Method and system for mapping between connectivity requests and a security rule set
A system capable of automated mapping between a connectivity request and an ordered security rule-set and a method of operating thereof. The system includes an interface operable to obtain data characterizing at least one connectivity request; a module for automated recognizing at least one rule within the rule-set, the rule controlling traffic requested in the at least one connectivity request, wherein the recognizing is provided by comparing a set of combinations specified in the connectivity request with a set of combinations specified in the rule and matching connectivity-related actions specified in the connectivity request; a module for automated evaluating relationship between traffic controlled by the recognized at least one rule and traffic requested in the at least one connectivity request; and a module for automated classifying, in accordance with evaluation results, the at least one connectivity request with respect to the at least one rules and/or vice versa.
1. A method of computerized managing a security gateway operating in accordance with an ordered security rule-set, the method comprising:
storing in a memory at least two different revisions of the rule-set corresponding to two different points-in-time;
obtaining and storing in the memory data characterizing a first set of combinations of values specified in a connectivity request;
recognizing by a processor operatively coupled to the memory, in each of the at least two different revisions of the rule-set, at least one rule which at least partially controls a traffic requested in the connectivity request, whereby each of the at least two different revisions of the rule-set gives rise, respectively, to at least one rule engaged with respect to the connectivity request, wherein a second set of combinations of values specified in the at least one engaged rule intersects with the first set of combinations of values specified in the connectivity request;
evaluating by the processor, in each of the at least two revisions of the rule-set, a ratio between an un-shadowed volume corresponding to an intersection between the first set of combinations of values specified in the connectivity request and the second set of combinations of values specified in the at least one engaged rule and an un-shadowed allowable volume corresponding to the second set of combinations of values of the at least one engaged rule, to yield, for each of the at least two different revisions, a conformity ratio characterizing a degree of satisfaction of the connectivity request by the at least one engaged rule,
identifying, by the processor and among the at least two revisions of the rule-set, at least one revision of the rule-set matching a predefined criterion with respect to the connectivity request, the predefined criteria related, at least, to a predefined value of the conformity ratio; and
enabling implementing on the security gateway the identified at least one revision of the rule-set.
2. The method of claim 1 , wherein the predefined criterion is selected from the group consisting of:
a first revision of the rule-set which requires amendment of the at least one engaged rule in order to accept the connectivity request; and
a first revision of the rule-set which does not require amendment of the at least one engaged rule in order to accept the connectivity request.
3. The method of claim 1 further comprising:
recognizing by the processor, in each of the at least two revisions of the rule-set, all rules engaged with respect to the connectivity request, whereby each of the at least two revisions of the rule-set gives rise, respectively, to a set of engaged rules; and
evaluating by the processor, in each of at least two revisions of the rule-set, a relationship between the traffic requested in the connectivity request and a traffic controlled by each of the engaged rules of a respective set of engaged rules;
wherein the predefined criterion with respect to the connectivity request is selected from the group consisting of:
a first revision of the rule-set which, in order to accept the connectivity request, does not require amendment of any of the engaged rules;
a first revision of the rule-set which comprises at least one engaged rule requiring amendment in order to accept the connectivity request;
a first revision of the rule-set which comprises a modified set of engaged rules.
4. The method of claim 3 , wherein the conformity ratio is evaluated separately for fields of the engaged rules.
5. The method of claim 1 further comprising:
recognizing by the processor, in each of the at least two revisions of the rule-set, all rules engaged with respect to the connectivity request, whereby each of the at least two revisions of the rule-set gives rise to a set of engaged rules; and
evaluating by the processor, in each of at least two revisions of the rule-set, conformity ratio characterizing a degree of satisfaction of the connectivity request by the set of engaged rules;
wherein at least one respective revision of the rule-set is identified in accordance with the predefined criterion related to a predefined value of the conformity ratio characterizing a degree of satisfaction of the connectivity request by the set of engaged rules from the respective revision of the rule-set.
