Claims:We claim:
1. A method for managing policies in a network security system, the method comprising:
receiving, by a policy management system (101) associated with a network firewall (103), one or more data packets from a request source of a plurality of request sources (105);
monitoring, by the policy management system (101), at least one of, an inbound transmission time, an out bound transmission time and a jitter hit rate associated with the one or more data packets and a hit count, a current hit count, a last hit time and a hit per policy associated with each of plurality of policies of the network firewall (103) in real-time;
estimating, by the policy management system (101), a hit count percentage for each of the plurality of policies based on the monitoring; and
grouping, by the policy management system (101), the plurality of policies into a plurality of policy clusters, based on the hit count percentage associated with each of the plurality of policies, to manage the policies of the network firewall (103).
2. The method as claimed in claim 1, wherein the hit count percentage represents number of times each policy in the plurality of policies is referenced.
3. The method as claimed in claim 1, wherein the hit count percentage is estimated based on at least one of multilinear regression and linear regression technique.

4. The method as claimed in claim 1, wherein grouping the plurality of policies comprises:
ranking, by the policy management system (101), the plurality of policies based on corresponding hit count percentage; and
grouping, by the policy management system (101), the plurality of policies into the plurality of policy clusters based on the ranking.
5. The method as claimed in claim 4 further comprising ranking the plurality of policy clusters based on the ranking of the plurality of policies associated with each of the policy cluster.
6. The method as claimed in claim 5 further comprising:
scanning, by the policy management system (101), upcoming data packets, using the plurality of policies in an order of the ranking of the plurality of policy clusters and an order of the ranking of the plurality of policies within each of the plurality of policy clusters.

7. The method as claimed in claim 6 further comprising scanning the upcoming data packets with the plurality of policies associated with a policy cluster of the plurality of policy clusters ranked subsequent to a current scanning policy cluster of the plurality of policy clusters, when the upcoming data packets are passed by the current scanning policy cluster.
8. A policy management system (101) for managing policies in a network security system, comprising:
a processor (113); and
a memory (111) communicatively coupled to the processor (113), wherein the memory (111) stores processor instructions, which, on execution, causes the processor (113) to:
receive one or more data packets from a request source of a plurality of request sources (105);
monitor at least one of, an inbound transmission time, an out bound transmission time and a jitter hit rate associated with the one or more data packets and a hit count, a current hit count, a last hit time, a hit per policy associated with each of plurality of policies of a network firewall (103) in real-time;
estimate a hit count percentage for each of the plurality of policies based on the monitoring; and
group the plurality of policies into a plurality of policy clusters, based on the hit count percentage associated with each of the plurality of policies, to manage the policies of the network firewall (103).
9. The policy management system (101) as claimed in claim 8, wherein the hit count percentage represents number of times each policy in the plurality of policies is referenced.
10. The policy management system (101) as claimed in claim 8, wherein the hit count percentage is estimated based on at least one of multilinear regression and linear regression technique.

11. The policy management system (101) as claimed in claim 8, wherein the processor (113) groups the plurality of policies by:

ranking the plurality of policies based on corresponding hit count percentage; and
grouping the plurality of policies into the plurality of policy clusters based on the ranking.

12. The policy management system (101) as claimed in claim 11, wherein the processor (113) ranks the plurality of policy clusters based on the ranking of the plurality of policies associated with each of the policy cluster.
13. The policy management system (101) as claimed in claim 12, wherein the processor (113) performs:
scanning upcoming data packets using the plurality of policies in an order of the ranking of the plurality of policy clusters and an order of the ranking of the plurality of policies within each of the plurality of policy clusters.
14. The policy management system (101) as claimed in claim 13, wherein the processor (113) scans the upcoming data packets with the plurality of policies associated with a policy cluster of the plurality of policy clusters ranked subsequent to a current scanning policy cluster of the plurality of policy clusters, when the upcoming data packets are passed by the current scanning policy cluster.
Dated this 28th day of March, 2018

R Ramya Rao
Of K&S Partners
Agent for the Applicant
IN/PA-1607
, Description:TECHNICAL FIELD
The present subject matter is related in general to network security, more particularly, but not exclusively to method and system for managing policies in a network security system.