Patent ID: 8490171

Claim:
A method of configuring a security gateway by means of a processor operatively coupled to a memory, the method comprising: a) accommodating in the memory an initial rule-set; b) obtaining log records of communication events corresponding to the initial rule-set to obtain a sufficient amount of log records; c) generating, with the processor, a transformation-based rule-set by transforming the obtained log records into respective rules, wherein each obtained log record is transformed into a respective rule with source, destination and service fields corresponding to source, destination and service values in the transformed obtained log record, and wherein an action in the rule is defined as “Accept”; and d) generating an operable rule-set by processing, with the processor, the transformation-based rule-set, wherein generating the operable rule-set by processing of transformation-based rule-set comprises: a) identifying and removing duplicate rules among the transformation-based rules, thus giving rise to remaining rules, wherein each remaining rule is provided with an initial hit count characterizing a number of respective duplicated rules before removing; and b) consolidating the remaining rules by source, destination and service respectively, thus giving rise to consolidated rules, wherein each consolidated rule is provided with a consolidated hit count calculated by summarizing the initial hit counts of the rules consolidated in the respective consolidated rule.