Configuration management for network activity detectors

摘要

Network activity detectors, such as firewalls, communicate with one another to form a Unified Threat Management System. A first network activity detector sends a request for configuration settings to a second network activity detector. The second network activity detector sends a set of configuration settings in response to the request. The configuration settings include information for detecting digital security threats and/or for responding to detected digital security threats. In this way, configuration settings are propagated from one network activity detector to another so that network activity detectors within a UTMS system are configured consistently, e.g., have up-to-date information for detecting and/or responding to digital security threats.

主权项

1. A method of promoting computer network security in a network comprising a first network activity detector, a second network activity detector, and a third network activity detector, the method comprising:
sending, by the first network activity detector to the second network activity detector, a first User Datagram Protocol (UDP) network packet, wherein the first UDP network packet comprises a request for configuration information; receiving, by the first network activity detector from the second network activity detector, a second UDP network packet, wherein the second UDP network packet comprises a first configuration information, wherein the first configuration information includes a set of information for detecting digital security threats; sending, by the second network activity detector to the third network activity detector, a third UDP network packet, wherein the third UDP network packet comprises a request for configuration information; receiving, by the second network activity detector from the third network activity detector, a fourth UDP network packet, wherein the fourth UDP network packet comprises a second configuration information, wherein the second configuration information includes the set of information for detecting digital security threats; in response to receiving the first UDP network packet from the first network activity detector, sending, to the first network activity detector, the first configuration information, wherein the first configuration information includes the set of information for detecting digital security threats; creating, by the third network activity detector, the set of information for detecting digital security threats; and in response to receiving the third UDP network packet from the second network activity detector, sending, by the third network activity detector to the second network activity detector, the second configuration information, wherein the second configuration information includes the set of information for detecting digital security threats.