Intelligent Firewall Flow Processor
Example systems, methods, and storage media are described. An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain telemetry data, the telemetry data including flow processing data associated with a plurality of flows. The instructions cause the network system to rank the plurality of flows indicated by the telemetry data according to importance. The instructions cause the network system to send information indicative of a respective rank of at least one of the plurality of flows to at least one of a controller or a network interface card (NIC), the NIC comprising NIC processing circuitry.
1 . A network system comprising:
processing circuitry; and
one or more memories coupled to the processing circuitry and configured to store instructions which, when executed by the processing circuitry, cause the network system to:
obtain telemetry data, the telemetry data including flow processing data associated with a plurality of flows;
rank the plurality of flows indicated by the telemetry data according to importance; and
send information indicative of a respective rank of at least one of the plurality of flows to at least one of a controller or a network interface card (NIC), the NIC comprising NIC processing circuitry.
2 . The network system of claim 1 , wherein as part of ranking the plurality of flows indicated by the telemetry data according to importance, the instructions cause the network system to, for each respective flow of the plurality of flows, determine importance criteria, the importance criteria comprising at least one of:
a flow hit rate, wherein the flow hit rate comprises a number of successful firewall flow evaluations for the respective flow out of a total number of evaluations for the respective flow during a time period;
a related flow hit rate, wherein the related flow hit rate comprises an indication of a number of successful firewall flow evaluations for one or more related flows to the respective flow out of a total number of evaluations for the one or more related flows during the time period;
a flow close missed rate, wherein the flow close missed rate comprises an indication of the number of failed firewall flow evaluations for the respective flow meeting an attribute threshold out of the total number of evaluations for the respective flow during the time period; or
a flow criticality.
3 . The network system of claim 2 , wherein each of the one or more related flows comprises a commonality in at least one attribute with the respective flow.
4 . The network system of claim 3 , wherein the at least one attribute comprises at least one of a source address, a destination address, a source port number, a destination port number, or a protocol.
5 . The network system of claim 2 , wherein as part of determining the flow close missed rate, the instructions cause the network system to:
determine a first number of attributes of the respective flow that failed during a first firewall flow evaluation of the respective flow;
determine that the first number of attributes meets the attribute threshold; and
based on the first number of attributes meeting the attribute threshold, classify the first firewall flow evaluation of the respective flow as a close miss;
determine a second number of attributes of the respective flow that failed during a second firewall flow evaluation of the respective flow;
determine that the second number of attributes does not meet the attribute threshold; and
based on the second number of attributes not meeting the attribute threshold, classify the second firewall flow evaluation of the respective flow as not being a close miss.
6 . The network system of claim 5 , wherein the attribute threshold is user definable.
7 . The network system of claim 2 , wherein flow criticality is indicatable by a user selectable flag, the user selectable flag indicating either a highest importance or not a highest importance, wherein an indication of a highest importance causes the network system to rank the respective flow as being of a highest importance and wherein an indication of not a highest importance causes the network system to utilize other importance criteria to determine the importance of the respective flow.
8 . The network system of claim 1 , wherein the instructions cause the processing circuitry to execute a machine learning model to rank the plurality of flows indicated by the telemetry data based on importance.
9 . The network system of claim 1 , wherein the instructions further cause the NIC to process one or more of the plurality of flows in accordance with the ranking.
10 . A method comprising:
obtaining telemetry data, the telemetry data including flow processing data associated with a plurality of flows;
ranking the plurality of flows indicated by the telemetry data according to importance; and
sending information indicative of a respective rank of at least one of the plurality of flows to at least one of a controller or at least one network interface card (NIC), the at least one NIC comprising NIC processing circuitry.
11 . The method of claim 10 , wherein ranking the plurality of flow indicated by the telemetry data according to importance comprises, for each respective flow of the plurality of flows, determining importance criteria, the importance criteria comprising at least one of:
a flow hit rate, wherein the flow hit rate comprises a number of successful firewall flow evaluations for the respective flow out of a total number of evaluations for the respective flow during a time period;
a related flow hit rate, wherein the related flow hit rate comprises an indication of a number of successful firewall flow evaluations for one or more related flows to the respective flow out of a total number of evaluations for the one or more related flows during the time period;
a flow close missed rate, wherein the flow close missed rate comprises an indication of the number of failed firewall flow evaluations for the respective flow meeting an attribute threshold out of the total number of evaluations for the respective flow during the time period; or
a flow criticality.
12 . The method of claim 11 , wherein each of the one or more related flows comprises a commonality in at least one attribute with the respective flow.
13 . The method of claim 12 , wherein the at least one attribute comprises at least one of a source address, a destination address, a source port number, a destination port number, or a protocol.
14 . The method of claim 11 , wherein determining the flow close missed rate comprises:
determining a first number of attributes of the respective flow that failed during a first firewall flow evaluation of the respective flow;
determining that the first number of attributes meets the attribute threshold; and
based on the first number of attributes meeting the attribute threshold, classifying the first firewall flow evaluation of the respective flow as a close miss;
determining a second number of attributes of the respective flow that failed during a second firewall flow evaluation of the respective flow;
determining that the second number of attributes does not meet the attribute threshold; and
based on the second number of attributes not meeting the attribute threshold, classifying the second firewall flow evaluation of the respective flow as not being a close miss.
15 . The method of claim 14 , further comprising obtaining, from a user, the attribute threshold.
16 . The method of claim 11 , wherein flow criticality is indicatable by a user selectable flag, the user selectable flag indicating either a highest importance or not a highest importance, wherein an indication of a highest importance causes the network system to rank the respective flow as being of a highest importance and wherein an indication of not a highest importance causes the network system to utilize other importance criteria to determine the importance of the respective flow.
17 . The method of claim 10 , wherein ranking the plurality of flows comprises executing a machine learning model.
18 . The method of claim 10 , further comprising processing, by the NIC, one or more of the plurality of flows in accordance with the ranking.
19 . Non-transitory computer-readable storage media storing instructions, which, when executed, cause processing circuitry to:
obtain telemetry data, the telemetry data including flow processing data associated with a plurality of flows;
rank the plurality of flows indicated by the telemetry data according to importance; and
send information indicative of a respective rank of at least one of the plurality of flows to at least one of a controller or at least one network interface card (NIC), the at least one NIC comprising NIC processing circuitry.
20 . The non-transitory computer-readable storage media of claim 19 , wherein as part of ranking the plurality of flows indicated by the telemetry data according to importance, the instructions cause the network system to, for each respective flow of the plurality of flows, determine importance criteria, the importance criteria comprising at least one of:
a flow hit rate, wherein the flow hit rate comprises a number of successful firewall flow evaluations for the respective flow out of a total number of evaluations for the respective flow during a time period;
a related flow hit rate, wherein the related flow hit rate comprises an indication of a number of successful firewall flow evaluations for one or more related flows to the respective flow out of a total number of evaluations for the one or more related flows during the time period;
a flow close missed rate, wherein the flow close missed rate comprises an indication of the number of failed firewall flow evaluations for the respective flow meeting an attribute threshold out of the total number of evaluations for the respective flow during the time period; or
a flow criticality.