Patent Document ID: 9479479
Application ID: 14496666
Patent Status: 1

Claim One:
1. A device, comprising: one or more processors to: receive rule information associated with a firewall policy, the rule information including a set of rules; add a rule, of the set of rules, to a detector tree associated with the firewall policy, the rule being added to the detector tree as a first leaf node based on a source address, associated with the rule, and as a second leaf node based on a destination address associated with the rule; identify one or more other rules to which the rule is to be compared based on adding the rule as the first leaf node and as the second leaf node, the one or more other rules being included in the set of rules; compare the rule and the one or more other rules; detect a rule anomaly based on comparing the rule to the one or more other rules, the rule anomaly being associated with a conflict between the rule and another rule of the one or more other rules; add, to the first leaf node and based on detecting the rule anomaly, information identifying the rule anomaly and information identifying a first node associated with the other rule and included in the detector tree; and add, to the second leaf node and based on detecting the rule anomaly, the information identifying the rule anomaly and information identifying a second node associated with the other rule and included in the detector tree.