Rule-based network-threat detection for encrypted communications

Patent metadata

Field	Value
Publication number	US-12010135-B2
Application number	US-202318370073-A
Country	US
Kind code	B2
Filing date	Sep 19, 2023
Priority date	Dec 23, 2015
Publication date	Jun 11, 2024
Grant date	Jun 11, 2024

Abstract

A packet-filtering system configured to filter packets in accordance with packet-filtering rules may receive data indicating network-threat indicators and may configure the packet-filtering rules to cause the packet-filtering system to identify packets comprising unencrypted data, and packets comprising encrypted data. A portion of the unencrypted data may correspond to one or more of the network-threat indicators, and the packet-filtering rules may be configured to cause the packet-filtering system to determine, based on the portion of the unencrypted data, that the packets comprising encrypted data correspond to the one or more network-threat indicators.

First claim

What is claimed is:

1. A method of filtering encrypted packets by a packet-filtering system comprising at least one processor and memory and configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, the method comprising:
receiving, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;
receiving, by the packet-filtering system, a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;
determining, by the packet-filtering system, that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;
generating, by the packet-filtering system and based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating:
an indication of one or more actions or an indication of the first packet-filtering rule; and
an Internet Protocol (IP) address corresponding to the domain name;

receiving, by the packet-filtering system and after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise:
encrypted data, and
respective packet headers comprising second unencrypted data;

determining, by the packet-filtering system and without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name;
based on determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, filtering the plurality of second packets based on the first packet-filtering rule;
determining, based on the logged indication of the one or more actions or the logged indication of the first packet-filtering rule, to apply a first action corresponding to the first packet-filtering rule; and
sending at least a portion of the filtered plurality of second packets to a proxy configured to perform the first action corresponding to the first packet-filtering rule.

2. The method of claim 1 , wherein the determining to apply the first action comprises selecting, from the one or more actions, the first action.

3. The method of claim 1 , wherein the log data comprises the logged indication of the first packet-filtering rule, and wherein the determining to apply the first action comprises determining, based on the logged indication of the first packet-filtering rule, the first action.

4. The method of claim 3 , wherein the first action comprises dropping, by the proxy, the at least the portion of the filtered plurality of second packets.

5. The method of claim 1 , wherein the plurality of first packets comprises the IP address.

6. The method of claim 1 , wherein the plurality of first packets comprises a Domain Name System (DNS) query comprising the domain name.

7. The method of claim 6 , wherein the DNS query comprises the IP address corresponding to the domain name.

8. The method of claim 1 , wherein the plurality of first packets comprise a certificate message for the encrypted communication session, and wherein the first action comprises:
at least one of dropping or logging one or more of the plurality of second packets based on a determination that the certificate message comprises data indicating at least one of:
a serial number indicated by the first packet-filtering rule,
an issuer indicated by the first packet-filtering rule,
a validity time-range indicated by the first packet-filtering rule,
a key indicated by the first packet-filtering rule, or
a signing authority indicated by the first packet-filtering rule.

9. The method of claim 1 , wherein the first action is based on at least one of:
a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule,
data indicating a protocol version specified by the first packet-filtering rule,
data indicating a method specified by the first packet-filtering rule,
data indicating a request specified by the first packet-filtering rule, or
data indicating a command specified by the first packet-filtering rule.

10. The method of claim 1 , wherein the plurality of first packets comprise one or more packets comprising one or more handshake messages configured to establish the encrypted communication session.

11. One or more non-transitory computer-readable media comprising instructions that, when executed by at least one processor of a packet-filtering system configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, cause the packet-filtering system to:
receive, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;
receive a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;
determine that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;
generate, based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating:
an indication of one or more actions or an indication of the first packet-filtering rule; and
an Internet Protocol (IP) address corresponding to the domain name;

receive, after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise:
encrypted data, and
respective packet headers comprising second unencrypted data;

determine, without decrypting the encrypted data, whether the plurality of sec

Assignees

• Centripetal Networks Llc

Inventors

• Ahn David K
• Moore Sean
• Disabello Douglas M

Classifications

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0263

  Rule management · CPC title