International Business Machines Corporation

Cezar P Grzelak

Rory F Bray

Jason David Keirstead

A computer-implemented method for using multi-dimensional geometry in simulations of packet flows through network devices, is provided. The computer-implemented method includes receiving an input object for traffic simulation of network devices, comprising a source and destination host ranges and source and destination port ranges, and protocol, application and vulnerability ranges, targeted for the destination host ranges. The computer-implemented method further includes representing blocked traffic of the simulated traffic by an intersection of at least two n-dimensional cuboids in n-dimensional space. The computer-implemented method further includes subtracting an access control list shape from an input shape to obtain a concave form representing permitted host, port, protocol, application, and vulnerability combinations of ranges. The computer-implemented method further includes decomposing the obtained concave shape into multiple convex shapes that satisfy a set of predetermined input conditions.

Multi-dimensional geometry for enhancement of simulations of network devices

An illustrative embodiment of a method for firewall rule use counting receives log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector, generates a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network, a source port and protocol list and a destination port and protocol list for each respective device, a unique object for each log data set received; a mapping database comprising an entry for each log data set received associated with the unique object; and feeds each entry in the mapping database through a topology model to also generate a reference to a unique firewall rule on a respective device in the plurality of devices. A count associated with the unique firewall rule is incremented using a count of logs stored associated with the respective unique object and a report is generated.

Growing community of inventors

Saint John, Canada

Cezar P Grzelak