Patent ID: 8209738

Claim:
A computer-implemented method for analysis of distributed device rule-sets for compliance with global policies, the method executable by a computer having a processor and memory, comprising: receiving from an administrator a network topology with a plurality of reachable, intercommunicating elements and associated parameters required to secure the intercommunication with one or more access control elements of the network topology; establishing connections to the access control elements to capture a snapshot configuration of device rule-sets of the one or more access control elements; receiving from the administrator a set of global access constraints with reference to the plurality of access control elements; generating a multi-layered rule graph that captures network interconnectivity and data flow among the intercommunicating elements, where each of a plurality of nodes in the multi-layered rule graph represents a possible access decision by an access control element and paths of the multi-layered rule graph represent sequences of access decisions; conducting statistical analysis using model-based importance sampling of the multi-layered rule graph to determine violations by the device rule-sets that fail to comply with the set of global access constraints, the importance sampling quantitatively characterizing a level of compliance with the global access constraints without conducting analysis of all potential paths of the multi-layered rule graph; and providing results of the statistical analysis to the administrator through a graphical user interface (GUI) of the computer as the results are obtained so that the administrator can watch the progress of the analysis.