Automatic detection and mitigation of security weaknesses with a self-configuring firewall

Patent metadata

Field	Value
Publication number	US-9705909-B2
Application number	US-201514812335-A
Country	US
Kind code	B2
Filing date	Jul 29, 2015
Priority date	Jul 29, 2015
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Some embodiments provide a self-configuring firewall for automatic detection and mitigation of security weaknesses. The self-configuring firewall performs passive and active vulnerability detection. Passive detection involves scanning software resources and configurations under firewall protection for vulnerabilities present in the software and software configurations. Active detection identifies vulnerabilities by subjecting the software resources and configurations to simulated malicious traffic. The identified vulnerabilities are mapped to attack signatures. The self-configuring firewall enables the attack signatures which in turn allow the firewall to detect traffic containing attacks directed to exploiting the vulnerabilities.

First claim

I claim:

1. A method for self-configuring a particular firewall, the method comprising:
tracking different sets of vulnerabilities affecting different configurations of different software applications;
mapping a set of software applications under protection of the particular firewall, wherein said mapping comprises scanning with the particular firewall, an address range of a network under protection of the particular firewall and detecting at the particular firewall, the set of software applications running on a set of machines addressable in said network as a result of said scanning;
scanning a software configuration for each software application of the set of software applications based on one or more commands, scripts, and input passing from the particular firewall to the set of machines and a response each machine of the set of machines provides to said particular firewall as a result of said passing;
identifying a subset of security vulnerabilities from the different sets of vulnerabilities present in said set of software applications and software configurations based on comparing the software configuration of each software application of the set of software applications from said scanning against the different configurations of the different software applications from said tracking; and
automatically reconfiguring the particular firewall based on said identifying, wherein automatically reconfiguring comprises enabling on the particular firewall, a set of firewall signatures from a plurality of firewall signatures protecting against the subset of security vulnerabilities present in said set of software applications and software configurations, wherein the set of firewall signatures detect traffic comprising attacks directed to the subset of security vulnerabilities.

2. The method of claim 1 further comprising blocking traffic at the particular firewall comprising a pattern matching one signature from said set of firewall signatures.

3. The method of claim 1 further comprising disabling a particular enabled signature from the plurality of firewall signatures when the particular enabled signature protects against an attack directed to a vulnerability not within said subset of security vulnerabilities.

4. The method of claim 1 further comprising generating simulated malicious traffic resembling at least one attack directed to at least one vulnerability.

5. The method of claim 4 further comprising passing said simulated malicious traffic to said set of software applications and monitoring response of said set of software applications to said simulated malicious traffic.

6. The method of claim 5 further comprising enabling a firewall signature from the plurality of firewall signatures in response to a security vulnerability identified from monitoring the response to said simulated malicious traffic.

7. The method of claim 1 , wherein the software configuration for a particular software application identifies a software version of the particular software application.

8. The method of claim 1 further comprising detecting a change in state to one software application of said set of software applications.

9. The method of claim 8 further comprising disabling a particular firewall signature from said set of firewall signatures when the change in state closes a particular security vulnerability from the subset of security vulnerabilities that the particular firewall signature protects against.

10. The method of claim 9 further comprising enabling a new firewall signature not of the set of firewall signatures when the change in state opens a new security vulnerability not previously identified in the subset of security vulnerabilities, wherein the new firewall signature is used in detecting traffic comprising an attack directed to the new security vulnerability.

11. The method of claim 1 , wherein said identifying comprises matching the software configuration for a particular software application from the set of software applications to at least one security vulnerability and obtaining a firewall signature from the set of firewall signatures protecting against the at least one security vulnerability based on said matching.

12. A method for automatically configuring protections provided by a particular firewall, the method comprising:
detecting a new security vulnerability after entry of the new security vulnerability in a vulnerability database;
determining a particular version of a particular software application affected by said new security vulnerability;
mapping systems under protection of the particular firewall, wherein said mapping comprises (i) sending one or more commands, scripts, and input from the particular firewall to said systems, (ii) monitoring at the particular firewall, a response each system of said systems returns as a result of said sending, and (iii) identifying a set of software applications running on said systems and a version number of each software application of the set of software applications based on said monitoring;
configuring the particular firewall with a particular set of firewall protections from different sets of firewall protections in response to receiving at the particular firewall, a request directed to a particular system of said systems and the particular system having defined the particular set of firewall protections; and
updating the particular set of firewall protections with a new protection in response to said request implicating the particular version of the particular software application running on said particular system and said determining that the particular version of the particular software application is affected by said new security vulnerability.

13. The method of claim 12 , wherein said updating comprises enabling a firewall signature on the particular firewall allowing the particular firewall to detect and block traffic comprising an attack directed to the new security vulnerability.

14. The method of claim 12 further comprising detecting an update to the particular software application, said update changing the particular software application version number from a first version to a second version.

15. The method of claim 14 further comprising determining a particular security vulnerability present in the particular software application first version that is not present in the particular software application second version.

16. The method of claim 15 further comprising updating the particular firewall protections in direct response to said determining, wherein said updating comprises disabling a firewall signature used in detecting the particular security vulnerability.

17. The method of claim 12 , wherein said updating is performed without manual or user action.

18. A method for self-configuring a particular firewall, the method comprising:
producing a first snapshot recording a first set of software applications used in delivering content or services of a first customer at a first time and a second snapshot recording a different second set of software applications used in delivering content or services of a different second customer from a same set of servers;
determining a first set of security vulnerabilities present in the first set of software applications and a different second set of security vulnerabilities present in the second set of software applications;
generating a first customer firewall configuration with a first set of firewall signatures enabled from a plurality of firewall signatures and a second customer firewall configuration with a different second set of firewall signa

Assignees

• Verizon Digital Media Services Inc

Inventors

• Zaw Tin

Classifications

• H04L63/0263

  Rule management · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title