Patent Description:
In each solution, however, the engineer must manually define the rules, either textually or through a graphical interface. As the number of resources increases on a given network, such as into the hundreds, thousands, or greater numbers, the less scalable these solutions become. Furthermore, existing techniques are cumbersome, tedious, and time-consuming, often requiring several engineers (or teams of engineers) to manage the network security for an organization. In addition, existing techniques are prone to errors, leaving open unintended communication paths that result in security vulnerabilities that may be exploited. <CIT> describes a method of creating micro-segmentation policy for a network. <CIT> describes a network that can achieve compliance by defining and enforcing a set of network policies to secure protected electronic information. <CIT> describes a network switch that automatically detects Voice over Internet Protocol (VoIP) traffic and mirrors the VoIP traffic to a security management device.

Methods, systems, apparatuses, and computer program products are provided for generating an enhanced network security rule. Existing security rules may be determined across a network that includes a plurality of network resources, such as computing devices and virtual machines. A map is generated that identifies each of the permitted connections between the resources over the network. In some implementations, the map may include a network topology map. Network traffic data for each of the permitted connections may be monitored or gathered. Based on the existing security rules and the gathered network traffic data, an enhanced security rule may be generated for a particular connection that reduces data traffic over connection.

In accordance with implementations described herein, communication paths that are open based on existing security rules may be restricted if network traffic is not observed over the communication path over a monitoring period. In this manner, generation of security rules for implementation on a network that takes into account an existing network landscape as well as actual network usage may be automated to enhance the overall network security of an organization.

Further features and advantages of the invention, as well as the structure and operation of various embodiments, are described in detail below with reference to the accompanying drawings. It is noted that the invention is not limited to the specific embodiments described herein. Such embodiments are presented herein for illustrative purposes only. Additional embodiments will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein.

Further, when a particular feature, structure, or characteristic is described in connection with an example embodiment, it is submitted that it is within the knowledge of one skilled in the art to effect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

In the discussion, unless otherwise stated, adjectives such as "substantially" and "about" modifying a condition or relationship characteristic of a feature or features of an example embodiment of the disclosure, are understood to mean that the condition or characteristic is defined to within tolerances that are acceptable for operation of the embodiment for an application for which it is intended.

Network security is an integral aspect in the protection of computers and sensitive content of an organization. For instance, where an organization relies on cloud-based applications or platforms, cloud providers may enable users to restrict access to network resources based on one or more user-defined access rules. Such rules may be implemented in a network firewall or by identifying security groups. In typical environments, a user must analyze the network and generate access rules manually. For example, an engineer responsible for a company's network security may need to identify which restrictions should be put in place and write specific rules for each access restriction. In other situations, the engineer may group or isolate network resources and specify the allowed communication paths between resources.

In each solution, however, the engineer must manually define the rules, either textually or through a graphical interface. An organization may have thousands of servers and thousands of user computers (e.g., desktops and laptops) connected to their network. The servers may each be a certain type of server such as a load balancing server, a firewall server, a database server, an authentication server, a personnel management server, a web server, a file system server, and so on. In addition, the user computers may each be a certain type such as a management computer, a technical support computer, a developer computer, a secretarial computer, and so on. Each server and user computer may have various applications installed that are needed to support the function of the computer. As a result, thousands of devices of different types operating thousands of applications may be interconnected by tens of thousands of connections. The many thousands of devices, applications, and connections, and existing security settings on the various network resources make it impossible for human network analyzers to configure network security for a given network. Even relatively small numbers of devices lead to many numbers of applications, existing security settings, and possible connections between the devices, again making it impractical for human network analyzers to configure network security.

Thus, as the number of connected resources increases on a given network, the less scalable the above-mentioned solutions become. Furthermore, existing techniques are cumbersome, tedious, and time-consuming, often requiring several engineers (or teams of engineers) to manage the network security for an organization. In addition, existing techniques are prone to errors, leaving open unintended communication paths that result in security vulnerabilities and potential breaches on a cloud-computing network that may be exploited.

Embodiments described herein address these and other issues by providing a system for automatically generating a security rule for implementation on a network. In the system, the allowed connections between various resources coupled to the network may be determined by analyzing the existing security rules across the network (e.g., on the network as a whole, a subnetwork, and/or on individual resources). Based on the existing security rules, a topology map may be generated that identifies the permitted connections between the resources included in the network. A network traffic data collector may monitor actual network traffic over the permitted connections. Using the existing security rules and the monitored traffic, an enhanced security rule may be generated that that is configured to reduce data traffic over at least one of the permitted connections.

Generating an enhanced security rule in this manner has numerous advantages. For instance, because the enhanced rule may be configured to provide a restriction on one or more permitted connections, such as a communication path that is available for data transmissions but is not used (or rarely used) based on monitoring actual data traffic, the resource security may be improved. For example, such a generated rule may reduce the risk of an intruder (located internal to the network or located externally) maliciously obtaining access to any of the resources, compromising sensitive data, installing malicious software, or otherwise exploiting vulnerabilities on any of the network's resources. This is because intruders frequently use connections/communication paths that are less frequented by normal network operations. Thus, placing restrictions on lesser used connections/communication paths can impair intruder activity. Furthermore, by improving network security in such a manner, the network as whole may also be protected from other types of attacks, such as unintended or unnecessary data transmissions, phishing attacks, or any other type of network attack from internal and/or external sources. As a result, security and operation of the computers on the network, as well as the network itself, may be improved.

Example implementations are described as follows that are directed to a system for generating an enhanced security rule. For instance, <FIG> shows a block diagram of an example computing system <NUM>, according to an example embodiment. As shown in <FIG>, system <NUM> includes a security manager <NUM>, resources 114A-114N, and resources 118A-118N, which may be communicatively coupled by one or more networks or subnetworks (subnets). For instance, any of the resources shown in <FIG> may be communicatively coupled to one or more other resources via network <NUM> and/or subnets 110A-110N. Network resources <NUM> comprise the resource set of system <NUM>, including but not limited to resources 114A-114N, 118A-118N, and any other resources not shown in <FIG> coupled to any one or more of network <NUM> and/or subnets 110A-112N. Security manager <NUM> includes a rule generation system <NUM>. As described in greater detail below, rule generation system <NUM> may be configured to generate one or more enhanced security rules associated with network <NUM>, subnets 110A-110N, or network resources <NUM> coupled thereto. System <NUM> is further described as follows.

