Method and system for intrusion detection and prevention

1. A method implemented on at least one machine including at least one processor, memory, and communications circuitry connected to a network for providing optimized access control rules, the method comprising:

receiving a request from a client device;

determining, based on the request, that an update is needed for access control rule information for the client device;

generating rule data comprising a plurality of data buckets each comprising one or more access control rules, each data bucket of the plurality being associated with a range of destination port numbers, and wherein each of the one or more access control rules comprise a set of tuples having a common source network and source port number, and one or more destination port numbers associated with the common source network and source port number; and

sending the rule data to the client device.

2. The method of claim 1 , wherein generating the rule data comprises:

identifying at least one group of subnets that one or more Internet Protocol (“IP”) addresses associated with the client device belong to;

determining one or more associated access control rules that are applicable to each of the at least one group of subnets; and

generating temporary rule data representing one or more temporary access control rules, each of the one or more temporary access control rules indicating at least: a protocol associated with the temporary access control rule, a corresponding source IP address that the temporary access control rule is applicable for, a corresponding source port number range for the corresponding source IP address, a destination IP address from the one or more IP addresses, and a destination port number range associated with the destination IP address.

3. The method of claim 2 , further comprising:

generating, from the temporary rule data, one or more tuples, where each of the one or more tuples comprise at least one of the one or more temporary access control rules that includes a same protocol, a same destination IP address, and a same destination port number; and

generating one or more rule sets each comprising at least one of the one or more tuples that includes a same corresponding source IP address.

4. The method of claim 3 , further comprising:

determining, from the one or more rule sets, each source IP address having the same destination port number; and

generating at least one combined rule set, wherein each combined rule set includes a first access control rule specifying the corresponding source IP address for the first access control rule and each destination port number range associated with the corresponding source IP address.

5. The method of claim 4 , further comprising:

determining a number of rule sets for the at least one combined rule set; and

determining a segmentation parameter for generating the plurality of data buckets, the segmentation parameter being determined based on the number of rule sets and the destination port number associated with the at least one combined rule set such that the plurality of data buckets are generated using the segmentation parameter.

6. The method of claim 1 , further comprising:

receiving an incoming data packet;

determining a destination port number associated with the incoming data packet;

determining a first data bucket of the plurality of data buckets associated with the destination port number; and

processing the incoming data packet using at least one of the one or more access control rules that the first data bucket includes.

7. The method of claim 1 , further comprising:

receiving an incoming data packet;

determining a destination port number associated with the incoming data packet;

selecting a first data bucket of the plurality of data buckets, the first data bucket being associated with a first range of destination port numbers;

determining that the destination port number is absent from within the first range of destination port numbers; and

selecting a second data bucket of the plurality of data buckets, the second data bucket being associated with a second range of destination port numbers distinct from the first range of destination port numbers; and

determining whether the destination port number is included within the second range of destination port numbers.

8. A system including at least one processor, memory, and communications circuitry connected to a network for providing optimized access control rules, the system comprising:

a request receiver configured to receive a request from a client device;

an update availability determiner configured to determine, based on the request, that an update is needed for access control rule information for the client device;

a rule generation system configured to generate rule data comprising a plurality of data buckets each comprising one or more access control rules, each data bucket of the plurality being associated with a range of destination port numbers, and wherein each of the one or more access control rules comprises a set of tuples having a common source network and source port number, and one or more destination port numbers associated with the common source network and source port number; and

a transmission unit configured to send the rule data to the client device.

9. The system of claim 8 , wherein the rule generation system further comprises:

an IP group identifier configured to identify at least one group of subnets that one or more Internet Protocol (“IP”) addresses associated with the client device belong to;

a group rule identifier configured to determine one or more associated access control rules that are applicable to each of the at least one group of subnets; and

a temporary rule generator configured to generate temporary rule data representing one or more temporary access control rules, each of the one or more temporary access control rules indicating at least: a protocol associated with the temporary access control rule, a corresponding source IP address that the temporary access control rule is applicable for, a corresponding source port number range for the corresponding source IP address, a destination IP address from the one or more IP addresses, and a destination port number range associated with the destination IP address.

10. The system of claim 9 , wherein the rule generation system further comprises a rule optimization system, the rule optimization system including:

a first optimization unit configured to:

generate, from the temporary rule data, one or more tuples, where each of the one or more tuples comprises at least one of the one or more temporary access control rules that includes a same protocol, a same destination IP address, and a same destination port number, and

generate one or more rule sets each comprising at least one of the one or more tuples that includes a same corresponding source IP address.

