Firewall Flow Record Coalescing for Virtual Infrastructure

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In virtualized environments with distributed firewalls, the management and collection of firewall flow records are inefficient due to resource constraints, leading to data loss and suboptimal analysis capabilities, as existing systems lack effective mechanisms for handling massive quantities of network performance data.

Innovation Solution

Implement a system for dynamically collecting and managing firewall flow records using a collection schedule that adapts based on processing capacity, employing heuristic-based graceful degradation and controlled lossy aggregation to prioritize data retention and optimize storage, ensuring continuous operation even under resource limitations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If firewall flow records are collected from all data end nodes continuously, then complete network performance data is obtained, but resource constraints cause data loss and storage issues

Engineering Contradiction:

Improvefirewall flow record data lossVSAvoidvolume of firewall flow records

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The system dynamically adjusts collection parameters including frequency, volume, and scope of firewall flow record collection based on available storage capacity and network conditions. When storage is充足, collection occurs at higher frequency and volume; when storage is constrained, collection frequency and volume are reduced to prevent data loss.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The system implements selective collection of firewall flow records by prioritizing certain data end nodes, time periods, or record types based on network performance monitoring needs. Instead of uniformly collecting all records, the system applies partial collection strategies that focus resources on the most critical data while reducing collection from less important sources.

Inventive Principle:

Principle #16Partial or excessive action

2Measurement precision

If firewall flow records are collected at high frequency from all data end nodes, then network performance monitoring accuracy is improved, but system resource consumption increases

Engineering Contradiction:

Improvenetwork performance monitoring accuracyVSAvoidsystem resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The collection frequency and scope are made dynamic rather than static. The system continuously monitors storage capacity, network conditions, and performance requirements to adjust collection parameters in real-time. Collection intensity increases when storage is abundant and performance monitoring is critical, and decreases when storage is constrained or network conditions are stable.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

Different data end nodes are treated differently based on their importance to network performance monitoring. Critical nodes are monitored at high frequency with complete record collection, while less critical nodes are monitored at lower frequencies or with selective record types, optimizing the balance between monitoring accuracy and resource consumption.

Inventive Principle:

Principle #3Local quality

3Productivity

If collection schedule is made adaptive based on processing capacity, then resource utilization is optimized, but system complexity increases

Engineering Contradiction:

Improveresource utilization efficiencyVSAvoidcollection schedule management complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system implements feedback mechanisms where collection performance, storage capacity, and processing capacity are continuously monitored and fed back to adjust future collection schedules. This closed-loop control enables adaptive optimization of resource utilization while maintaining manageable complexity through rule-based adjustment logic.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10630644B2Managing firewall flow records of a virtual infrastructure

Publication Date: 2020.04.21 VMWARE INC

AI summary

In a computer-implemented method for managing firewall flow records, firewall flow records of a virtual infrastructure including a distributed firewall are received, wherein the firewall flow records are captured according to firewall rules of the distributed firewall, and wherein the firewall flow records each include tuples and at least one field of network traffic data. Responsive to detecting a number of received firewall flow records exceeding a threshold value, it is determined whether the tuples are identical for any of the firewall flow records. Provided the tuples are not identical for any of the firewall flow records, the tuples for the firewall flow records are modified to generate modified firewall flow records. It is determined whether the tuples are identical for any of the modified firewall flow records. Provided the tuples are identical for any of the modified firewall flow records, the modified firewall flow records for which the tuples are identical are coalesced into a single firewall flow record.