Firewall Security Policy Recommendation via Collective Voting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Configuring firewall blocking rules is challenging, often resulting in oversimplification or conservative configurations that fail to customize for specific users, leading to either excessive or insufficient blocked communications.
Innovation Solution
A method and system that recommend security policies to firewalls based on the collective experience of diverse users, using a voting engine and recommendation engine to analyze past communications and provide recommendations on whether to block or allow new communications by tallying positive and negative votes from similar past events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall blocking rules are configured to be conservative to ensure security, then network security is improved, but too many legitimate communications are blocked
Solution Approach 1:
The system implements feedback by collecting information about communications blocked or allowed at other firewalls and using this feedback to dynamically adjust security policies. The voting mechanism processes feedback from multiple sources to determine whether similar communications should be blocked or allowed, enabling the firewall to learn from collective experience and improve its decisions over time without requiring manual reconfiguration.
Solution Approach 2:
The system performs preliminary action by pre-configuring default security policies and using historical voting data to predict appropriate actions for new communications. Before making a blocking decision, the system queries the voting engine with communication characteristics and receives a pre-evaluated recommendation based on similar past cases, allowing the firewall to make informed decisions without conservative over-blocking.
2Measurement precision
If firewall blocking rules are customized for specific users to improve precision, then configuration accuracy is improved, but device complexity increases
Solution Approach 1:
The system achieves universality by creating a multi-functional voting engine that serves multiple firewalls and users through a single centralized service. Instead of each firewall maintaining separate custom rules, the voting engine provides universal security policy recommendations to all participating firewalls based on aggregated data from diverse users and networks, reducing individual firewall complexity while maintaining high configuration accuracy.
Solution Approach 2:
The voting engine acts as an intermediary between individual firewalls and the collective wisdom of the network. Rather than each firewall directly implementing complex custom rules, the intermediary voting engine processes communication requests, queries historical voting data, and returns simplified recommendations, thereby reducing the complexity burden on individual firewalls while achieving precise, customized security policies.
3Ease of operation
If firewall rules are simplified to reduce configuration difficulty, then ease of operation is improved, but security effectiveness deteriorates
Solution Approach 1:
The system implements self-service by enabling firewalls to automatically query the voting engine and implement security decisions without manual configuration. The firewall simply submits communication characteristics to the voting engine and applies the returned recommendation, making the system easy to operate while maintaining security effectiveness through collective intelligence rather than simplified manual rules.
Data Source
AI summary
Recommending a security policy to a firewall, includes receiving a request from a firewall for a recommendation as to whether the firewall should allow or block a detected present communication for which the firewall does not have an existing security policy. Information about past blocked and allowed communications at other firewalls on a network is searched to identify past communications that are similar to the present communication. The identified past communications are assigned a respective positive or negative vote. A positive vote indicates a past communication was allowed and a negative vote indicates a past communication was not allowed. A positive recommendation is sent to the requesting firewall to allow the present communication if the positive votes outnumber the negative votes, and a negative recommendation is sent to the requesting firewall to block the present communication if the negative votes outnumber the positive votes.