Patent Document ID: 10009380
Application ID: 14991646
Patent Flag: 1

Claim One:
1. A network security device comprising: a memory configured to: store a plurality of network events; and store a set of network filter rules; a processor configured to: provide an interface for modifying the set of network rules; receive a change to a set of network rules; perform a first simulation of network traffic allowed and denied according to the current set of network rules and a second simulation of network traffic allowed and denied according to the changed set of network rules using at least a portion of the network events; compare the results of the first and second simulation to identify changes in network traffic allowed and denied between the current set and the changed set of network rules; calculate an entropy of strings matching a wildcard of a new network rule of the chanced set of network rules; display the changes in allowed and denied traffic for review of the changed set of network rules and the entropy of the new network rule; receive an instruction to implement the changed set of network rules based on the review; and filter network traffic according to the changed set of network rules.