Rule-based network-threat detection

Patent metadata

Field	Value
Publication number	US-11012459-B2
Application number	US-202017001164-A
Country	US
Kind code	B2
Filing date	Aug 24, 2020
Priority date	Apr 17, 2015
Publication date	May 18, 2021
Grant date	May 18, 2021

Abstract

A packet-filtering device may receive packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to network-threat indicators. The packet-filtering device may receive packets and, for each packet, may determine that the packet corresponds to criteria specified by a packet-filtering rule. The criteria may correspond to one or more of the network-threat indicators. The packet-filtering device may apply an operator specified by the packet-filtering rule. The operator may be configured to cause the packet-filtering device to either prevent the packet from continuing toward its destination or allow the packet to continue toward its destination. The packet-filtering device may generate a log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and indicating whether the packet-filtering device prevented the packet from continuing toward its destination or allowed the packet to continue toward its destination.

First claim

What is claimed is:

1. A method comprising:
receiving a plurality of packet-filtering rules configured to cause a device to identify packets corresponding to at least one of a plurality of network-threat indicators, wherein the plurality of network-threat indicators are associated with network-threat-intelligence reports supplied by one or more network-threat-intelligence providers, and wherein each of the plurality of packet-filtering rules specifies at least one packet matching criterion and at least one operator;
receiving a plurality of packets;
utilizing a domain name system cache to determine whether a first packet of the plurality of packets corresponds to a first packet matching criterion specified by a first packet-filtering rule of the plurality of packet filtering rules based on one of a domain name, a Uniform Resource Identifier (URI), or a Uniform Resource Locator (URL) of the first packet; and
responsive to a determination that the first packet of the plurality of packets corresponds to the first packet matching criterion:
applying, to the first packet, a first operator specified by the first packet-filtering rule corresponding to the first packet matching criterion;
generating, for the first packet, a packet log entry comprising at least one threat identifier corresponding to the first packet;
determining at least one score associated with the at least one threat identifier; and
communicating the at least one score associated with the at least one threat identifier.

2. The method of claim 1 , wherein applying the first operator specified by the first packet-filtering rule allows the first packet to continue toward a destination of the first packet, the method further comprising:
updating the first packet-filtering rule corresponding to the first packet matching criterion to specify a second operator; and
responsive to a determination that a second packet of the plurality of packets corresponds to the first packet matching criterion specified by the updated first packet-filtering rule, applying, by the device and to the second packet, the second operator specified by the updated first packet-filtering rule corresponding to the first packet matching criterion,
wherein applying the second operator specified by the updated first packet-filtering rule prevents the second packet from continuing toward a destination of the second packet.

3. The method of claim 1 , wherein determining the at least one score further comprises determining the at least one score based on at least one of:
a type of threat associated with the at least one threat identifier,
geographic information,
an anonymous proxy associated with the at least one threat identifier, or
an actor associated with the at least one threat identifier.

4. The method of claim 1 , further comprising:
updating, based on the generated packet log entry, a packet flow log entry, wherein the packet flow log entry consolidates a plurality of packet log entries corresponding to a common threat identifier, and wherein the determining the at least one score associated with the at least one threat identifier comprises updating a first score associated with the packet flow log entry corresponding to the at least one threat identifier.

5. The method of claim 1 , wherein determining the at least one score associated with the at least one threat identifier further comprises:
determining a number of network-threat-intelligence providers, of one or more network-threat-intelligence providers, from which the at least one threat identifier corresponding to the first packet was received; and
determining a second score for the at least one threat identifier corresponding to the first packet based on the number of network-threat-intelligence providers.

6. The method of claim 1 , wherein the determining the at least one score associated with the at least one threat identifier further comprises:
determining the at least one score based on a number of the plurality of packets that correspond to the at least one threat identifier.

7. The method of claim 1 , further comprising:
updating the at least one score based on one or more times at which one or more packets of a plurality of logged packets that corresponds to one or more packet-filtering rules were filtered by the device; and
updating the at least one score based on a number of the plurality of logged packets that correspond to the one or more packet-filtering rules.

8. The method of claim 1 , wherein determining the at least one score further comprises determining the at least one score based on an identity of one or more network-threat-intelligence providers that provided network-threat indicators associated with a corresponding threat identifier, and a number of network-threat intelligence providers that provided network-threat indicators associated with a corresponding threat identifier.

9. The method of claim 1 , wherein determining the at least one score further comprises determining the at least one score based on a destination of a packet of a plurality of logged packets that corresponds to the plurality of packet-filtering rules.

10. The method of claim 1 , wherein communicating the at least one score associated with the at least one threat identifier comprises communicating a plurality of scores, wherein each score of the plurality of scores is associated with a different threat identifier.

11. A device comprising:
at least one processor; and
memory storing instructions that, when executed by the at least one processor, cause the device to:
receive a plurality of packet-filtering rules configured to cause the device to identify packets corresponding to at least one of a plurality of network-threat indicators, wherein the plurality of network-threat indicators are associated with network-threat-intelligence reports supplied by one or more network-threat-intelligence providers, and wherein each of the plurality of packet-filtering rules specifies at least one packet matching criterion and at least one operator;
receive a plurality of packets;
utilize a domain name system cache to determine whether a first packet of the plurality of packets corresponds to a first packet matching criterion specified by a first packet filtering rule of the plurality of packet filtering rules based on one of a domain name, a Uniform Resource Identifier (URI), or a Uniform Resource Locator (URL) of the first packet; and
responsive to a determination that the first packet of the plurality of packets corresponds to a first packet matching criterion:
apply, to the first packet, a first operator specified by the first packet-filtering rule corresponding to the first packet matching criterion;
generate, for the first packet, a packet log entry comprising at least one threat identifier corresponding to the first packet;
determine, at least one score associated with the at least one threat identifier; and
communicate the at least one score associated with the at least one threat identifier.

12. The device of claim 11 , wherein the instructions, when executed by the at least one processor, cause the device to apply the first operator such that the first operator specified by the first packet-filtering rule allows the first packet to continue toward a destination of the first packet, wherein instructions further cause the device to:
update the first packet-filtering rule corresponding to the first packet matching criterion to specify a second operator; and
responsive to a determination that a second packet of the plurality of packets corresponds to the first packet matching criterion specified by an updated first packet-filtering rule, apply, to the second packet, t

Assignees

• Centripetal Networks Inc

Inventors

• Ahn David K
• George Keith A
• Geremia Peter P
• Mallett Iii Pierre
• Moore Sean
• Perry Robert T
• Rogers Jonathan R

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L43/028

  by filtering · CPC title