Network <NUM> and subnets 110A-110N may each include one or more of any of a local area network (LAN), a wide area network (WAN), a personal area network (PAN), a combination of communication networks, such as the Internet, and/or a virtual network. Security manager <NUM> may be communicatively coupled to any one of network resources <NUM> via network <NUM> and/or subnets 110A-110N. In an implementation, security manager <NUM>, network <NUM>, subnets 110A-110N, and any one of network resources <NUM> may communicate via one or more application programming interfaces (API), and/or according to other interfaces and/or techniques.

Security manager <NUM>, network <NUM>, subnets 110A-110N, and network resources <NUM> may each include at least one network interface that enables communications with each other. Examples of such a network interface, wired or wireless, include an IEEE <NUM> wireless LAN (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth™ interface, a near field communication (NFC) interface, etc. Further examples of network interfaces are described elsewhere herein.

Network resources <NUM> may comprise any node, device or machine (physical or virtual) coupled to any of network <NUM> or subnets 110A-110N. In one example embodiment, network <NUM> and/or subnets 110A-110N may collectively comprise a network of an organization (including but not limited to a company, business, or cloud-based subscription), and network resources <NUM> may include any node, device, or machine coupled to the network. In some further example embodiments, network <NUM> and/or subnets 110A-110N may comprise a virtual or cloud-based network, and network resources <NUM> may comprise one or more virtual machines or nodes of the virtual or cloud-based network. In some other examples, any of network resources <NUM> may comprise a desktop computer, a portable computer, a smartphone, a tablet, a wearable computing device (e.g., a smart watch, a smart headset), a mixed and/or virtual reality device (e.g., Microsoft HoloLens™), or any other processing device. Network resources <NUM> are not limited to processing devices in implementations, and may include other resources on a network, such as storage devices (e.g., physical storage devices, local storage devices, cloud-based storages, hard disk drives, solid state drives, random access memory (RAM) devices, etc.), databases, etc..

It is noted and understood that implementations are not limited to the illustrative arrangement shown in <FIG>. Rather, an organization may comprise any number of networks, virtual networks, subnets, machines or virtual machines (or other resources) coupled in any manner. For instance, a subnet can comprise one or more additional subnets (not shown), resources can be coupled to a plurality of subnets or coupled to network <NUM> without a subnet, etc. Furthermore, network resources <NUM> and security manager <NUM> may be co-located, may be implemented on a single computing device or virtual machine, or may be implemented on or distributed across one or more additional computing devices or virtual machines not expressly illustrated in <FIG>.

In some other example embodiments, security manager <NUM> may be implemented on one or more servers. For instance, such servers may be part of a particular organization or company associated with network <NUM> and/or subnets 110A-110N, or may be a cloud-based server configured to provide services for a plurality of organizations. Furthermore, although <FIG> depicts a single security manager <NUM>, it is understood that implementations may comprise any number of security managers.

Note that the variable "N" is appended to various reference numerals for illustrated components to indicate that the number of such components is variable, with any value of <NUM> and greater. Note that for each distinct component/reference numeral, the variable "N" has a corresponding value, which may be different for the value of "N" for other components/reference numerals. The value of "N" for any particular component/reference numeral may be less than <NUM>, in the <NUM>, in the hundreds, in the thousands, or even greater, depending on the particular implementation.

Each of network <NUM>, subnets 110A-110N, resources 114A-114N, and resources 118A-118N may comprise a rule set. For example, network <NUM> may comprise a rule set <NUM>, subnets 110A-110N may respectively comprise rule sets 112A-112N, resources 114A-114N may respectively comprise rule sets 116A-116N, and resources 118A-118N may respectively comprise rule sets 120A-120N. Each rule set may include one or more security rules, including access rules, that are each associated with the network, one or more subnets, and/or one or more resources. Collectively, security rules provided in rule sets <NUM>, 112A-112N, 116A-116N, and 118A-118N may control communications between resources across network <NUM> by allowing, denying, or throttling network traffic between resources. In some examples, network <NUM> and/or one or more subnets 110A-110N may comprise one or more hardware devices (e.g., a router, a switch, etc.) may store rule sets associated with the network or subnet (or resources coupled thereto). In some other examples, network <NUM> and/or one or more subnets 110A-110N may store associated rule sets in one or more locations remote from the network or subnet, such as a cloud-based storage or server (e.g., in a central location or the like). It is noted and understood that such implementations are not intended to be limiting, and rule sets may be stored in any other manner appreciated by those skilled in the relevant art.

In embodiments, a security rule may be configured according to any suitable format. In one example, a security rule may include one or more of the following attributes/settings:.

In other embodiments, a security rule may include additional and/or alternative types of attributes/settings.

As described below in greater detail, rule generation system <NUM> may be configured to generate one or more enhanced security rules for network <NUM> (which may include one or more subnets as shown in <FIG>). Rule generation system <NUM> may be configured to determine existing security rules across network <NUM> (e.g., from rule sets shown in <FIG>), generate a map of permitted connections based on the existing rules and monitor actual data traffic over such permitted connections. Based on the existing rules and the monitored traffic, rule generation system <NUM> may generate an enhanced security rule for one or more of the permitted connections.

In some example embodiments, rule generation system <NUM> may automatically suggest such enhanced security rules to harden a network in a micro-segmentation manner where network resources may be divided into logical groups and restrictive access rules may be implemented in an ordered or prioritized way to restrict potentially malicious activities on a network. For instance, enhanced security rules in a micro-segmented network may include restrictions on network traffic based on a configuration of the applicable security rule settings (e.g., as shown above), including settings of a source or destination Internet Protocol (IP) address associated with the traffic, ports through which transmissions may be allowed or denied, and/or protocols through which transmissions may be allowed or denied. In some other examples, such as where a nano-segmented network is implemented, the enhanced security rules may also include further network restrictions based on the process that initiates the network traffic (e.g., the software or application that initiates a data transfer).

