Rule-based network-threat detection

• US 9,413,722 B1
• Filed: 09/15/2015
• Issued: 08/09/2016
• Est. Priority Date: 04/17/2015
• Status: Active Grant

• Current Assignee: Centripetal Networks, Inc.
• Original Assignee: Centripetal Networks, Inc.
• Inventors: George, Keith A., Rogers, Jonathan R., Ahn, David K., Geremia, Peter P., Mallett, Pierre III, Moore, Sean, Perry, Robert T.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/855,374
• Time in Patent Office: 329 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A packet-filtering device may receive packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to network-threat indicators. The packet-filtering device may receive packets and, for each packet, may determine that the packet corresponds to criteria specified by a packet-filtering rule. The criteria may correspond to one or more of the network-threat indicators. The packet-filtering device may apply an operator specified by the packet-filtering rule. The operator may be configured to cause the packet-filtering device to either prevent the packet from continuing toward its destination or allow the packet to continue toward its destination. The packet-filtering device may generate a log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and indicating whether the packet-filtering device prevented the packet from continuing toward its destination or allowed the packet to continue toward its destination.

Claims

1. A method comprising:

receiving, by a packet-filtering device, a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of network-threat indicators;

receiving, by the packet-filtering device, a plurality of packets, wherein the plurality of packets comprises a first packet and a second packet;

responsive to a determination by the packet-filtering device that the first packet satisfies one or more criteria, specified by a packet-filtering rule of the plurality of packet-filtering rules, that correspond to one or more network-threat indicators of the plurality of network-threat indicators;

applying, by the packet-filtering device and to the first packet, an operator specified by the packet-filtering rule and configured to cause the packet-filtering device to allow the first packet to continue toward a destination of the first packet;

communicating, by the packet-filtering device, information from the packet-filtering rule that identifies the one or more network-threat indicators, and data indicative that the first packet was allowed to continue toward the destination of the first packet;

causing, by the packet-filtering device and in an interface, display of the information in at least one portion of the interface corresponding to the packet-filtering rule and the one or more network-threat indicators;

receiving, by the packet-filtering device, an instruction generated in response to a user invoking an element in the at least one portion of the interface corresponding to the packet-filtering rule and the one or more network-threat indicators; and

responsive to receiving the instruction;

modifying, by the packet-filtering device, at least one operator specified by the packet-filtering rule to reconfigure the packet-filtering device to prevent packets corresponding to the one or more criteria from continuing toward their respective destinations; and

responsive to a determination by the packet-filtering device that the second packet corresponds to the one or more criteria;

preventing, by the packet-filtering device, the second packet from continuing toward a destination of the second packet;

communicating, by the packet-filtering device, data indicative that the second packet was prevented from continuing toward the destination of the second packet; and

causing, by the packet-filtering device and in the interface, display of the data indicative that the second packet was prevented from continuing toward the destination of the second packet.

2. The method of claim 1, further comprising:

responsive to the determination by the packet-filtering device that the first packet satisfies the one or more criteria, allowing, by the packet-filtering device, the first packet to continue toward the destination of the first packet.

3. The method of claim 2, wherein:

the packet-filtering device is located at a boundary between a first network and a second network;

both the first packet and the second packet are received from a common host in the first network and destined for a common host in the second network;

the determination by the packet-filtering device that the first packet satisfies the one or more criteria comprises a determination that the first packet was received from the common host in the first network;

the determination by the packet-filtering device that the second packet satisfies the one or more criteria comprises a determination that the second packet was received from the common host in the first network;

allowing the first packet to continue toward the destination of the first packet comprises allowing the first packet to continue toward the common host in the second network; and

preventing the second packet from continuing toward the destination of the first packet comprises preventing the second packet from continuing toward the common host in the second network.

4. The method of claim 2, wherein:

the packet-filtering device is located at a boundary between a first network and a second network;

both the first packet and the second packet are received from a common host in the first network;

the first packet is destined for a first host in the second network;

the second packet is destined for a second host in the second network;

the determination by the packet-filtering device that the first packet satisfies the one or more criteria comprises a determination that the first packet was received from the common host;

the determination by the packet-filtering device that the second packet satisfies the one or more criteria comprises a determination that the second packet was received from the common host;

allowing the first packet to continue toward the destination of the first packet comprises allowing the first packet to continue toward the first host; and

preventing the second packet from continuing toward the destination of the second packet comprises preventing the second packet from continuing toward the second host.

