Firewall event reduction for rule use counting

1. A computer program product for firewall rule use counting, the computer program product comprising:

one or more computer recordable-type data storage devices containing computer executable program code stored thereon, where the computer executable program code when executed on a computer causes the computer to:

receive log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector;

generate a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network;

generate a source port and protocol list and a destination port and protocol list for each respective device in the plurality of devices;

generate a unique object for each log data set received;

generate a mapping database comprising an entry for each log data set received associated with the unique object;

feed each entry in the mapping database through a topology model representative of the particular network;

generate a reference to a unique firewall rule on a respective device in the plurality of devices;

increment a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object; and

generate a report.

2. The computer program product of claim 1 , where the set of databases further comprises:

a rule database containing a record of all firewall rules from each firewall rule whose counts are to be tracked, a route database containing a record of all routing rules from each firewall and each router in a network, a subnet database containing a record of all subnets used on interfaces of each firewall and each router in the network.

3. The computer program product of claim 1 , where, in causing the computer to generate a network trie for each reference database, the computer executable program code when executed on the computer causes the computer to:

read all entries in a routing database, a rules database, and a subnet database, to populate several network tries, where a trie is created for each classless inter-domain routing (CIDR) addresses used in a destination field of routes to form a route trie, CIDR addresses present in the subnet database to form an interface trie, for each firewall device, creating a device source trie containing all CIDR addresses used in sources of firewall rules, and a destination trie containing all CIDR addresses used in the destination of firewall rules;

read all entries in the rules database, to create a list for each firewall device of source ports and list of protocols used in rules of the respective device; and

read all entries in the rules database, to create a list for each firewall device of destination ports and list of protocols used in rules of the respective device.

4. The computer program product of claim 1 , where, in causing the computer to generate a unique object for each log data set received, the computer executable program code when executed on the computer causes the computer to:

create a unique object as each firewall log enters the system, using attributes of a narrowest CIDR network of results from a source IP address lookup in the route trie, the interface trie, and the device source trie; a narrowest CIDR network of results from a destination IP address lookup in the route trie, the interface trie, and the device destination trie;

determine whether the source port and/or protocol are present in the log and are also present in the list of ports and protocols used in rules for this device;

add, responsive to a positive determination, the source port and/or protocol to the unique object; and

add, responsive to a negative determination, a null value to the unique object.

5. The computer program product of claim 1 , where, in causing the computer to generate a reference to a unique firewall rule on a respective device in the plurality of devices, the computer executable program code when executed on the computer causes the computer to:

read all entries in a database mapping unique objects to log counts into the topological model, where a reference to a unique firewall rule on a given device is identified.

6. The computer program product of claim 1 , where, in causing the computer to increment a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object, the computer executable program code when executed on the computer causes the computer to:

determine whether a count of logs associated with the unique object exists in a database mapping unique objects to log counts;

increment, responsive to the count of logs associated with the unique object exists, a count of events associated with the unique object; and

create, responsive to the count of logs associated with the unique object does not exist, a count of logs associated with the unique object.

7. The computer program product of claim 1 , where, in causing the computer to feed each entry in the mapping database through a topology model representative of the particular network, the computer executable program code when executed on the computer causes the computer to:

create the topological model using all routes, devices, and firewall rules on the particular network, such that a given Internet protocol packet constructed and fed into the topological model behaves as it would on the particular network.

8. An apparatus for firewall rule use counting, the apparatus comprising:

a communications fabric;

one or more computer recordable data storage devices connected to the communications fabric;

a memory connected to the communications fabric, where the memory contains computer executable program code;

a communications unit connected to the communications fabric;

an input/output unit connected to the communications fabric; and

one or more processors connected to the communications fabric, where the one or more processors execute the computer executable program code to direct the apparatus to:

receive log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector;

generate a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network;

generate a source port and protocol list and a destination port and protocol list for each respective device in the plurality of devices;

generate a unique object for each log data set received;

generate a mapping database comprising an entry for each log data set received associated with the unique object;

feed each entry in the mapping database through a topology model representative of the particular network;

generate a reference to a unique firewall rule on a respective device in the plurality of devices;

increment a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object; and

generate a report.

9. The apparatus of claim 8 , where the set of databases further comprises:

a rule database containing a record of all firewall rules from each firewall rule whose counts are to be tracked, a route database containing a record of all routing rules from each firewall and each router in a network, a subnet database containing a record of all subnets used on interfaces of each firewall and each router in the network.

10. The apparatus of claim 8 , where the one or more processors execute the computer executable program code to generate a network trie for each reference database directs the apparatus to:

read all entries in a routing database, a rules database, and a subnet database, to populate several network tries, where a trie is created for each classless inter-domain routing (CIDR) addresses used in a destination field of routes to form a route trie, CIDR addresses present in the subnet database to form an interface trie, for each firewall device, creating a device source trie containing all CIDR addresses used in sources of firewall rules, and destination trie containing all CIDR addresses used in the destination of firewall rules;

read all entries in the rules database, to create a list for each firewall device of source ports and list of protocols used in rules of the respective device; and

read all entries in the rules database, to create a list for each firewall device of destination ports and list of protocols used in rules of the respective device.

11. The apparatus of claim 8 , where the one or more processors execute the computer executable program code to generate a unique object for each log data set received directs the apparatus to:

create a unique object as each firewall log enters the system, using attributes of a narrowest CIDR network of results from a source IP address lookup in the route trie, the interface trie, and the device source trie; a narrowest CIDR network of results from a destination IP address lookup in the route trie, the interface trie, and the device destination trie;

determine whether the source port and/or protocol are present in the log and are also present in the list of ports and protocols used in rules for this device;

responsive to a positive determination, add the source port and/or protocol to the unique object; and

responsive to a negative determination, add a null value to the unique object.

12. The apparatus of claim 8 , where the one or more processors execute the computer executable program code to generate a reference to a unique firewall rule on a respective device in the plurality of devices directs the apparatus to:

read all entries in a database mapping unique objects to log counts into the topological model, where a reference to a unique firewall rule on a given device is identified.

13. The apparatus of claim 8 , where the one or more processors execute the computer executable program code to increment a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object directs the apparatus to:

determine whether a count of logs associated with the unique object exists in a database mapping unique objects to log counts;

responsive to a determination the count of logs associated with the unique object exists, increment a count of events associated with the unique object; and

responsive to a determination to the count of logs associated with the unique object does not exist, create a count of logs associated with the unique object.