In implementations, rule generation system <NUM> may be configured to automate network micro-segmentation and nano-segmentation by generating appropriate security rules based on current network topology and monitored network traffic that augment existing security rules. Such rules may be deployed or implemented in at various locations or levels across network <NUM>, including but not limited to the network level, subnet level, resource level, or any other grouping of network resources. For instance, as illustrated in <FIG>, enhanced security rules may be optimally applied to any of rule sets <NUM>, 112A-112N, 116A-116N, and/or 118A-118N. By augmenting existing rules in this manner, greater security protections may be placed across network <NUM> to restrict communication paths that are open but unused, thereby reducing the likelihood that an attacker (e.g., an employee or former employee of an organization, a visitor, or anyone else that may have gained access to a network) accesses sensitive information or otherwise breaches network resources.

Rule generation system <NUM> may operate in various ways to generate an enhanced security rule for a network. For instance, rule generation system <NUM> may operate according to <FIG> shows a flowchart <NUM> of a method for generating an enhanced network security rule, according to an example embodiment. For illustrative purposes, flowchart <NUM> and rule generation system <NUM> are described as follows with respect to <FIG> shows a block diagram of a system <NUM> for generating a security rule, according to an example embodiment. As shown in <FIG>, system <NUM> includes rule generation system <NUM> and one or more network monitor agents <NUM>. Furthermore, rule generation system <NUM> includes an allowed connections determiner <NUM>, a network traffic data collector <NUM>, a rule generator <NUM>, a rule tester <NUM>, and an implementation graphical user interface (GUI) <NUM>. As shown in <FIG>, allowed connections determiner includes a security rule determiner <NUM> and a topology map generator <NUM> that may obtain one or more rule sets <NUM> and generate a permitted connections map <NUM>. Network traffic data collector <NUM> may communicate with network monitor agents <NUM> to monitor traffic across network <NUM>. As shown in <FIG>, rule generator <NUM> may generate an enhanced security rule <NUM> that may be implemented on network <NUM>, subnets 110A-110N, or any of the resources coupled thereto. Flowchart <NUM> and system <NUM> are described in further detail as follows.

Flowchart <NUM> of <FIG> begins with step <NUM>. Security rules are determined across a network that includes a plurality of resources. For instance, with reference to <FIG> and <FIG>, security rule determiner <NUM> may be configured to determine security rules across network <NUM>, which may comprise one more subnets 110A-110N and a plurality of network resources <NUM>. Security rule determiner <NUM> may determine security rules by obtaining <NUM> rule sets <NUM>. In implementations, rule sets <NUM> may comprise each set of security rules across network <NUM>. For instance, with reference to the illustrative arrangement of <FIG>, rule sets <NUM> may include each of rule set <NUM>, rule set 112A-112N, rule sets 116A-116N, and rule sets 120A-120N. Rule sets <NUM> may include, but are not limited to, security rules in rule sets that are inputted manually (e.g., through textual or graphical user interface) or automatically through any other manner that allows or denies data transmissions over particular communication paths.

In some examples, a rule set may be implemented on a firewall or a security group that indicates which data traffic should be allowed and/or denied. For example, a rule set in a firewall or security group may identify one or more source or destination IP addresses associated with network <NUM> that may or may not transmit and/or receive data transmissions, particular ports through which transmissions may be allowed or denied, or particular protocols through which transmissions may be allowed or denied. As shown in <FIG>, such rules may be implemented in rule sets at various locations in an organization, including at a network level (e.g., network <NUM>), at a subnet level (e.g., any one of subnets 110A-110N), and/or at particular resource (e.g., network resources <NUM>).

For example, each endpoint or node in network <NUM> may comprise a security rule set, as shown in <FIG>. Where the endpoint or node (e.g., one of network resources <NUM>) is a virtual machine and network <NUM> comprises a virtual network, a network interface of the virtual machine may comprise a rule set that identifies security rules for the network interface. It is noted and understood, however, that a virtual machine may comprise a plurality of network interfaces in some examples, and each network interface may comprise its own rule set. For instance, a single virtual machine may comprise a plurality of network interfaces corresponding to different subnets of network <NUM>, and each network interface may comprise security rules (e.g. in a firewall or one or more security groups) that control communications between the virtual machine over the particular subnet.

In one illustrative example, rule set 112A may indicate that data transmissions originating from a particular IP address are allowed for resources 116A-116N, while blocking all other data transmissions for resources 116A-116N. In another illustrative example, a network interface of resource 118A may comprise a security rule (e.g., in a firewall or the like) indicating that communications with other network resources over certain ports or protocols are permitted, while denying communications over different protocols or ports. In some further examples, rule sets may be implemented at a plurality of different levels (e.g., at a subnet level and/or at one or more network resources). As a result, for a particular endpoint or node (e.g., one of network resources <NUM>), such as a virtual machine, data transmissions to or from the resource may be controlled by the combination of the security rules of the resource, and any subnets or networks which the resource is a part.

Accordingly, data transmissions on network <NUM> may be allowed or denied based on the combination of one or more security rules in various rule sets on network <NUM>. In implementations therefore, security rule determiner <NUM> may determine security rules across network <NUM> by obtaining the set (or sets) of security rules existing with respect to the entire network, including any subnets and/or network resources.

In step <NUM>, a map of permitted connections between the resources is generated. For instance, with reference to <FIG>, topology map generator <NUM> may generate <NUM> a permitted connections map <NUM> that identifies the permitted connections between network resources <NUM> over network <NUM>. Topology map generator <NUM> may generate permitted connections map <NUM> in a variety of ways. In one non-limiting example, topology map generator <NUM> may be configured to generate a network topology that comprises a hierarchical tree representing the network. For instance, the topology may comprise a network (or a plurality of networks) that includes a hierarchy of a plurality of subnets, where each subnet comprises a plurality of resources (e.g., network interfaces or virtual machines) associated with the particular subnet. Based on the network topology and the existing security rules, topology map generator <NUM> may identify each allowed communication path between all of the resources in network <NUM> (e.g., each communication path in which one resource can directly or indirectly communicate with another resource).

In some implementations, topology map generator <NUM> may comprise an algorithm or other process for identifying each such communication path between pairs of resources to generate permitted connections map <NUM>. For instance, topology map generator <NUM> may extract each security rule across network <NUM> (including each security rule on any subnets and resources included within a hierarchy of network <NUM>) and intersect each obtained rule to generate permitted connections map <NUM>. In other words, by combining security rules across network <NUM> at various hierarchy levels, topology map generator <NUM> may be configured to generate an aggregated map that identifies all of the allowed communication paths.

