Patent ID: 8856911
Filing Date: 2014-10-07
Classification: H04L

Abstract:
1. A method of recommending a security policy to a firewall, the method comprising: receiving, by a network service connected to a firewall via an internet, a request from the firewall for a recommendation as to whether the firewall should allow a detected present communication; searching, at the network service, information about past blocked and allowed communications at other firewalls on the network that have corresponding policy rules as the requesting firewall to identify past communications that are corresponding to the present communication, wherein the information includes information about a context of the past blocked and allowed communications and a state of the other firewalls, wherein identified past communications are assigned one of a respective positive and negative vote, wherein the positive vote indicates a respective past communication was allowed through a firewall on the network and wherein the negative vote indicates a past communication was not allowed through a firewall on the network, and wherein a value of the respective positive and negative vote is greater than or equal to one depending on a context of a respective past communication, which reflects various degrees of similarity to the context of the firewall requesting a recommendation so as to indicate how similar identified past communications are to a detected present communication; and sending, from the network service to the requesting firewall, a positive recommendation to the requesting firewall that the present communication be allowed if the positive votes are reliably outnumbering the negative votes, and sending a negative recommendation to the requesting firewall that the present communication be blocked if the negative votes outnumber the positive votes.