Detector Tree for Firewall Rule Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Firewall policies with a large number of rules face inefficiencies in detecting rule anomalies, as existing methods require comparing each rule to every other rule, leading to substantial time consumption and computational complexity.
Innovation Solution
A detector tree data structure is implemented to organize rule information, allowing a rule anomaly to be detected based on a small number of comparisons, approximately equal to the logarithm of the total number of rules, by structuring the tree based on source and destination addresses and identifying conflicts efficiently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional rule comparison methods are used to detect rule anomalies in firewall policies, then detection accuracy is maintained, but detection time increases substantially with the number of rules
Solution Approach 1:
The patent segments the set of N firewall rules into smaller subsets using a detector tree data structure. Each node in the tree represents a subset of rules, and the tree organizes rules hierarchically based on their characteristics. This segmentation allows the system to compare rules within smaller subsets rather than comparing every rule with every other rule, reducing the number of comparisons from O(N^2) to O(N log N) while maintaining detection accuracy.
2Reliability
If comprehensive rule comparison is performed to ensure all conflicts are detected, then detection completeness is improved, but computational complexity increases
Solution Approach 1:
The patent introduces a new dimensional organization of rules by constructing a detector tree with multiple levels and branches. Rules are arranged in a hierarchical structure where each level represents a different aspect of rule comparison. This dimensional transformation allows the system to achieve comprehensive coverage of rule interactions without requiring exhaustive pairwise comparison, reducing computational complexity from quadratic to linearithmic while maintaining detection completeness.
3Productivity
If the detector tree structure is implemented to reduce comparison numbers, then detection efficiency is improved, but data structure complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-organizing the firewall rules into a detector tree structure before the actual anomaly detection process. During this preliminary phase, rules are sorted and arranged in a hierarchical tree structure based on their characteristics. This preliminary organization enables efficient detection during the actual operation, as the tree structure allows for quick navigation and comparison with minimal computations, improving detection efficiency despite the initial setup complexity.
Data Source
AI summary
A device may receive rule information, associated with a firewall policy, that includes a set of N rules. The device may add a rule, of the set of N rules, to a detector tree associated with the firewall policy. The device may identify other rules to which the rule is to be compared. The other rules may be included in the set of N rules, and may include a quantity of rules approximately equal to a result of a logarithm to base 2 of N. The device may compare the rule and the other rules, and may detect a rule anomaly based on comparing the rule to the other rules. The rule anomaly may be associated with a conflict between the rule and a particular rule of the other rules. The device may identify the rule anomaly within the detector tree, and may output information regarding the rule anomaly.