Patent Document ID: 20170041294
Application ID: 15332629
Patent Flag: 0

Claim One:
1. A device, comprising: one or more processors to: receive rule information associated with a firewall policy, the rule information including a set of N rules; add a rule, of the set of N rules, to a detector tree associated with the firewall policy, the rule being added to the detector tree based on a source address, associated with the rule, and a destination address associated with the rule; identify one or more other rules to which the rule is to be compared, the one or more other rules being included in the set of N rules, and the one or more other rules including a quantity of rules approximately equal to a result of a logarithm to base 2 of N; compare the rule and the one or more other rules; detect a rule anomaly based on comparing the rule to the one or more other rules, the rule anomaly being associated with a conflict between the rule and another rule of the one or more other rules; identify the rule anomaly within the detector tree based on detecting the rule anomaly; and output or store information regarding the rule anomaly.