Patent Document ID: 9838354
Application ID: 14752355
Patent Flag: 1

Claim One:
1. A firewall device, comprising: a memory to store instructions; and one or more processors of the firewall device to execute the instructions to: obtain information regarding a plurality of firewall rules, the information including information for a particular firewall rule of the plurality of firewall rules, the information for the particular firewall rule including one or more match condition values and a ranking value, the particular firewall rule being applicable to packets that are associated with packet information that matches the one or more match condition values associated with the particular firewall rule, a match condition value, of the one or more match condition values, being associated with a match count that identifies a quantity of times that packets, received by the firewall device, are associated with packet information that matches the match condition value, and the ranking value identifying a quantity of times that the particular firewall rule has been applied to the packets received by the firewall device; perform a linear regression analysis of match counts and ranking values associated with the plurality of firewall rules to train a model that describes a relationship between the match counts and the ranking values associated with the plurality of firewall rules; automatically determine a size of a training set of match condition values and ranking values for the model, based on receiving an indication for a desired accuracy of predictions made using the model, to reduce processing power used by the firewall device to check the plurality of firewall rules; determine that the particular firewall rule applies to a first packet received by the firewall device based on checking whether the one or more match condition values match packet information associated with the first packet; obtain a new firewall rule, associated with no ranking information, that includes a first match condition value, of the one or more match condition values, and a second match condition value, of the one or more match condition values, where the first match condition value is associated with a first firewall rule, of the plurality of firewall rules, and with a first match count, and where the second match condition value is associated with a second firewall rule, of the plurality of firewall rules, and with a second match count, the second firewall rule being different from the first firewall rule; predict a particular ranking value, as a predicted ranking value, of the new firewall rule based on the first match count and the second match count and based on analyzing the information regarding the plurality of firewall rules; and perform an action on a second packet, with regard to the new firewall rule, based on the predicted ranking value.