Permitted connections map <NUM> may comprise a topology map or the like that textually and/or graphically illustrates the topology of network <NUM> and each allowed communication between resources. For instance, allowed communication paths may be depicted on a topology map in a superimposed manner, via one or more annotations, or in any other suitable manner. Permitted connections map <NUM> is not limited to a topology map, but may comprise any other graphical or non-graphical representation of permitted connections between resources in network <NUM> based on existing security rules. For instance, permitted connections map <NUM> may comprise a textual representation, a chart, a graph, a table, or any combination thereof for identifying permitted connections between resources. Permitted connections map <NUM> may comprise a single map for network <NUM> or may comprise multiple maps in some implementations, such as separate maps for each subnet or resource, or any other logical arrangement as will be appreciated by those skilled in the relevant arts.

Accordingly, topology map generator <NUM> may be configured to traverse all paths between pairs of resources based on existing security rules in a network configuration to generate a map of permitted connections. In implementations, the map of permitted connections may comprise one or more details associated with each permitted connection, such as an IP address of a source/transmitting resource, an IP address of a destination/receiving resource, source and/or destination ports through which the connection is permitted, and a protocol through which the connection is permitted. In a further implementation, permitted connections map <NUM> may include an identification of a process, such as an identifier of the software or executable file that is permitted to transmit data between pairs of resources. Any number of attributes and/or types of attributes describing each connection may be include included in the topology map of permitted connections map <NUM>.

As a result, in example embodiments, each allowed connection or communication path may be identified by a tuple of values and/or identifiers (e.g., a source IP, destination IP, source port, destination port, protocol, and/or process). In one non-limiting illustration, an algorithm implemented to identify allowed connections in a micro-segmented network environment may comprise an algorithm as follows:
<IMG>.

Note that permitted connections map <NUM> may be stored and be transportable in any form, including a file, a table, an array, a database, or other data structure.

In step <NUM>, network traffic data that corresponds to data traffic between the resources over the permitted connections is gathered. For instance, with reference to <FIG>, network traffic data collector <NUM> may be configured to obtain <NUM> permitted connections map <NUM> and gather network traffic data on network <NUM> between pairs of resources <NUM> over each of the permitted connections. Network traffic data that is gathered may include collecting actual network traffic data across each permitted connection over monitoring period or other time period. In example embodiments, network traffic data may be gathered and stored in a granular fashion based on the actual traffic itself. For instance, network traffic data may be gathered and stored for each source IP, destination IP, source port, destination port, protocol, an initiating process, a time, etc. for each monitored transmission. Network traffic data may be stored in any suitable manner, including but not limited to a map (e.g., a topology map or as an overlay to permitted connections map <NUM>), chart, graph, or any other representation identifying monitored network traffic across a plurality of permitted network connections.

In some implementations, network traffic data controller <NUM> may be configured to deploy <NUM> one or more network monitor agents <NUM> at various locations across network <NUM> to record network data traffic over each of the permitted connections (e.g., in traffic log files). Network monitor agents <NUM> may comprise software or instructions configured to execute on network <NUM> or subnets 110A-110N (e.g., on a router, switch, firewall, etc.), on any one or more of network resources <NUM>, or any one or more nodes on network <NUM>. In another example, network monitor agents <NUM> may comprise a host service that may execute on one or more resources (e.g., network resources <NUM>) to record incoming and outgoing network traffic. Network monitor agents <NUM> may monitor network traffic over one or more allowed communication paths over a time period and report such monitored network traffic to network traffic data collector <NUM> in an aggregated form, or may report monitored traffic in an aggregated form for aggregation by network traffic data collector <NUM>. In yet another implementation, network traffic data controller <NUM> may be configured to obtain and/or record network traffic directly from one or more devices on network <NUM> (e.g., routers, firewalls, switches, etc.). Implementations are not limited to these illustrative examples, and any other suitable technique for monitoring actual network traffic between resources may be utilized.

Network traffic data controller <NUM> may monitor network data traffic in terms volume (e.g., the actual amount of incoming/outgoing data, such as in bytes, kilobytes, megabytes, etc.) and/or frequency (how often data is transmitted over each communication path). As described above, network traffic data controller <NUM> may monitor network data traffic over a time period. For instance, the time period may comprise any period of time that is representative of ordinary network usage, such as one day, one week, one month, etc., or any other predetermined time period.

In step <NUM>, an enhanced security rule is generated for a permitted connection indicated in the map based on the security rules and the network traffic data. For instance, with reference to <FIG>, rule generator <NUM> may be configured to generate <NUM> enhanced security rule <NUM> based on existing security rules across network <NUM> and network traffic data gathered by network traffic data collector <NUM>. In implementations, enhanced security rule <NUM> may comprise a rule that is configured to reduce data traffic over at least one of the permitted connections. For instance, enhanced security rule <NUM> may comprise a security rule that may increase network security by restricting or preventing communications over communication paths that are permitted but not utilized based on monitored network traffic. By generating enhanced security rule <NUM> that restricts open, but unused communication paths, rule generator <NUM> may thereby further harden network <NUM> while also taking into account existing security rules.

Enhanced security rule <NUM> may comprise any number of security rules that may be recommended and/or enforced at any suitable location across network <NUM>, including but not limited to firewalls, routers, switches, security groups, etc. In some examples, enhanced security rule <NUM> may be implemented in any one or more of rule set <NUM>, rule set 112A-112N, rule sets 116A-116N, rule sets 120A-120N, or any other location or combination thereof.

Rule generator <NUM> may generate enhanced security rule <NUM> in a variety of ways. In one example, rule generator <NUM> may obtain <NUM> permitted connections map <NUM> and obtain <NUM> monitored network traffic data. Rule generator <NUM> may compare the differences between permitted connections map <NUM> and monitored network traffic data to identify the permitted connections across network <NUM> that are not utilized during an actual traffic monitoring period. In a further example, such as where monitored network traffic data and permitted connections map <NUM> each comprise a map or the like, rule generator <NUM> may be configured to identify the unused but open connections by subtracting the map, graph, chart, etc. representing the monitored network traffic data from the map, graph, chart, etc. representing permitted connections map <NUM>. In some implementations, rule generator <NUM> may also generate a map, graph, chart, etc., or any other representation, identifying the open but unused communication paths across network <NUM>. It is noted and understood, however, that any other technique known and appreciated to those skilled in the relevant art may be implemented to determine the identities of each communication path across network <NUM> that is open based on existing security rules but not utilized.

