Network Security Rule Optimization via Anomaly Removal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network security devices face inefficiencies due to anomalies in security policies, such as shadowing, redundancy, and correlation anomalies, which waste resources and degrade performance by requiring unnecessary rule evaluations and storage.
Innovation Solution
A security management system optimizes network security device rules by converting overlapping rules into mutually exclusive rules, removing redundant rules, and merging nearly equal rules, using redundancy removal and join/merge policies to streamline rule sets without affecting packet behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrators configure multiple security rules to cover various network traffic scenarios, then the security coverage and reliability are improved, but the rule set size increases causing memory utilization to increase and search time to increase
Solution Approach 1:
The patent merges multiple security rules that have overlapping match conditions into a single consolidated rule. When multiple rules match the same set of packets, they are combined into one rule that evaluates all matching packets simultaneously, reducing the total number of rules stored in the security device while maintaining the same security coverage and evaluation behavior.
Solution Approach 2:
The consolidated security rule serves multiple functions by evaluating packets against multiple original rule criteria in a single evaluation step. The merged rule acts as a universal rule that replaces several specialized rules, maintaining comprehensive security coverage while reducing rule set quantity.
2Reliability
If administrators configure multiple security rules to cover various network traffic scenarios, then the security coverage is improved, but the search time for packet evaluations increases due to more rules to traverse
Solution Approach 1:
The patent merges multiple security rules that have overlapping match conditions into a single consolidated rule. When multiple rules match the same set of packets, they are combined into one rule that evaluates all matching packets simultaneously, reducing the total number of rules stored in the security device while maintaining the same security coverage and evaluation behavior.
3Reliability
If the security device stores and evaluates a large number of security rules, then the security policy comprehensiveness is improved, but the memory utilization increases consuming more device resources
Solution Approach 1:
The patent merges multiple security rules that have overlapping match conditions into a single consolidated rule. When multiple rules match the same set of packets, they are combined into one rule that evaluates all matching packets simultaneously, reducing the total number of rules stored in the security device while maintaining the same security coverage and evaluation behavior.
4Adaptability or versatility
If overlapping security rules are present in the rule set, then the security policy flexibility is improved allowing different actions for different packets, but the rule complexity increases causing unnecessary rule evaluations
Solution Approach 1:
The patent merges multiple security rules that have overlapping match conditions into a single consolidated rule. When multiple rules match the same set of packets, they are combined into one rule that evaluates all matching packets simultaneously, reducing the total number of rules stored in the security device while maintaining the same security coverage and evaluation behavior.
Data Source
AI summary
The techniques described herein may optimize a set of ordered rules of a security device through the removal of one or more anomalies. For example, a security management system or other configuration management system or component may detect and remove one or more anomalies from a set (e.g., list) of one or more ordered rules to be enforced by the network security device, such as shadowing anomalies, redundancy anomalies, and/or correlation anomalies, among others, as described herein. Security management system may transform the set of ordered rules to replace at least a subset of the rules within one or more mutually exclusive rules. In some instances, the security management system may optimize the transformed rule set, for example, by using redundancy removal and/or join/merge policies.