Patent ID: 9043461
Filing Date: 2015-05-26
Classification: H04L

Abstract:
1. A method for firewall rule use counting, the method comprising: receiving log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector; generating a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network; generating a source port and protocol list and a destination port and protocol list for each respective device in the plurality of devices; generating a unique object for each log data set received; generating a mapping database comprising an entry for each log data set received associated with the unique object; feeding each entry in the mapping database through a topology model representative of the particular network; generating a reference to a unique firewall rule on a respective device in the plurality of devices; incrementing a count associated with the unique firewall rule using a count of logs stored associated with the respective unique object; and generating a report.