In this manner, rule generator <NUM> may automatically determine network vulnerabilities that may exist across network <NUM> due to communication paths that existing security rules have been left open, but that are not actually used. By identifying such communication paths, rule generator <NUM> may generate enhanced security rule <NUM> that restricts traffic over such communication paths. For example, where a communication path is open based on existing security rules but not utilized for a period of time (e.g., during a monitoring period), enhanced security rule <NUM> may generate a security rule that is configured to deny or block traffic along the identified communication path. As discussed above, enhanced security rule <NUM> may be applied at any suitable location (or a plurality of locations) across network <NUM>, including but not limited to firewalls, switches, routers, security groups, etc. on network <NUM>, subnets 110A-110N, or network resources <NUM> to deny or block traffic along the communication path.

While enhanced security rule <NUM> may be configured to block an entire communication path between resources, implementations described herein are not limited to blocking entire communication paths but may also cover any other manner of reducing data traffic over a connection. Enhanced security rule <NUM> may also be configured to reduce data traffic over a communication path with additional granularity based on monitored network traffic data. For instance, enhanced security rule <NUM> may comprise a rule that reduces data traffic for a communication path by blocking or denying communications based on an IP address, a port, or an initiating process relating to the communication, and applying a "deny" action to the rule.

As a non-limiting example, where network traffic data collector <NUM> determines that a particular one or more of source and/or destination IP addresses communicated over a given path, enhanced security rule <NUM> may be configured to allow the one or more source and/or destination IP addresses to communicate over the path, but deny all other IP addresses from communicating over the path. In another example, where network traffic data collector <NUM> determines that a subset of ports or protocols associated with a communication path are utilized during a monitoring period, but other permitted ports or protocols are not being used, enhanced security rule <NUM> may allow the subset of ports or protocols to communicate (e.g., with "allow" actions applied to their security rule(s)), but block all other ports or protocols from communicating over the path (e.g., with "deny" actions applied to their security rule(s)). In yet another example, enhanced security rule <NUM> may comprise a security rule that enables communication over a given path initiated by a certain process based on monitored network traffic data, but block communications over the path by other initiating processes. It is also noted and understood that a combination of the above techniques may also be implemented (e.g., allowing and/or blocking a combination of IP addresses, ports, protocols, and/or processes) over a given communication path. For instance, network traffic data collector <NUM> does not observe any traffic between two resources over a permitted connection, enhanced security rule <NUM> may comprise a rule (or plurality of rules) that entirely blocks the two resources from communicating. In these ways, network security may be improved based on actual network traffic, while also taking into account existing security rules of network <NUM>.

In yet some other examples, enhanced security rule <NUM> may comprise a temporal security rule based on a time of day of monitored network traffic. For instance, enhanced security rule <NUM> may be implemented in a manner that opens a communication path during a particular time period (such as a particular hour, day, week, month, etc.) with a "time" or similar setting coupled with an "allow" action, while restricting the communication path during other time periods. In an illustration, if network traffic data collector <NUM> determines that a permitted connection is utilized only during a certain time period, rule generator <NUM> may generate enhanced security rule <NUM> to be implemented as a temporary rule by deploying the rule to one or more appropriate rule sets during the time period and removing or disabling the rule outside of the time period.

In some example embodiments, enhanced security rule <NUM> may be recommended <NUM> to a user (e.g., a security analyst, network administrator, etc.) through an interface, such as implementation GUI <NUM>. Implementation GUI <NUM> may comprise a suitable graphical user interface through which a user may view enhanced security rule <NUM> and implement the security rule on network <NUM>. For instance, implementation GUI <NUM> may be configured to display enhanced security rule <NUM> as a recommended security rule to enhance the security of network <NUM> along with reasoning associated with the security rule, such as an indication that the communication path to be restricted by the security was not used (or the use was below a threshold) during the monitoring period, the amount of use that was monitored during the period, one or more graphs, maps, charts, etc. generated by topology map generator <NUM>, network traffic data collector <NUM>, or rule generator <NUM>, etc. Implementation GUI <NUM> may also provide one or more interactive user controls, such as a selectable icon, button, menu, etc. that upon interaction, enables activation of enhanced security rule <NUM> on network <NUM>. In some other example embodiments, rule generator <NUM> may implement enhanced security rule <NUM> automatically on network <NUM> by deploying the security rule to the appropriate firewall, router, switch, security group, etc..

Rule generator <NUM> may generate an enhanced security rule that reduces traffic over a permitted connection in a variety of ways. For example, <FIG> shows a flowchart <NUM> of a method for generating an enhanced security rule based on a determining that network traffic data does not exceed a threshold, according to an example embodiment. In an implementation, the method of flowchart <NUM> may be implemented by rule generator <NUM>. <FIG> is described with continued reference to <FIG> and <FIG>. Other structural and operational implementations will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM> and system <NUM> and <NUM> of <FIG> and <FIG>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, it is determined that the network traffic data indicates that data traffic over one of the permitted connections does not exceed a threshold of volume or frequency of data traffic. For instance, with reference to <FIG>, rule generator <NUM> may be configured to implement one or more data traffic threshold amounts in generating enhanced security rule <NUM>. In implementations, a threshold amount of data traffic may comprise a threshold amount of data traffic based on a volume of data traffic between two of network resources <NUM>, and/or based on a frequency of data traffic between two of network resources <NUM>.

For example, network traffic data collector <NUM> may monitor data traffic over each permitted connection across network <NUM> and log and/or store an amount of data traffic in terms of the volume of traffic and/or frequency of communications over each permitted connection during a predefined monitoring period. In one non-limiting illustration, rule generator <NUM> may comprise a threshold volume of data traffic in terms of bits, bytes, or any other unit of measurement defining data transmission volumes. In another non-limiting illustration, rule generator <NUM> may comprise a threshold frequency of data traffic as any number (e.g., quantity) of transmissions between pairs of resources over a particular time period (e.g., per hour, day, month, etc.). In example implementations, such thresholds may be predetermined and/or configurable via a suitable user interface, such as implementation GUI <NUM>. Based on the monitored data traffic, rule generator <NUM> may thereby determine whether the monitored data traffic over a particular connection between resources exceeds a threshold volume of data traffic or a threshold frequency of data traffic in a given time period.

