Consolidated Firewall Rule Validation Using Historical Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional firewall solutions require generating individual rules for each criterion, leading to large rule sets that slow down computing time and resource usage, and testing on live traffic can result in malicious traffic reaching the origin server, increasing processing time and security risks.
Innovation Solution
The system generates firewall rules that can match multiple request properties using pattern recognition and applies them to test traffic before live traffic, allowing for validation and optimization of firewall rules using historical data to minimize false positives and improve security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If individual firewall rules are generated for each criterion, then security coverage is improved, but computing time and resource usage increase
Solution Approach 1:
The patent combines multiple firewall rules into a single consolidated rule that can match multiple request properties simultaneously. Instead of creating separate rules for each criterion (IP address, user agent, request path), the system generates one rule that integrates these criteria using pattern recognition, thereby reducing the number of rules from many to fewer while maintaining comprehensive security coverage.
Solution Approach 2:
The firewall rule is designed to perform multiple functions by matching different request properties through a single rule structure. The rule can simultaneously evaluate IP addresses, user agents, and request paths using pattern recognition capabilities, making the rule universal rather than specialized for a single criterion, thus improving productivity while maintaining reliability.
2Measurement precision
If firewall rules are tested on live traffic, then real-time validation is achieved, but malicious traffic may reach the origin server and processing time increases
Solution Approach 1:
The system performs preliminary validation of firewall rules using historical data before applying them to live traffic. By pre-testing rules against stored historical request data, the system can identify and correct potential issues with rule logic or false positives/negatives in advance, ensuring that only validated rules are deployed to protect against malicious traffic without exposing the origin server to risks during the validation process.
Solution Approach 2:
Historical data serves as an intermediary medium for validating firewall rules. Instead of directly testing rules against live traffic (which could allow malicious traffic through), the system uses historical data as a safe intermediary to first validate rule effectiveness. This intermediary approach enables measurement precision while preventing harmful factors from affecting the validation process or the origin server.
3Reliability
If multiple individual firewall rules are used, then comprehensive filtering is achieved, but device complexity increases
Solution Approach 1:
The patent merges multiple individual firewall rules into a single consolidated rule that maintains comprehensive filtering effectiveness. By integrating multiple criteria (IP address matching, user agent patterns, request path patterns) into one rule structure, the system achieves the same filtering capability as many separate rules but with reduced complexity, directly addressing the contradiction between reliability and device complexity.
Data Source
AI summary
A control server receives configuration data from a domain owner device associated with a domain owner of a resource, where the resource is hosted by an origin server. The control server uses the configuration data to generate a firewall rule to apply to requests directed to the resource and received by the edge server. The control server retrieves test traffic relevant to the firewall rule and applies the firewall rule to the test traffic. The control server determines an outcome from applying the firewall rule to the test traffic and, based on an input from the domain owner device, performs an action on the firewall rule.