6. A rule-set manager operating in conjunction with a security gateway operating in accordance with an ordered security rule-set, the rule-set manager capable of automatically managing the ordered security rule-set, the rule-set manager comprising a processor operatively coupled to a memory and to an interface, wherein:
the memory is configured to store at least two different revisions of the rule-set corresponding to two different points-in-time the interface is configured to obtain and to store in the memory data characterizing a first set of combinations of values specified in a connectivity request;
the processor is configured to:
recognize, in each of the at least two different revisions of the rule-set, at least one rule which at least partially controls a traffic requested in the connectivity request, whereby each of the at least two different revisions of the rule-set gives rise, respectively, to at least one rule engaged with respect to the connectivity request, wherein a second set of combinations of values specified in the at least one engaged rule intersects with the first set of combinations of values specified in the connectivity request;
evaluate by the processor, in each of the at least two revisions of the rule-set, a ratio between an un-shadowed volume corresponding to an intersection between the first set of combinations of values specified in the connectivity request and the second set of combinations of values specified in the at least one engaged rule and an un-shadowed allowable volume corresponding to the second set of combinations of values of the at least one engaged rule, to yield, for each of the at least two different revisions, a conformity ratio characterizing a degree of satisfaction of the connectivity request by the at least one engaged rule,
identify, among the at least two revisions of the rule-set, at least one revision of the rule-set matching a predefined criterion with respect to the connectivity request, the predefined criteria related, at least, to a predefined value of the conformity ratio; and
enable implementing on the security gateway the identified at least one revision of the rule-set.
7. The rule-set manager of claim 6 , wherein the predefined criterion is selected from the group consisting of:
a first revision of the rule-set which requires amendment of the at least one engaged rule in order to accept the connectivity request; and
a first revision of the rule-set which does not require amendment of the at least one engaged rule in order to accept the connectivity request.
8. The rule-set manager of claim 6 , wherein the processor is further configured to:
recognize, in each of the at least two revisions of the rule-set, all rules engaged with respect to the connectivity request, whereby each of the at least two revisions of the rule-set gives rise to a respective set of engaged rules; and
evaluate, in each of at least two revisions of the rule-set, a relationship between the traffic requested in the connectivity request and a traffic controlled by each of the engaged rules of the respective set of engaged rules;
wherein the predefined criterion with respect to the connectivity request is selected from the group consisting of:
a first revision of the rule-set which, in order to accept the connectivity request, does not require amendment of any of the engaged rules;
a first revision of the rule-set which comprises at least one engaged rule requiring amendment in order to accept the connectivity request;
a first revision of the rule-set which comprises a modified set of engaged rules.
9. The rule-set manager of claim 8 , wherein the conformity ratio is evaluated separately for fields of the engaged rules.
10. The rule-set manager of claim 6 , wherein the processor is further configured to:
recognize, in each of the at least two revisions of the rule-set, all rules engaged with respect to the connectivity request, whereby each of the at least two revisions of the rule-set gives rise to a respective set of engaged rules;
evaluate, in each of at least two revisions of the rule-set, conformity ratio characterizing a degree of satisfaction of the connectivity request by the recognized respective set of engaged rules;
wherein at least one respective revision of the rule-set is identified in accordance with the predefined criterion related to a predefined value of the conformity ratio characterizing a degree of satisfaction of the connectivity request by the set of engaged rules from the respective revision of the rule-set.
11. The rule-set manager of claim 6 being an integrated part of the security gateway.
12. The rule-set manager of claim 6 being a part of a security management system operatively coupled to the security gateway.
13. A computer program product comprising a non-transitory computer useable medium having computer readable program code embodied therein for automatically managing an ordered security rule-set, the computer program product comprising:
computer readable program code for recognizing, upon obtaining data characterizing a first set of combinations of values specified in a connectivity request and in each of at least two different revisions of the rule-set corresponding to two different points-in-time, at least one rule which at least partially controls a traffic requested in the connectivity request, wherein each of the at least two different revisions of the rule-set gives rise, respectively, to at least one rule engaged with respect to the connectivity request, wherein a second set of combinations of values specified in the at least one engaged rule intersects with the first set of combinations of values specified in the connectivity request;
computer readable program code for evaluating by a processor, in each of the at least two revisions of the rule-set, a ratio between an un-shadowed volume corresponding to an intersection between the first set of combinations of values specified in the connectivity request and the second set of combinations of values specified in the at least one engaged rule and an un-shadowed allowable volume corresponding to the second set of combinations of values of the at least one engaged rule, to yield, for each of the at least two different revisions, a conformity ratio characterizing a degree of satisfaction of the connectivity request by the at least one engaged rule,
computer readable program code for identifying, by the processor and among the at least two revisions of the rule-set, at least one revision of the rule-set matching a predefined criterion with respect to the connectivity request, the predefined criteria related, at least, to a predefined value of the conformity ratio; and
computer readable program code for implementing the identified at least one revision of the rule-set.