In step <NUM>, the enhanced security rule is generated in response to the determination that the network traffic data indicates that the data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic. For instance, with continued reference to <FIG>, rule generator <NUM> may be configured to generate enhanced security rule <NUM> based on a determination that the monitored network traffic data does not exceed a threshold amount of volume or frequency of data traffic during a monitoring period. In other words, where the monitored amount of data traffic is below a threshold amount in terms of volume and/or frequency, rule generator <NUM> may infer that the amount of traffic is not sufficient to keep the permitted connection open or that the data transmission was accidental. In a further example, rule generator <NUM> may also be configured to implement a combination of thresholds (e.g., both a volume and a frequency threshold). Therefore, in such situations, rule generator <NUM> may generate enhanced security rule <NUM> that blocks and/or restricts a communication path for the connection as described herein.

In some other example embodiments, rule generator <NUM> may implement a strict threshold in generating enhanced security rule <NUM>. For instance, if any traffic (even if minimal) is monitored between resources over a permitted connection, rule generator <NUM> may determine that such communication was intentional and therefore keep the permitted connection open. In some further examples, rule generator <NUM> may be configured to generate enhanced security rule <NUM> as a recommendation to block and/or restrict the communication path along with an indication of the amount of data traffic monitored during the monitoring period. In such examples, the recommended security rule along with threshold information may be displayed via implementation GUI <NUM> for implementation on network <NUM>.

As described above, an enhanced security rule may be generated with varying levels of granularity in implementations. For example, <FIG> shows a flowchart <NUM> of a method for generating an enhanced security rule that identifies a process that initiated data traffic, according to an example embodiment. In an implementation, the method of flowchart <NUM> may be implemented by rule generator <NUM>. <FIG> is described with continued reference to <FIG> and <FIG>. Other structural and operational implementations will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM> and systems <NUM> and <NUM> of <FIG> and <FIG>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, a process that initiates data traffic over a particular connection is identified. For instance, with reference to <FIG>, network traffic data collector <NUM> may be configured to store a plurality of parameters associated with monitored network data traffic, including but not limited to the identity of a process that initiates data traffic between pairs of network resources <NUM>. An initiating process includes, but is not limited to, a program, software or process executing on a resource, or other executable process that initiates network data traffic. By monitoring such parameters associated with network data traffic, rule generator <NUM> may thereby determine an identity of a process that initiates data traffic over a particular one of the permitted connections.

In step <NUM>, an enhanced security rule is generated for the particular connection that allows the identified process to transmit data over the particular connection and denies data transmissions for other processes over the particular connection. For instance, rule generator <NUM> may generate enhanced security rule <NUM> that allows data traffic initiated by the identified process (e.g., based on actual data traffic monitored during the monitoring period) and denies data transmissions for other processes. In an illustrative example, if rule generator <NUM> identifies only a single process that initiates data traffic between pairs of network resources <NUM> over a particular one of the permitted connections in network <NUM>, rule generator <NUM> may generate enhanced security rule <NUM> that enables the identified process to initiate data traffic between the resources, while blocking all other processes (e.g., processes that did not initiate any data traffic over the monitoring period) from initiating data transmissions between the resources. In this manner, enhanced security rule <NUM> may implement a nano-segmentation technique to limit the processes that initiate transmissions across network <NUM>, thereby further enhancing the security of network <NUM>.

As described above, rule generator <NUM> may generate an enhanced security rule for implementation on a network, subnet, and/or an individual resource in implementations. For example, <FIG> shows a flowchart <NUM> of a method for combining a plurality of enhanced security rules, according to an example embodiment. In an implementation, the method of flowchart <NUM> may be implemented by rule generator <NUM>. <FIG> is described with continued reference to <FIG> and <FIG>. Other structural and operational implementations will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM> and systems <NUM> and <NUM> of <FIG> and <FIG>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, a plurality of enhanced security rules are generated where each security rules corresponds to a particular resource. For instance, with reference to <FIG>, rule generator <NUM> may generate a plurality of enhanced security rules <NUM>, where each enhanced security rule corresponds to a particular resource among network resources <NUM>. As illustrated in <FIG>, for example, the plurality of enhanced security rules <NUM> may be generated for each of resources 114A-114N (or a subset thereof), or any other grouping of resources among network resources <NUM>. As described herein, the enhanced security rules for the particular network resources may comprise any combination of security rules that allow and/or deny particular communication paths between resources in network <NUM>.

In step <NUM>, the enhanced security rules are combined to generate an optimized rule for a subnet of the network that includes the plurality of particular resources. For instance, with continued reference to <FIG>, rule generator <NUM> may be configured to combine the plurality of enhanced security rules <NUM> to generate an optimized security rule for application on network <NUM>. In implementations, the optimized security rule may be implemented in a particular rule set at the subnet level (e.g., in any one of rule sets 112A-112N) that includes the plurality of resources associated with enhanced security rules <NUM>. In this manner, rule generator <NUM> may be configured to optimize security rules by including the same restrictions as individual enhanced security rules in a fewer set of broader security rules, thereby reducing the number of security rules to be implemented on network <NUM>.

In an illustrative example, if enhanced security rules <NUM> for each of resources 114A-114N comprise rules to block certain communication paths (e.g., communications from the same IP, or communications involving the same port, protocol, or initiating process), rule generator <NUM> may combine such rules into a single rule to be implemented in rule set <NUM> that blocks/denies the same network activity for all of the resources included within subnet 110A (e.g., a "network security group") rather than implementing separate rules for each of resources 114A-114N. This example is illustrative only, and implementations may cover any other manner of combining rules for various network resources into a fewer number of security rules for application on a higher node or nodes that include the individual resources (e.g., optimized rules may be implemented in one or more of rule set <NUM> or rule sets 112A-112N). As a result, rule generator <NUM> may reduce an overall number of security rules by generating a common security rule that may be applied at the appropriate higher hierarchy level while still enhancing network security (e.g., hardening security for each of the resources included within the hierarchy). By reducing the number of rules, a user such as a security analyst may be enabled to more easily and quickly review, analyze, and approve of recommended security rules across <NUM>.