11. The system of claim 10 , wherein the rule optimization system further comprises:

a second optimization unit configured to:

determine, from the one or more rule sets, each source IP address having the same destination port number, and

generate at least one combined rule set, wherein each combined rule set includes a first access control rule specifying the corresponding source IP address for the first access control rule and each destination port number range associated with the corresponding source IP address.

12. The system of claim 11 , wherein the rule optimization system further comprises:

a third optimization unit configured to:

determine a number of rule sets for the at least one combined rule set, and

determine a segmentation parameter for generating the plurality of data buckets, the segmentation parameter being determined based on the number of rule sets and the destination port number associated with the at least one combined rule set, such that the plurality of data buckets are generated using the segmentation parameter.

13. The system of claim 8 , further comprising a telemetry data analyzer configured to:

receive an incoming data packet;

determine a destination port number associated with the incoming data packet;

determine a first data bucket of the plurality of data buckets associated with the destination port number; and

process the incoming data packet using at least one of the one or more access control rules that the first data bucket includes.

14. The system of claim 8 , further comprising a telemetry data analyzer configured to:

receive an incoming data packet;

determine a destination port number associated with the incoming data packet;

select a first data bucket of the plurality of data buckets, the first data bucket being associated with a first range of destination port numbers;

determine that the destination port number is absent from within the first range of destination port numbers; and

select a second data bucket of the plurality of data buckets, the second data bucket being associated with a second range of destination port numbers distinct from the first range of destination port numbers; and

determine whether the destination port number is included within the second range of destination port numbers.

15. A non-transitory computer readable medium comprising instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive a request from a client device;

determine, based on the request, that an update is needed for access control rule information for the client device;

generate rule data comprising a plurality of data buckets each comprising one or more access control rules, each data bucket of the plurality being associated with a range of destination port numbers, and wherein each of the one or more access control rules comprises a set of tuples having a common source network and source port number, and one or more destination port numbers associated with the common source network and source port number; and

send the rule data to the client device.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions associated with the rule data being generated, when read by the at least one processor, cause the computing device to:

identify at least one group of subnets that one or more Internet Protocol (“IP”) addresses associated with the client device belong to;

determine one or more associated access control rules that are applicable to each of the at least one group of subnets; and

generate temporary rule data representing one or more temporary access control rules, each of the one or more temporary access control rules indicating at least: a protocol associated with the temporary access control rule, a corresponding source IP address that the temporary access control rule is applicable for, a corresponding source port number range for the corresponding source IP address, a destination IP address from the one or more IP addresses, and a destination port number range associated with the destination IP address.

17. The non-transitory computer readable medium of claim 16 , wherein the instructions, when read by the at least one processor, further cause the computing device to:

generate, from the temporary rule data, one or more tuples, where each of the one or more tuples comprises at least one of the one or more temporary access control rules that includes a same protocol, a same destination IP address, and a same destination port number; and

generate one or more rule sets each comprising at least one of the one or more tuples that includes a same corresponding source IP address.

18. The non-transitory computer readable medium of claim 17 , wherein the instructions, when read by the at least one processor, further cause the computing device to:

determine, from the one or more rule sets, each source IP address having the same destination port number; and

generate at least one combined rule set, wherein each combined rule set includes a first access control rule specifying the corresponding source IP address for the first access control rule and each destination port number range associated with the corresponding source IP address.

19. The non-transitory computer readable medium of claim 18 , wherein the instruction, when read by the at least one processor, further cause the computing device to:

determine a number of rule sets for the at least one combined rule set; and

determine a segmentation parameter for generating the plurality of data buckets, the segmentation parameter being determined based on the number of rule sets and the destination port number associated with the at least one combined rule set, such that the plurality of data buckets are generated using the segmentation parameter.

20. The non-transitory computer readable medium of claim 15 , wherein the instruction, when read by the at least one processor, further cause the computing device to:

determine a destination port number associated with an incoming data packet;

select a first data bucket of the plurality of data buckets, the first data bucket being associated with a first range of destination port numbers;

determine that the destination port number is absent from within the first range of destination port numbers; and

select a second data bucket of the plurality of data buckets, the second data bucket being associated with a second range of destination port numbers distinct from the first range of destination port numbers; and

determining whether the destination port number is included within the second range of destination port numbers.