Behavioral Graph Firewall Policy for Complex Rule Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security policies become increasingly complex and difficult to modify without causing unintended vulnerabilities or gaps, making it challenging to detect and mitigate attacks effectively.
Innovation Solution
Convert network security policies into behavioral graphs to facilitate manipulation, querying, and understanding of network communications, allowing for simplified policy adjustments and real-time threat detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network security policies are maintained and updated over time, then security coverage is improved, but policy complexity increases making manipulation and modification difficult
Solution Approach 1:
The patent creates a behavioral graph representation as a copy or abstraction of the actual network security policy. This graph model captures the essential security rules and relationships in a simplified visual format, allowing analysts to manipulate and understand the policy without directly modifying the complex underlying firewall rules. The graph serves as a manageable replica that preserves security coverage while reducing operational complexity.
Solution Approach 2:
The patent segments the monolithic network security policy into discrete behavioral graph components representing different security rules, network entities, and their relationships. By breaking down the complex policy into modular graph elements (nodes and edges), the system enables targeted manipulation of specific security aspects without affecting the entire policy, thus maintaining security coverage while improving manageability.
2Reliability
If traditional firewall rules are used, then security enforcement is achieved, but detection and correlation of attacks across multiple domains is insufficient
Solution Approach 1:
The behavioral graph serves multiple functions simultaneously: it enforces security policies through generated firewall rules, detects attacks by analyzing graph patterns, correlates events across different network domains, and provides visual analysis capabilities. This multi-functional approach allows the same data structure to both prevent and detect security incidents, overcoming the limitation of traditional firewalls that only enforce rules without sophisticated detection capabilities.
Solution Approach 2:
The system continuously monitors network traffic and updates the behavioral graph with observed patterns, creating a feedback loop that improves detection capabilities over time. By comparing actual traffic against the learned behavioral patterns in the graph, the system can detect anomalies and evolving attacks while maintaining enforcement of established security policies, thus enhancing detection without compromising enforcement.
Data Source
AI summary
Techniques and systems described herein relate to a security system for a network or other monitored system of computing devices, such as a firewall system. The techniques and systems provide for generation of behavioral graphs based on observed network and/or system traffic during an observation period and subsequent creation of a network security policy using the behavioral graph as the framework for the network security policy. The techniques and systems additionally provide for manipulation, evaluation, and querying of network security policies through the use of matrix operations on behavioral graphs and plain text inputs and querying of the behavioral graph to form a network security policy.