In some other example implementations, rule generator <NUM> may be configured to combine enhanced security rules <NUM> to generate an optimized rule in a manner that prioritize rule reduction over complete network hardening. For instance, where a network comprises a relatively large number of resources (e.g., in the hundreds or thousands, or even greater), rule generator <NUM> may generate many enhanced security rules based on the network topology and monitored network data traffic among the resources. In such instances, rule generator <NUM> may be configured to prioritize the generation of an optimized rule (or plurality of optimized rules) that reduces the overall number of enhanced security rules by generating rules that may be applied for groups of machines (e.g., at the subnet or network level), even if such rules do not result in complete hardening of network <NUM>.

For example, if subnet 110A comprises <NUM> resources, and <NUM> of such resources are determined to communicate with another subnet over a particular communication path (e.g., using a certain port, protocol, or process), but do not communicate with the other subnet using any other communication path, rule generator <NUM> may generate a single optimized security rule (or set of optimized rules) for implementation on subnet 110A that allows data traffic over the particular communication path for all resources 114A-114N included in subnet 110A, but denies all other communication paths for the resources. Thus, while the optimized rule may leave available certain communication paths that are not used based on monitored network traffic data, an optimized security rule may still enhance the overall security of network <NUM> while reducing the overall number of security rules.

In some example implementations, enhanced security rules may be tested on a network prior to restricting a communication path. For example, <FIG> shows a flowchart <NUM> of a method for testing an implementation of the enhanced security rule, according to an example embodiment. In an implementation, the method of flowchart <NUM> may be implemented by rule tester <NUM>. <FIG> is described with continued reference to <FIG> and <FIG>. Other structural and operational implementations will be apparent to persons skilled in the relevant art(s) based on the following discussion regarding flowchart <NUM> and systems <NUM> and <NUM> of <FIG> and <FIG>.

Flowchart <NUM> begins with step <NUM>. In step <NUM>, an implementation of an enhanced security rule is tested over a temporary duration. For instance, with reference to <FIG>, rule tester <NUM> may be configured to obtain <NUM> enhanced security rule <NUM> and test an implementation thereof over a temporary duration. In some examples, the temporary duration over which enhanced security rule <NUM> may be an audit or trial period that is predetermined or configurable via implementation GUI <NUM> during which rule tester <NUM> tracks a potential implementation of enhanced security rule <NUM> for communications on network <NUM>. Rule tester <NUM> may store and/or log each instance of network traffic that would be allowed and/or denied if enhanced security rule <NUM> was fully implemented, and provide such information to implementation GUI <NUM> for review by an analyst. Based on the tested implementation of enhanced security rule <NUM> over the trial or audit period, the security analyst may determine to fully implement the rule on network <NUM>, discard the rule, or continue testing the rule for an additional duration through an interaction with one or more user controls of implementation GUI <NUM>.

Accordingly, embodiments improve network security in an automatic fashion that is not possible in conventional implementations. Embodiments automatically analyze network configurations to determine allowed communications, determine the associated security rules, and collect assessments of network data traffic (e.g., data traffic in the form of data packets, communications according to network protocols, etc.), and use this information to generate security rules that deny communications over allowed connections that are underutilized, or not used at all. In this manner, intruders (e.g., malicious software such as computer viruses, worms, Trojan horses, ransomware, spyware, adware, and scareware, hackers that have infiltrated the network via misappropriated passwords, security vulnerabilities, and allowed personnel that engage in improper network activity) may be denied and/or restricted in their ability to navigate a network to cause harm. Embodiments described herein enable network security not previously practical due to the complexity of networks, including the numbers of network resources and vast numbers of connections between them. Embodiments enable savings in computer resources, such as processor utilization and memory usage, by the efficient detection of underutilized connections and configuration of appropriate security rules thereon.

Security manager <NUM>, rule generation system <NUM>, network <NUM>, subnets 110A-110N, resources 114A-114N, resources 118A-118N, and network monitor agents <NUM> (and/or any subcomponents of any of the same), flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, and/or flowchart <NUM> may be implemented in hardware, or hardware combined with software and/or firmware, such as being implemented as computer program code/instructions stored in a physical/hardware-based computer readable storage medium and configured to be executed in one or more processors, or being implemented as hardware logic/electrical circuitry (e.g., electrical circuits comprised of transistors, logic gates, operational amplifiers, one or more application specific integrated circuits (ASICs), one or more field programmable gate arrays (FPGAs)). For example, one or more of security manager <NUM>, rule generation system <NUM>, network <NUM>, subnets 110A-110N, resources 114A-114N, resources 118A-118N, and network monitor agents <NUM> (and/or any subcomponents thereof), flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, and/or flowchart <NUM> may be implemented separately or together in a SoC. The SoC may include an integrated circuit chip that includes one or more of a processor (e.g., a central processing unit (CPU), microcontroller, microprocessor, digital signal processor (DSP), etc.), memory, one or more communication interfaces, and/or further circuits, and may optionally execute received program code and/or include embedded firmware to perform functions.

<FIG> depicts an exemplary implementation of a computing device <NUM> in which example embodiments may be implemented. For example, any of security manager <NUM>, rule generation system <NUM>, network <NUM>, subnets 110A-110N, resources 114A-114N, resources 118A-118N, or network monitor agents <NUM> (or any subcomponents thereof) may be implemented in one or more computing devices similar to computing device <NUM> in stationary or mobile computer embodiments, including one or more features of computing device <NUM> and/or alternative features. The description of computing device <NUM> provided herein is provided for purposes of illustration, and is not intended to be limiting. Example embodiments may be implemented in further types of computer systems, as would be known to persons skilled in the relevant art(s).

A number of program modules may be stored on the hard disk, magnetic disk, optical disk, ROM, or RAM. These programs include operating system <NUM>, one or more application programs <NUM>, other programs <NUM>, and program data <NUM>. Application programs <NUM> or other programs <NUM> may include, for example, computer program logic (e.g., computer program code or instructions) for implementing security manager <NUM>, rule generation system <NUM>, network <NUM>, subnets 110A-110N, resources 114A-114N, resources 118A-118N, and network monitor agents <NUM> (and/or any subcomponents thereof), flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, flowchart <NUM>, and/or flowchart <NUM> (including any suitable step of flowcharts <NUM>, <NUM>, <NUM>, <NUM>, or <NUM>) and/or further example embodiments described herein.

