein the at least one capability of the network device includes at least one of a hardware capability supported by the network device, an operating system capability supported by the network device, or a programming language capability supported by the network device.

9. 8. The apparatus of claim 7, wherein the indication of the capacity of the network device includes at least one of an indication of an amount of central processing unit resources available at the network device, an indication of an amount of memory resources available at the network device, or an indication of an amount of input / output resources available at the network device.

10. 2. The apparatus of claim 1, wherein the network telemetry data for the network device comprises packet information for a set of traffic flows processed by the network device.

11. 11. The apparatus of claim 10, wherein the network telemetry data comprises at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data.

12. To generate the device specific security rules, the instructions, when executed by the at least one processor, cause the apparatus to at least:

2. The apparatus of claim 1, further comprising: a step of solving a constraint satisfaction problem including a set of inputs including at least one of the set of security policies, the network device information, a security goal associated with the security rule, or a configuration constraint.

13. To generate the device specific security rules, the instructions, when executed by the at least one processor, cause the apparatus to at least:

2. The apparatus of claim 1, further comprising: a step of: compiling the security rules taking into account at least a portion of the network device information.

14. The apparatus of claim 1 , wherein the network device configuration information includes hardware capabilities of the network device, and the device-specific security rules are generated based on the hardware capabilities of the network device.

15. The apparatus of claim 1 , wherein the device-specific security rules are generated in a manner that minimizes resource consumption at the network device.

16. The apparatus of claim 1 , wherein the device-specific security rules are specified in a format supported by the network device as indicated in the network device configuration information.

17. The apparatus of claim 1 , wherein the device-specific security rules relate to at least one of a distributed denial of service (DDoS) attack or a botnet attack.

18. 2. The apparatus of claim 1, wherein the feedback information comprises network telemetry data of the network device for a set of traffic flows processed by the network device.

19. 20. The apparatus of claim 18, wherein the network telemetry data comprises at least one of a set of mirrored packets, Internet Protocol (IP) Flow Information Export (IPFIX) data, Simple Network Management Protocol (SNMP) traps, or gRPC data.

20. The instructions, when executed by the at least one processor, cause the device to at least: receiving, at the network device, feedback information associated with application of the device specific security rules; generating second device-specific security rules for the network device based on compiling the security rules based on the feedback information; and transmitting the second device specific security rule to the network device.

21. To generate the second device specific security rules, the instructions, when executed by the at least one processor, cause the apparatus to at least: determining, at the network device, a validity of the device specific security rules based on the feedback information; and generating, at the network device, the second device-specific security rule if the network device determines that the validity of the device-specific security rule does not meet a threshold.

22. To generate the second device specific security rules, the instructions, when executed by the at least one processor, cause the apparatus to at least:

21. The apparatus of claim 20, further comprising: a step of compiling the security rules taking into account at least a portion of the feedback information.

23. 21. The apparatus of claim 20, wherein the second device specific security rule is a modified version of the device specific rule, or the second device specific security rule is a new security rule.

24. receiving a security rule for a communication network including the network device, the security rule being based on a set of security policies, security attack sample information, and Internet information; receiving network device information for the network device, the network device information including network device configuration information indicative of a configuration of the network device and network telemetry data for the network device; generating programming language-based device specific security rules for the network device based on compiling the security rules based on the network device information; sending the device specific security rules to the network device; The method according to claim 1, further comprising:

25. At least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least: transmitting, by a network device, network device information including network device configuration information indicative of a configuration of the network device and network telemetry data of the network device; receiving, by the network device, first device specific security rules configured based on the network device information and based on a programming language; performing, by the network device, application of the first device specific security rules at the network device; transmitting, by the network device based on the application of the first device specific security rule at the network device, feedback information associated with the application of the first device specific security rule at the network device; receiving, by the network device, second device specific security rules configured based on the feedback information; performing, by the network device, application of the second device specific security rules at the network device; An apparatus for executing the above-mentioned procedure.

26. At least one processor; and at least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least: receiving a security rule based on a programming language and based on at least one of a set of security policies, security attack sample information, or Internet information; receiving network device information for a network device, the network device information including network device configuration information indicative of a configuration of the network device and network telemetry data for the network device; generating device-specific security rules for the network device based on compiling the security rules based on the programming language and based at least in part on the network device information; for the network device, initiating a configuration of the network device using the device specific security rules; An apparatus for executing the above-mentioned procedure.

Images