5. The method of claim 2, wherein:

the packet-filtering device is located at a boundary between a first network and a second network;

both the first packet and the second packet are destined for a common host in the first network;

the first packet is received from a first host in the second network;

the second packet is received from a second host in the second network;

the determination by the packet-filtering device that the first packet satisfies the one or more criteria comprises a determination that the first packet is destined for the common host;

the determination by the packet-filtering device that the second packet satisfies the one or more criteria comprises a determination that the second packet is destined for the common host;

allowing the first packet to continue toward the destination of the first packet comprises allowing the first packet to continue toward the common host; and

preventing the second packet from continuing toward the destination of the second packet comprises preventing the second packet from continuing toward the common host.

6. The method of claim 1, comprising, for a packet of the plurality of packets and responsive to the determination by the packet-filtering device that the packet satisfies the one or more criteria, updating, by the packet-filtering device and based on a packet-log entry, a packet-flow log to indicate the determination and whether the packet-filtering device prevented the packet from continuing toward a destination of the packet or allowed the packet to continue toward the destination of the packet.

7. The method of claim 6, wherein receiving the plurality of packets comprises receiving a first portion of packets and a second portion of packets, the method comprising:

for each packet in the first portion of packets;

generating, by the packet-filtering device, a packet-log entry indicating one or more network-threat indicators of the plurality of network-threat indicators to which the packet corresponds and whether the packet-filtering device prevented the packet from continuing toward a destination of the packet or allowed the packet to continue toward the destination of the packet; and

generating, by the packet-filtering device and based on the packet-log entry, a flow-log entry indicating the one or more network-threat indicators and whether the packet-filtering device prevented the packet from continuing toward the destination of the packet or allowed the packet to continue toward the destination of the packet; and

for each packet in the second portion of packets;

generating, by the packet-filtering device, a packet-log entry indicating one or more network-threat indicators of the plurality of network-threat indicators to which the packet corresponds and whether the packet-filtering device prevented the packet from continuing toward the destination of the packet or allowed the packet to continue toward the destination of the packet; and

modifying, by the packet-filtering device and based on the packet-log entry, an existing flow-log entry corresponding to the one or more network-threat indicators to reflect whether the packet-filtering device prevented the packet from continuing toward the destination of the packet or allowed the packet to continue toward the destination of the packet.

8. The method of claim 7, wherein:

the second portion of packets is received by the packet-filtering device after the first portion of packets is received by the packet-filtering device; and

for each packet in the second portion of packets, generating the packet-log entry comprises generating the packet-log entry while the packet-filtering device is generating one or more flow-log entries for one or more packets in the first portion of packets.

9. The method of claim 8, comprising:

receiving, by the packet-filtering device and after receiving the second portion of packets, a third portion of packets; and

generating, by the packet-filtering device, for each packet in the third portion of packets, and while modifying one or more existing flow-log entries based on one or more packet-log entries generated for one or more packets in the second portion, a packet-log entry for the packet.

10. The method of claim 1, wherein:

each of the plurality of network-threat indicators corresponds to at least one network threat of a plurality of network threats; and

each of the plurality of packet-filtering rules corresponds to a different network threat of the plurality of network threats.

11. The method of claim 10, further comprising:

for each packet of the plurality of packets and responsive to the determination by the packet-filtering device that a packet satisfies the one or more criteria that correspond to the one or more network-threat indicators;

generating, by the packet-filtering device, a packet-log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and data indicating whether the packet-filtering device prevented the packet from continuing toward a destination of the packet or allowed the packet to continue toward the destination of the packet; and

updating, by the packet-filtering device and based on the packet-log entry, a packet-flow log to indicate the determination that the packet satisfies the one or more criteria and whether the packet-filtering device prevented the packet from continuing toward the destination of the packet or allowed the packet to continue toward the destination of the packet.

12. The method of claim 11, wherein:

the packet-flow log comprises a plurality of packet-flow-log entries;

each packet-flow-log entry of the plurality of packet-flow-log entries corresponds to a different network threat of the plurality of network threats;

the one or more network-threat indicators correspond to a particular network threat; and

updating the packet-flow log comprises updating a packet-flow-log entry, of the plurality of packet-flow-log entries, that corresponds to the particular network threat.

13. The method of claim 12, wherein the generating the data indicating whether the packet-filtering device prevented the packet from continuing toward the destination of the packet or allowed the packet to continue toward the destination of the packet comprises generating the data based on the packet-flow-log entry that corresponds to the particular network threat.

14. The method of claim 10, comprising:

determining, by the packet-filtering device, an ordering of the plurality of network threats; and

indicating, in the interface, the ordering.

