Abstract: In an example, a non-transitory machine-readable medium has instructions, which, when executed by a processor of a machine, cause the machine to perform operations including: (i) receiving a plurality of network messages transmitted within a communication network, (ii) analyzing the network messages to determine network traffic information, and (iii) determining, based on the network traffic information, a current system context from among a plurality of system contexts. Each system context indicates a respective aggregate status of devices in the communication network. The operations also include (iv) selecting, based on the current system context, a set of filtering rules from among a plurality of sets of filtering rules, (v) applying the selected set of filtering rules to the network messages to determine a subset of network messages that are acceptable for the current system context, and (vi) forwarding each network message of the subset to a destination of the network message.

Abstract: In an example, a non-transitory machine-readable medium has instructions, which, when executed by a processor of a machine, cause the machine to perform operations including: (i) receiving a plurality of network messages transmitted within a communication network, (ii) analyzing the network messages to determine network traffic information, and (iii) determining, based on the network traffic information, a current system context from among a plurality of system contexts. Each system context indicates a respective aggregate status of devices in the communication network. The operations also include (iv) selecting, based on the current system context, a set of filtering rules from among a plurality of sets of filtering rules, (v) applying the selected set of filtering rules to the network messages to determine a subset of network messages that are acceptable for the current system context, and (vi) forwarding each network message of the subset to a destination of the network message.

Abstract: A method includes obtaining, at a device, packet data descriptive of authorized traffic of a network. The method also includes generating, at the device, rule elements based on the packet data. The method further includes consolidating, at the device, the rule elements based on distance measures associated with the rule elements. The method also includes generating, at the device, firewall filter rules for the network based on the consolidated rule elements.

Abstract: A method includes obtaining, at a device, packet data descriptive of authorized traffic of a network. The method also includes generating, at the device, rule elements based on the packet data. The method further includes consolidating, at the device, the rule elements based on distance measures associated with the rule elements. The method also includes generating, at the device, firewall filter rules for the network based on the consolidated rule elements.