US 12,278,802 B2
Combined machine learning and formal techniques for network traffic analysis
Charanraj Thimmisetty, Dublin, CA (US); Praveen Tiwari, Milpitas, CA (US); Viswesh Ananthakrishnan, Palo Alto, CA (US); and Claudionor Jose Nunes Coelho, Jr., Redwood City, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Sep. 13, 2021, as Appl. No. 17/447,471.
Claims priority of provisional application 63/202,117, filed on May 27, 2021.
Prior Publication US 2022/0385635 A1, Dec. 1, 2022
Int. Cl. H04L 9/40 (2022.01); G06F 18/214 (2023.01); G06N 3/04 (2023.01)
CPC H04L 63/0263 (2013.01) [G06F 18/214 (2023.01); G06N 3/04 (2013.01); H04L 63/0236 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
parsing a plurality of security rules indicated in a current configuration of a firewall, wherein each security rule indicates first criteria for network traffic and a corresponding action to be taken by the firewall on network traffic satisfying the first criteria;
generating a plurality of formulas to represent the plurality of security rules, wherein each formula comprises a logical representation of the first criteria of the security rule represented by the formula and an indication of the corresponding action;
based on submission of a first query indicating second criteria for network traffic, determining if the firewall has detected network traffic satisfying the second criteria based on traffic logs generated by the firewall;
based on determining that the firewall has not detected network traffic satisfying the second criteria, evaluating the first query based on the plurality of formulas to determine if the firewall could detect network traffic satisfying the second criteria with the current configuration of the firewall, wherein evaluating the first query to determine if the firewall could detect network traffic satisfying the second criteria with the current configuration of the firewall comprises determining if the second criteria are satisfiable;
based on determining that the second criteria are satisfiable, determining an action that the firewall would take for network traffic that satisfy the second criteria based on a result of the evaluating; and
indicating the action that the firewall would take for network traffic that satisfies the second criteria if it were detected with the current configuration of the firewall.