Cyber twin of NGFW for security posture management

Patent metadata

Field	Value
Publication number	US-12470600-B2
Application number	US-202318216502-A
Country	US
Kind code	B2
Filing date	Jun 29, 2023
Priority date	Jun 29, 2023
Publication date	Nov 11, 2025
Grant date	Nov 11, 2025

Abstract

The present application discloses a method, system, and computer system for managing policy configurations. The method includes (i) receiving a set of predefined security policy rules, (ii) determining, based at least in part on the set of predefined security policy rules, one or more security policy rules that do not satisfy one or more predefined requirements, (iii) performing a priority or position analysis to determine a relationship among a plurality of security policy rules, and (iv) providing a report pertaining to the one or more security policy rules.

First claim

What is claimed is:

1 . A system for managing policy configurations, comprising:
one or more processors configured to:
receive a set of predefined security policy rules;
receive an indication of a particular intent with respect to a desired outcome with respect to a flow of network traffic across a network;
perform an intent satisfaction to determine one or more security policy rules of the set of predefined security policy rules that satisfy the particular intent, comprising:
generating one or more vector representations for the one or more security policy rules;
querying, based on the one or more vector representations, a prediction engine for a prediction of the one or more security policy rules that satisfy the particular intent; and
obtaining from the prediction engine the prediction of the one or more security policy rules that satisfy the particular intent, wherein the prediction engine implements a machine learning model;

determine an active measure for implementing the particular intent with respect to the set of predefined security policy rules; and
cause the active measure to be implemented; and
a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

2 . The system of claim 1 , wherein causing the active measure to be implemented includes generating and providing a report pertaining to the one or more security policy rules that indicates a recommendation for modifying at least one of the security policy rules to align the at least one of the security policy rules with the particular intent.

3 . The system of claim 2 , wherein the report pertaining to the one or more security policy rules includes an indication of the active measure.

4 . The system of claim 1 , wherein the one or more processors are further configured to:
receive a new security policy rule; generate a vector representation for the new security policy rule; and perform a priority or position analysis to determine a relationship between the new security policy rule and one or more of the set of predefined security policy rules.

5 . The system of claim 4 , wherein the new security policy rule is received and the priority or position analysis is performed before the new security policy rule is deployed to a security entity.

6 . The system of claim 5 , wherein the report includes an impact of deployment of the new security policy rules, and the report is provided before the new security policy rule is deployed to the security entity.

7 . The system of claim 6 , wherein the security entity is a firewall.

8 . The system of claim 4 , wherein the new security policy rule is received after deployment to a security entity.

9 . The system of claim 4 , wherein the priority or position analysis is performed with respect to deployed security policy rules at a predefined interval.

10 . The system of claim 4 , wherein performing the priority or position analysis includes monitoring a firewall and obtaining a report indicating an intent of at least one of the plurality of security policy rules.

11 . The system of claim 1 , wherein:
the one or more processors are further configured to:
receive a new security policy rule; and
determine an intent for the new security policy rule;
perform a priority or position analysis with respect to the intent for the new security rule, comprising:
determining intents for one or more security policy rules of the predefined security policy rules;
filtering the one or more security policy rules of the predefined security policy rules to remove a security policy rule that does not match the intent for the new security policy rule; and
performing an analysis between the new security policy rule and one or more resulting security policy rules output from the filtering of the one or more security policy rules.

12 . The system of claim 11 , wherein performing the priority or position analysis to determine a relationship among a plurality of security policy rules includes determining a permissiveness scoring with respect to the plurality of security policy rules.

13 . The system of claim 1 , wherein a satisfiability modulo theories (SMT) solver to determine a security policy rule satisfying the particular intent or contradicting the particular intent.

14 . The system of claim 1 , wherein the prediction engine uses the machine learning model to perform a clustering with respect to the plurality of security policy rules.

15 . The system of claim 4 , wherein the priority or position analysis is performed based at least in part on the vector representation for the new security policy rule and the one or more vector representations for the one or more security policy rules.

16 . The system of claim 4 , wherein determining the relationship between the new security policy rule and one or more of the set of predefined security policy rules comprises determining whether the new security policy rule is inconsistent with respect to one or more of the security policy rules.

17 . The system of claim 16 , wherein an active measure is determined for resolving an inconsistency between the new security policy and the set of predefined security policy rules.

18 . The system of claim 17 , wherein the active measure for resolving the inconsistency comprises deleting an inconsistent security policy rule.

19 . A method for managing policy configurations, comprising:
receiving, by one or more processors, a set of predefined security policy rules; receiving an indication of a particular intent with respect to a desired outcome with respect to a flow of network traffic across a network; performing an intent satisfaction to determine one or more security policy rules of the set of predefined security policy rules that satisfy the particular intent, comprising:
generating one or more vector representations for the one or more security policy rules;
querying, based on the one or more vector representations, a prediction engine for a prediction of the one or more security policy rules that satisfy the particular intent; and
obtaining from the prediction engine the prediction of the one or more security policy rules that satisfy the particular intent, wherein the prediction engine implements a machine learning model;
determining an active measure for implementing the particular intent with respect to the set of predefined security policy rules; and causing the active measure to be implemented.

20 . A computer program product embodied in a non-transitory computer readable medium for managing policy configurations, and the computer program product comprising computer instructions for:
receiving, by one or more processors, a set of predefined security policy rules; receiving an indication of a particular intent with respect to a desired outcome with respect to a flow of network traffic across a network; performing an intent satisfaction to determine one or more security policy rules of the set of predefined security policy rules that satisfy the particular intent, comprising:
generating one or more vector representations for the one or more security policy rules;
querying, based on the one or more vector representations, a prediction engine for a prediction of the one or more security policy rules that satisfy the particular intent; and
obtaining from the prediction engine the prediction of the one or more security policy rules that satisfy the particular intent, wherein the prediction engine implements a machine learni

Assignees

• Palo Alto Networks Inc

Inventors

• Tiwari Praveen
• Lin Hai
• De La Iglesia Didac
• Jayaraj Prem
• Sharma Gaurav
• Sampat Manish

Classifications

• H04L41/0894

  Policy-based network configuration management · CPC title

• H04L43/06

  Generation of reports · CPC title

• H04L63/0263

  Rule management · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title