Patent ID: 11936621
Assignee: THE BANK OF NEW YORK MELLON
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 3:
4. The non-transitory computer-readable medium of claim 1, wherein a computing network comprises the first plurality of computers, the second plurality of computers, and a third plurality of computers, the operations further comprise:
obtaining, with the computing system, a third set of firewall rules of a third firewall for a third instance of the distributed application, wherein a third set of services of the plurality of services of the third instance of the distributed application are executed on the third plurality of computers, wherein each firewall rule of the third set of firewall rules comprises a respective IP address and a respective port number of a third port over which network traffic directed to a respective service at the respective IP address and the respective port number is to be communicated;
obtaining, with the computing system, a mapping of IP addresses to identifiers of services from amongst the first set of services, the second set of services, and the third set of services;
determining, with the computing system, based on the first set of firewall rules and the third set of firewall rules and the mapping, respectively, (i) a third set of IP addresses authorized to communicate with the first set of services and a third set of port numbers of respective third ports over which communications between a respective IP address from the third set of IP addresses and a respective service from the first set of services are transmitted, and (ii) a fourth set of IP addresses authorized to communicate with the third set of services and a fourth set of port numbers of respective fourth ports over which communications between a respective IP address from the fourth set of IP addresses and a respective service from the third set of services are transmitted;
generating, with the computing system, third connectivity data indicating, for each of the third set of IP addresses and each of the fourth set of IP addresses, respectively, a respective port number from the third set of port numbers over which communications between a respective IP address from the third set of IP addresses and a respective service from the first set of services are transmitted, and a respective port number from the fourth set of port numbers over which communications between a respective IP address from the fourth set of IP addresses and a respective service from the third set of services are transmitted; and
generating, with the computing system, second comparison data based on a comparison of the first connectivity data and the third connectivity data, wherein the second comparison data indicates whether firewall drift is detected for the third set of firewall rules.