15. The method of claim 14, wherein determining the ordering comprises determining the ordering based on data stored in a packet-flow log, the method comprising, for a packet of the plurality of packets and responsive to the determination by the packet-filtering device that the packet satisfies the one or more criteria that correspond to the one or more network-threat indicators, updating, by the packet-filtering device and based on a packet-log entry, a packet-flow log to indicate the determination and whether the packet-filtering device prevented the packet from continuing toward the destination of the packet or allowed the packet to continue toward the destination of the packet.

16. The method of claim 15, wherein determining the ordering comprises, for each network threat of the plurality of network threats, determining a number of packets corresponding to the network threat and allowed by the packet-filtering device to continue toward their respective destinations.

17. The method of claim 15, wherein determining the ordering comprises, for each network threat of the plurality of network threats, determining a number of packets corresponding to the network threat and prevented by the packet-filtering device from continuing toward their respective destinations.

18. The method of claim 15, wherein determining the ordering comprises, for each network threat of the plurality of network threats, determining a time indicated by the data stored in the packet-flow log at which the packet-filtering device last identified a packet corresponding to the network threat.

19. The method of claim 10, wherein receiving the plurality of packet-filtering rules comprises receiving a plurality of packet-filtering rules generated based on a plurality of network-threat-intelligence reports produced by one or more network-threat-intelligence providers.

20. The method of claim 19, comprising:

determining, by the packet-filtering device and based on the plurality of network-threat-intelligence reports, an ordering of the plurality of network threats; and

indicating, in the interface, the ordering.

21. The method of claim 20, wherein:

a first network threat of the plurality of network threats corresponds to a first packet-filtering rule of the plurality of packet-filtering rules;

a second network threat of the plurality of network threats corresponds to a second packet-filtering rule of the plurality of packet-filtering rules; and

determining the ordering comprises determining an order of the first network threat relative to the second network threat based on;

a determination that the first packet-filtering rule was generated based on one or more network-threat indicators included in a network-threat-intelligence report of the plurality of network-threat-intelligence reports produced by a first network-threat-intelligence provider of the one or more network-threat-intelligence providers; and

a determination that the second packet-filtering rule was generated based on one or more network-threat indicators included in a network-threat-intelligence report of the plurality of network-threat-intelligence reports produced by a second network-threat-intelligence provider of the one or more network-threat-intelligence providers.

22. The method of claim 20, wherein:

a first network threat of the plurality of network threats corresponds to a first packet-filtering rule of the plurality of packet-filtering rules;

a second network threat of the plurality of network threats corresponds to a second packet-filtering rule of the plurality of packet-filtering rules;

the first packet-filtering rule was generated based on one or more network-threat indicators included in a first portion of the plurality of network-threat-intelligence reports;

the second packet-filtering rule was generated based on one or more network-threat indicators included in a second portion of the plurality of network-threat-intelligence reports; and

determining the ordering comprises determining an order of the first network threat relative to the second network threat based on a determination that the first portion of the plurality of network-threat-intelligence reports was received from a greater number of the one or more network-threat-intelligence providers than the second portion of the plurality of network-threat-intelligence reports.

23. The method of claim 20, wherein:

receiving the plurality of packet-filtering rules comprises receiving the plurality of packet-filtering rules from one or more computing devices that provide packet-filtering rules to a plurality of different packet-filtering devices;

a first network threat of the plurality of network threats corresponds to a first packet-filtering rule of the plurality of packet-filtering rules;

a second network threat of the plurality of network threats corresponds to a second packet-filtering rule of the plurality of packet-filtering rules; and

determining the ordering comprises determining an order of the first network threat relative to the second network threat based on data received from the one or more computing devices indicating a number of the plurality of different packet-filtering devices that have reconfigured an operator of the first packet-filtering rule to prevent packets corresponding to criteria specified by the first packet-filtering rule from continuing toward their respective destinations.

24. The method of claim 1, wherein the packet-filtering device is located at a boundary between a first network and a second network, and wherein the first packet and the second packet are either received from a common host in the first network and destined for a common host in the second network or received from the common host in the second network and destined for the common host in the first network, the method comprising:

generating, by the packet-filtering device, one or more packet-filtering rules configured to cause the packet-filtering device to prevent packets received from the common host in the first network from continuing toward at least one of one or more other hosts in the first network or one or more other hosts in the second network; and

responsive to receiving the instruction;

applying, by the packet-filtering device, the one or more packet-filtering rules to one or more packets received from the common host in the first network; and

preventing, by the packet-filtering device, the one or more packets received from the common host in the first network from continuing toward the at least one of the one or more other hosts in the first network or the one or more other hosts in the second network.

25. The method of claim 1, wherein:

receiving the plurality of packet-filtering rules comprises receiving the plurality of packet-filtering rules from one or more computing devices that provide packet-filtering rules to a plurality of different packet-filtering devices.