Firewall Rule Prioritization via Deny Count and Anomaly Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing firewall rules in web-based applications is challenging due to high rates of false positives, where standard firewalls incorrectly identify valid requests as attacks, requiring administrators to manually review logs and define exceptions, which is time-consuming and cumbersome.
Innovation Solution
A method to identify and prioritize firewall rules by determining a deny count and anomaly score for each rule, calculating an urgency measure to focus administrative attention on critical rules, allowing for efficient identification and resolution of false positives by sorting and updating rules based on these measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If firewall rules are configured to detect and prevent web attacks, then security protection is improved, but false positive rate increases causing more valid requests to be incorrectly blocked
Solution Approach 1:
The system performs preliminary analysis by collecting statistics on firewall rule triggering before taking action. It monitors and records how often each rule is triggered, then uses this historical data to make informed decisions about rule modifications, preventing both false positives and actual attacks through data-driven adjustments
Solution Approach 2:
The system dynamically adjusts firewall rule parameters based on collected statistics. When a rule triggers excessively (indicating false positives), the system automatically modifies its parameters such as threshold values or exception conditions, balancing security detection accuracy with legitimate traffic flow
2Object-generated harmful factors
If administrators manually review logs and define exceptions for false positives, then false positive resolution is achieved, but time consumption and operational complexity increase
Solution Approach 1:
The firewall system performs self-adjustment by automatically analyzing its own rule triggering statistics and modifying rules based on detected patterns. The system autonomously identifies false positives through statistical analysis and adjusts its behavior without requiring continuous administrator intervention, making the system self-optimizing
Solution Approach 2:
The system implements a feedback loop where rule triggering results are continuously monitored and fed back into the rule management process. Statistics from rule evaluations are used to automatically adjust future rule applications, creating a closed-loop system that learns from its own performance and continuously improves
3Manufacturing precision
If administrators manually examine and modify firewall rules, then rule accuracy is improved, but productivity and efficiency decrease
Solution Approach 1:
The system autonomously analyzes its own rule performance data and automatically modifies rules to improve accuracy. By implementing self-diagnosis and self-correction capabilities, the system maintains high rule accuracy without requiring manual administrator review, thereby preserving productivity while achieving precision
Data Source
AI summary
Embodiments described herein relate to managing firewall rules. Embodiments include identifying a plurality of firewall rules for request handling. Embodiments include determining a deny count for each given firewall rule of the plurality of firewall rules based on a number of requests flagged on account of the given firewall rule. Embodiments include determining an anomaly score for each given firewall rule of the plurality of firewall rules indicating a severity of attacks the given firewall rule protects against. Embodiments include determining an urgency measure for each given firewall rule of the plurality of firewall rules based on the deny count for the given firewall rule and the anomaly score for the given firewall rule. Embodiments include determining an update to at least one firewall rule of the plurality of firewall rules based on the urgency measure for each given firewall rule of the plurality of firewall rules.