Patent ID: 9438563
Filing Date: 2016-09-06
CPC Classification: G06F,H04L

Claim Text:
1. A method comprising: maintaining, by a firewall device within a private Internet Protocol (IP) network of an enterprise, a log of network traffic observed by the firewall device by storing, for each network traffic flow, information regarding one or more of traffic volume, a source interface, a destination interface, a source IP address, a destination IP address, an application name, an application type, port information, one or more timestamps and a username associated with the network traffic flow; receiving, by the firewall device, a request from a network administrator for a report to be generated based on the log, the request containing information indicative of report parameters including (i) a specified time frame, (ii) user information indicative of an identity of one or more users within the enterprise; and (iii) application information indicative of one or more particular applications or one or more types of applications associated with the logged network traffic; extracting, by the firewall device, information regarding network traffic flows from the log satisfying the report parameters; presenting, by the firewall device, a customized and interactive hierarchical report to the network administrator via a graphical user interface (GUI) of the firewall device, the customized and interactive hierarchical report including (i) a plurality of aggregated network traffic items; and (ii) a plurality of action objects each corresponding to one of the plurality of aggregated network traffic items, wherein information associated with the plurality of aggregated network traffic items is determined by individually aggregating each of a plurality of traffic aggregation parameters for each observed value of a primary report parameter within the extracted information, wherein the plurality of traffic aggregation parameters, include one or more traffic volume and percentage of traffic volume; responsive to interaction by the network administrator with a particular action object of the plurality of action objects: responsive to receiving, by the firewall device, an indication from the network administrator regarding one or more selected options of the plurality of options, defining and establishing the appropriate firewall policy, wherein the appropriate firewall policy comprises one or more rules to identify the matching network traffic and one or more corresponding actions to be taken on the matching network traffic based on the one or more selected options.