System and method for applying rule sets and rule interactions
Described is a system and method for determining relationships between a plurality of existing rules in a rule set, wherein the relationships include cause interactions and effect interactions among the existing rules, creating a representation of the relationships including the cause interactions and effect interactions, receiving a new rule to be inserted into the rule set and determining if a conflict is created by insertion of the new rule in the rule set.
1. A computer readable storage medium including a set of instructions executable by a processor, that cause the processor to perform a method for screening incoming data of a network, comprising:
determining relationships between a plurality of existing rules in a rule set of a firewall used to screen the incoming data of the network, wherein the relationships include cause interactions and effect interactions among the existing rules;
creating a representation of the relationships including the cause interactions and effect interactions;
receiving a new rule to be inserted into the rule set;
inserting further relationships between the new rule and the existing rules into the representation to create a modified representation; and
determining, based on the modified representation, if a conflict is created by insertion of the new rule in the rule set.
2. The computer readable storage medium of claim 1 , wherein the determining of the conflict includes:
determining further cause interactions and further effect interactions of the new rule with the existing rules.
3. The computer readable storage medium of claim 1 , comprising:
adding the new rule to the rule set when the new rule can be added without conflict.
4. The computer readable storage medium of claim 1 , wherein the rule set includes parameters used to determine when the rule set is invoked.
5. The computer readable storage medium of claim 1 , wherein each rule of the rule set is placed with a cause and effect pairing making a rule node to create the cause interactions and effect interactions.
6. The computer readable storage medium of claim 1 , wherein the representation is a di-graph.
7. The computer readable storage medium of claim 6 , wherein the di-graph includes vertices where each vertex represents a rule of the rule set and the effects.
8. The computer readable storage medium of claim 6 , wherein the di-graph includes arcs where each arc represents one of the cause interactions and the effect interactions.
9. The computer readable storage medium of claim 1 , wherein the new rule is a change to one of the existing rules.
10. The computer readable storage medium of claim 1 , further comprising:
indicating the conflict created by the new rule with the existing rules.
11. The computer readable storage medium of claim 1 , further comprising:
suggesting, when the conflict is identified, a new replacement for the new rule within the rule set.
12. The computer readable storage medium of claim 1 , wherein the representation is provided in a visual format.
13. A system for screening incoming data of a network, comprising:
an analyzing module to analyze the relationships between a plurality of existing rules in a rule set of a firewall used to screen the incoming data of the network, wherein the relationships include cause interactions and effect interactions among the existing rules;
a representation module to create a representation of the relationships including the cause interactions and effect interactions;
a receiving module to receive a new rule to be inserted into the rule set;
a new rule analyzing module to analyze if a conflict is created by insertion of the new rule in the rule set by inserting further relationships between the new rule and the existing rules to create a modified representation and determining if a conflict is created based on the modified representation; and
a display to display the representation and the modified representation to a user of the system.
14. The system of claim 13 , wherein the new rule analyzing module determining the conflict includes:
determining further cause interactions and further effect interactions of the new rule with the existing rules.
15. The system of claim 13 , wherein the analyzing module places each rule of the rule set with a cause and effect pairing making a rule node to create the cause interactions and effect interactions.
16. The system of claim 13 , wherein the representation module represents the relationships in a di-graph format.
17. The system of claim 13 , wherein the receiving module receives a new rule that is a change to one of the existing rules.
18. The system of claim 13 , wherein the new rule analyzing module indicates the conflict created by the new rule with the existing rules.
19. The system of claim 13 , wherein the new rule analyzing module suggests, when the conflict is identified, a new placement for the new rule within the rule set.