Systems and methods for security configuration
View Patent ↗A method of configuring a network security device includes receiving a changed set of network rules to replace a current set of network rules; using a plurality of network traffic events to perform a first simulation of according to the current set of network rules and a second simulation according to the changed set of network rules; comparing the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules; displaying the changes in allowed and denied traffic for review of the changed set of network rules; receiving an instruction to implement the changed set of network rules based on the review; and filtering network traffic according to the changed set of network rules.
1. A network security device comprising:
a memory configured to:
store a plurality of network events; and
store a set of network filter rules;
a processor configured to:
provide an interface for modifying the set of network rules;
receive a change to a set of network rules;
perform a first simulation of network traffic allowed and denied according to the current set of network rules and a second simulation of network traffic allowed and denied according to the changed set of network rules using at least a portion of the network events;
compare the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules;
calculate an entropy of strings matching a wildcard of a new network rule of the chanced set of network rules;
display the changes in allowed and denied traffic for review of the changed set of network rules and the entropy of the new network rule;
receive an instruction to implement the changed set of network rules based on the review; and
filter network traffic according to the changed set of network rules.
2. The network security device of claim 1 , wherein the network events are stored in a first-in-first out buffer.
3. The network security device of claim 1 , wherein the processor is further configured to group and display the plurality of network events.
4. The network security device of claim 1 , wherein the processor is further configured to evaluate the use of computational resources during the first and second simulation.
5. The network security device of claim 1 , wherein the processor is further configured to display a performance impact of the changed set of network rules.
6. The network security device of claim 1 , wherein the processor is further configured to:
evaluate the use of computational resources during the first and second simulation; and
display a performance impact of the changed set of network rules or rejecting the changed set of rules if the performance impact crosses a threshold.
7. The network security device of claim 1 , wherein the processor is further configured to:
calculate a ratio of allowed traffic between the current set of network rules and the changed set of network rules; and
reject the changed set of network rules if the ratio crosses a threshold.
8. The network security device of claim 1 , wherein the processor is further configured to log a set of alerts generated by the changed set of network rules but not by the current set of network rules.
9. The network security device of claim 1 , wherein the processor is further configured to:
calculate a rule quality score for the changed set of network rules; and
display the rule quality score or reject the changed set of rules if the rule quality score crosses a threshold.
10. A method for network security configuration, comprising:
receiving a changed set of network rules to replace a current set of network rules;
using a plurality of network traffic events to perform a first simulation of network traffic allowed and denied according to the current set of network rules and a second simulation of network traffic allowed and denied according to the changed set of network rules;
comparing the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules;
calculating the entropy of string matching a wildcard of a new network rule of the changed set of network rules;
displaying the changes in allowed and denied traffic for review of the changed set of network rules;
receiving an instruction to implement the changed set of network rules based on the review; and
filtering network traffic according to the changed set of network rules.
11. The method of claim 10 , wherein the network events are stored in a first-in-first-out buffer.
12. The method of claim 10 , further comprising:
evaluating the use of computational resources during the first and second simulation; and
displaying a performance impact of the changed set of network rules or rejecting the changed set of rules if the performance impact crosses a threshold.
13. The method of claim 10 , further comprising calculating a ratio of allowed traffic between the current set of network rules and the changed set of network rules, and reject the changed set of network rules if the ratio crosses a threshold.
14. The method of claim 10 , further comprising logging a set of alerts generated by the changed set of network rules but not by the current set of network rules.
15. The method of claim 10 , further comprising:
calculating a rule quality score for the changed set of network rules; and
displaying the rule quality score or rejecting the changed set of rules if the rule quality score crosses a threshold.
16. A method for network security configuration, comprising:
retrieving a plurality of network events;
grouping and displaying the plurality of network events;
receiving a changed network rule;
simulating the effect of the changed network rule on the plurality of network events;
calculating an entropy of strings matching a wildcard of the changed network rule;
using a processor to evaluate the changed network rule based on a plurality of conditions including rejecting a rule quality score crossing a threshold a ratio of allowed traffic crosses a threshold, and a performance impact cross a threshold and to reject the changed network rule if at least one of the conditions is met; the rule quality based at least in part on the calculated entropy; and
filtering network traffic according to the changed network rule if the changed network rule is not rejected.
17. The method of claim 16 , wherein the plurality of network events are stored in a first-in-first-out buffer.
18. The method of claim 16 , further comprising evaluating the performance impact by comparing a processor usage of a current network rule and the changed network rule.
19. The method of claim 16 , further comprising evaluating the performance impact by comparing a memory usage of a current network rule and the changed network rule.
20. The method of claim 16 , further comprising calculating a ratio of allowed traffic between a current network rule and the changed network rule.