Automated learning of externally defined network assets by a network security device

Patent metadata

Field	Value
Publication number	US-2019297055-A1
Application number	US-201815935667-A
Country	US
Kind code	A1
Filing date	Mar 26, 2018
Priority date	Mar 26, 2018
Publication date	Sep 26, 2019
Grant date	—

Abstract

Systems and methods for automated learning of externally defined network assets by a network security device are provided. According to one embodiment, updated information for a network asset associated with a private network is received by a network security device from an external asset management device associated with the private network. The updated information includes a change in a definition or an attribute of the network asset. The existence of a current definition and attribute information for the network asset is determined by the network security device. The current definition and attribute information is dynamically updated based on the updated information by the network security system within a run-time representation of security policy rules within a kernel of a network security operating system without disrupting on-going application of one or more security policy rules defined for the network asset to network traffic directed to or originated by the network asset.

First claim

What is claimed is:

1 . A method comprising:
receiving, by a network security device associated with a private network, updated information associated with a network asset associated with the private network from an external asset management device associated with the private network, wherein the updated information includes a change in a definition or an attribute of the network asset; determining, by the network security device, existence of a current definition and attribute information for the network asset; and without disrupting on-going application of a plurality of security policy rules, including one or more security policy rules defined for the network asset and relating to network traffic directed to or originated by the network asset, by the network security device, dynamically updating, by the network security device, the current definition and attribute information within a run-time representation of the one or more security policy rules within a kernel of a network security operating system of the network security device based on the updated information.

2 . The method of claim 1 , wherein said determining is based on a comparison of the current definition and attribute information with the updated information, wherein the network security device concludes that the updated information relates to the network asset when a majority of the current definition and most of the attributes information matches the updated information.

3 . The method of claim 1 , further comprising causing a definition or an attribute of the network asset maintained by one or more other network security devices associated with the private network to be updated based on the updated information.

4 . The method of claim 1 , wherein the updated information is retrieved directly from one or more external asset management devices, wherein a first application programming interface (API) is used for retrieving the updated information from a first external asset management device of the one or more external asset management devices and a second API is used for retrieving updated information from a second external asset management device of the one or more external asset management devices.

5 . The method of claim 1 , wherein the updated information is retrieved, by the network security device, from one or more external asset management devices, through an agent, wherein the agent uses a first API for retrieving the updated information from a first external asset management device of the one or more external asset management devices and the agent uses a second API for retrieving the updated information from a second external asset management device of the one or more external asset management devices.

6 . The method of claim 1 , wherein the updated information is retrieved, by the network security device, from one or more external asset management devices using a hybrid configuration in which updated information from a first external asset management device of the one or more external asset management devices is retrieved directly by the network security device, and updated information from a second external asset management device of the one or more external asset management devices is received indirectly through an agent.

7 . The method of claim 1 , wherein the network security device comprises any or a combination of an Intrusion Prevention System (IPS), an Intrusion Detection System (IDS), a gateway device, a network management device, a firewall, a Distributed Denial of Service (DDoS) prevention device, a Unified Threat Management (UTM) appliance and a software defined network security device.

8 . The method of claim 1 , wherein the change in the definition or the attribute represents a change to one or more of an asset name of the network asset, a subnet within which the network asset is connected, an off-site hostname to which the network asset belongs, a location of the network asset and a group with which the network asset is associated.

9 . The method of claim 1 , wherein the change in the definition or the attribute represents a change to one or more of an Internet Protocol (IP) address of the network asset, a Media Access Control (MAC) address of the network asset, a user ID and an exposure level.

10 . The method of claim 1 , wherein said dynamically updating, by the network security device, the current definition and attribute information within a run-time representation of the one or more security policy rules within a kernel of a network security operating system of the network security device is performed without impacting a system configuration of the network security device.

11 . A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network security device associated with a private network, causes the one or more processors to perform a method comprising:
receiving updated information associated with a network asset associated with the private network from an external asset management device associated with the private network, wherein the updated information includes a change in a definition or an attribute of the network asset; determining existence of a current definition and attribute information for the network asset; and without disrupting on-going application of a plurality of security policy rules, including one or more security policy rules defined for the network asset and relating to network traffic directed to or originated by the network asset, dynamically updating the current definition and attribute information within a run-time representation of the one or more security policy rules within a kernel of a network security operating system of the network security device based on the updated information.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein said determining is based on a comparison of the current definition and attribute information with the updated information, wherein the network security device concludes that the updated information relates to the network asset when a majority of the current definition and most of the attributes information matches the updated information.

13 . The non-transitory computer-readable storage medium of claim 11 , wherein the method further comprises causing a definition or an attribute of the network asset maintained by one or more other network security devices associated with the private network to be updated based on the updated information.

14 . The non-transitory computer-readable storage medium of claim 11 , wherein the updated information is retrieved directly from one or more external asset management devices, wherein a first application programming interface (API) is used for retrieving the updated information from a first external asset management device of the one or more external asset management devices and a second API is used for retrieving updated information from a second external asset management device of the one or more external asset management devices.

15 . The non-transitory computer-readable storage medium of claim 11 , wherein the updated information is retrieved from one or more external asset management devices, through an agent, wherein the agent uses a first API for retrieving the updated information from a first external asset management device of the one or more external asset management devices and the agent uses a second API for retrieving the updated information from a second external asset management device of the one or more external asset management devices.

16 . The non-transitory compu

Assignees

• Fortinet Inc

Inventors

• May Robert A
• Nantel Mathieu

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/71

  to assure secure computing or processing of information · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title