Patent ID: 8255985
Filing Date: 2012-08-28
Classification: H04L

Abstract:
1. A method of recommending a security policy to a firewall, the method comprising: receiving, by a network service connected to a firewall via an internet, a request from the firewall for a recommendation as to whether the firewall should block a detected present communication; determining whether an existing security policy addresses whether to block the communication; in response to determining that no existing security policy addresses whether to block the communication, searching, at the network service, information about past blocked and allowed communications at other firewalls on the network that have corresponding policy rules and a corresponding state as the requesting firewall to identify past communications that are corresponding to the communication, wherein identified past communications are assigned a respective positive or negative vote, wherein the positive vote indicates a respective past communication was allowed through a firewall on the network and wherein the negative vote indicates a past communication was not allowed through a firewall on the network, and wherein a value of the respective positive and negative vote is less than or equal to one depending on a context of a respective past communication, which reflects various degrees of similarity to the context of the firewall requesting a recommendation so as to indicate how similar identified past communications are to a detected present communication; and sending, from the network service to the requesting firewall, one of the following graduated recommendations a positive recommendation to the requesting firewall: a strong positive recommendation to allow that the present communication allowed if the positive votes overwhelmingly outnumber the negative votes, a moderate positive recommendation to allow the communication if the positive votes moderately outnumber the negative votes, a weak positive recommendation to allow the communication if the positive votes only somewhat outnumber the negative votes, a null recommendation if the positive votes are not enough to reliably indicate that the communication be allowed.