Example embodiments are also directed to such communication media that are separate and non-overlapping with embodiments directed to computer-readable storage media.

Such computer programs, when executed or loaded by an application, enable computing device <NUM> to implement features of example embodiments described herein.

Example embodiments are also directed to computer program products comprising computer code or instructions stored on any computer-readable medium.

A system for generating a network security rule is disclosed herein. The system includes: one or more processors; and one or more memory devices that store program code configured to be executed by the one or more processors, the program code comprising: an allowed connections determiner that includes: a security rule determiner configured to determine security rules across a network that includes a plurality of resources, and a topology map generator configured to generate a map of permitted connections between resources over the network; a network traffic data collector configured to gather network traffic data that corresponds to data traffic between the resources over the permitted connections; and a rule generator configured to generate an enhanced security rule for a permitted connection indicated in the map based on the security rules and the network traffic data, the enhanced security rule configured to reduce data traffic over the permitted connection.

In one implementation of the foregoing system, the rule generator is further configured to: determine that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generate the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic.

In another implementation of the foregoing system, the rule generator is further configured to: identify a process that initiates data traffic over a particular connection; and generate an enhanced security rule for the particular connection that allows the identified process to transmit data over the particular connection and denies data transmissions for other processes over the particular connection.

In another implementation of the foregoing system, the rule generator is configured to: generate a plurality of enhanced security rules, each of which corresponds to a particular resource of a plurality of particular resources; and combine the enhanced security rules to generate an optimized rule for a subnet of the network that includes the plurality of particular resources.

In another implementation of the foregoing system, the network traffic data collector is configured to deploy a plurality of network monitor agents to monitor data traffic over the permitted connections.

In another implementation of the foregoing system, the system further includes a rule tester configured to test an implementation of the enhanced security rule over a temporary duration.

In another implementation of the foregoing system, the system further includes: a GUI configured to: display the enhanced security rule; and enable activation of the security rule via interaction with a GUI element.

A method in a computing device for generating a network security rule is disclosed herein. The method includes determining security rules across a network that includes a plurality of resources; generating a map of permitted connections between resources over the network; gathering network traffic data that corresponds to data traffic between the resources over the permitted connections; and generating an enhanced security rule for a permitted connection indicated in the map based on the security rules and the network traffic data, the enhanced security rule configured to reduce data traffic over the permitted connection.

In one implementation of the foregoing method, the generating the enhanced security rule comprises: determining that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generating the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic.

In another implementation of the foregoing method, the method further includes: identifying a process that initiates data traffic over a particular connection; and generating an enhanced security rule for the particular connection that allows the identified process to transmit data over the particular connection and denies data transmissions for other processes over the particular connection.

In another implementation of the foregoing method, the generating the enhanced security rule comprises: generating a plurality of enhanced security rules, each of which corresponds to a particular resource of a plurality of particular resources; and combining the enhanced security rules to generate an optimized rule for a subnet of the network that includes the plurality of particular resources.

In another implementation of the foregoing method, the gathering the network traffic data comprises: deploying a plurality of network monitor agents to monitor data traffic over the permitted connections.

In another implementation of the foregoing method, the method further includes: testing an implementation of the enhanced security rule over a temporary duration.

In another implementation of the foregoing method, the method further includes: providing the enhanced security rule for displaying in a GUI; and providing an GUI element that when activated, enables activation of the security rule.

A computer-readable memory is disclosed herein. The computer-readable memory has computer program code recorded thereon that when executed by at least one processor causes the at least one processor to perform a method comprising: determining security rules across a network that includes a plurality of resources; generating a map of permitted connections between resources over the network; gathering network traffic data that corresponds to data traffic between the resources over the permitted connections; and generating an enhanced security rule for a permitted connection indicated in the map based on the security rules and the network traffic data, the enhanced security rule configured to reduce data traffic over the permitted connection.

In one implementation of the foregoing computer-readable memory, the generating the enhanced security rule comprises: determining that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and generating the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic.

In another implementation of the foregoing computer-readable memory, the method further includes: identifying a process that initiates data traffic over a particular connection; and generating an enhanced security rule for the particular connection that allows the identified process to transmit data over the particular connection and denies data transmissions for other processes over the particular connection.

In another implementation of the foregoing computer-readable memory, the generating the enhanced security rule comprises: generating a plurality of enhanced security rules, each of which corresponds to a particular resource of a plurality of particular resources; and combining the enhanced security rules to generate an optimized rule for a subnet of the network that includes the plurality of particular resources.

In another implementation of the foregoing computer-readable memory, the gathering the network traffic data comprises: deploying a plurality of network monitor agents to monitor data traffic over the permitted connections.

In another implementation of the foregoing computer-readable memory, the method further includes: testing an implementation of the enhanced security rule over a temporary duration.

Claim 1:
A system (<NUM>, <NUM>, <NUM>) for generating a network security rule, the system comprising:
one or more processors (<NUM>); and
one or more memory devices (<NUM>) that store program code (<NUM>) configured to be executed by the one or more processors (<NUM>), the program code (<NUM>) comprising:
an allowed connections determiner (<NUM>) that includes:
a security rule determiner (<NUM>) configured to determine security rules across a network (<NUM>) that includes a plurality of resources (114A-114N, 118A-118N), and
a topology map generato-r (<NUM>) configured to generate a map (<NUM>) of permitted connections between resources over the network (<NUM>);
a network traffic data collector (<NUM>) configured to gather network traffic data that corresponds to data traffic between the resources (114A-114N, 118A-118N) over the permitted connections; and
a rule generator (<NUM>) configured to generate an enhanced security rule (<NUM>) for a permitted connection indicated in the map (<NUM>) based on the security rules and the network traffic data, the enhanced security rule (<NUM>) configured to reduce data traffic over the permitted connection;
characterized in that
the rule generator is further configured to:
determine that the network traffic data indicates data traffic over the permitted connection does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic; and
generate the enhanced security rule in response to the determination that the network traffic data indicates data traffic does not exceed, in a time period, at least one of a threshold volume of data traffic or a threshold frequency of data traffic.