Patent Document ID: 9215212
Application ID: 12489329

Base Claim:
1. A method of generating a representation of a plurality of learned rules from a learning engine of an application firewall based on a history of uniform resource locator (URL) communications with a web server, the method comprising: a) determining, by a learning engine of an application firewall, a plurality of learned rules based on a history of URL communications with a web server, each of the plurality of learned rules assigned a URL string; b) categorizing, by a visualizer, a subset of the plurality of learned rules under a first check type of a plurality of check types; c) generating, by the visualizer, a first tree representation of URL strings of the subset of learned rules, each node of the first tree corresponding to a segment of the URL strings identified based on application of a first selected delimiter to the URL strings to segment the URL strings into a first plurality of segments, each URL string comprising a path to a resource and comprising multiple segments identified based on application of the first selected delimiter; d) changing, via the visualizer responsive to a user operating the visualizer, the first delimiter to a second selected delimiter for the same URL strings of the subset of learned rules; and e) generating, by the visualizer, a second tree representation of the same URL strings responsive to the change to the second selected delimiter, each node of the second tree corresponding to a segment of the URL strings identified based on application of the second selected delimiter to the URL strings to segment the URL strings into a second plurality of segments, the change allowing a visual comparison of hierarchical distributions of the first plurality of segments and the second plurality of segments between the first tree and the second tree, and distributions of the subset of learned rules corresponding to the first plurality of segments and the second plurality of segments.

---

Claim 2:
2. The method of claim 1 , wherein step (a) further comprises generating a first learned rule of the plurality of learned rules based on a plurality of URL communications having a first URL string in common, and assigning the first URL to the first learned rule.