RULE-BASED NETWORK-THREAT DETECTION

• US 20190238577A1
• Filed: 12/12/2018
• Published: 08/01/2019
• Est. Priority Date: 04/17/2015
• Status: Active Grant

• Current Assignee: Centripetal Networks, Inc.
• Original Assignee: Centripetal Networks, Inc.
• Inventors: Ahn, David K., George, Keith A., Geremia, Peter P., Mallett, III, Pierre, Moore, Sean, Perry, Robert T., Rogers, Jonathan R.
• Granted Patent: US 10,567,413 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A packet-filtering device may receive packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to network-threat indicators. The packet-filtering device may receive packets and, for each packet, may determine that the packet corresponds to criteria specified by a packet-filtering rule. The criteria may correspond to one or more of the network-threat indicators. The packet-filtering device may apply an operator specified by the packet-filtering rule. The operator may be configured to cause the packet-filtering device to either prevent the packet from continuing toward its destination or allow the packet to continue toward its destination. The packet-filtering device may generate a log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and indicating whether the packet-filtering device prevented the packet from continuing toward its destination or allowed the packet to continue toward its destination.

Claims

1. (canceled)

2. A method comprising:

receiving, by a packet-filtering device located at a boundary between a protected network and an unprotected network, a plurality of packets;

responsive to a determination by the packet-filtering device that a first packet of the plurality of packets corresponds to a first packet matching criterion specified by a first packet-filtering rule of a plurality of packet-filtering rules;

applying, by the packet-filtering device and to the first packet, a first operator specified by the first packet-filtering rule corresponding to the first packet matching criterion;

generating, by the packet-filtering device and for the first packet, a packet log entry comprising at least one threat identifier corresponding to the first packet; and

determining, by the packet-filtering device, at least one score associated with the at least one threat identifier; and

communicating, by the packet-filtering device, the at least one score associated with the at least one threat identifier,

wherein each of the plurality of packet-filtering rules specifies at least one packet matching criterion and at least one operator.

3. The method of claim 2, wherein applying the first operator specified by the first packet-filtering rule allows the first packet to continue toward a destination of the first packet, the method further comprising:

updating the first packet-filtering rule corresponding to the first packet matching criterion to specify a second operator; and

responsive to a determination by the packet-filtering device that a second packet of the plurality of packets corresponds to the first packet matching criterion specified by an updated first packet-filtering rule, applying, by the packet-filtering device and to the second packet, the second operator specified by the updated first packet-filtering rule corresponding to the first packet matching criterion,

wherein applying the second operator specified by the updated first packet-filtering rule prevents the second packet from continuing toward a destination of the second packet.

4. The method of claim 2, wherein determining the at least one score further comprises determining the at least one score based on at least one of a type of threat associated with the at least one threat identifier, geographic information, an anonymous proxy associated with the at least one threat identifier, or an actor associated with the at least one threat identifier.

5. The method of claim 2, further comprising:

updating, by the packet-filtering device and based on the generated packet log entry, a packet flow log entry, wherein each packet flow entry consolidates a plurality of packet log entries corresponding to a common threat identifier,

wherein the determining the at least one score associated with the at least one threat identifier comprises updating a first score associated a packet flow log entry corresponding to the at least one threat identifier.

6. The method of claim 2, wherein determining the at least one score associated with the at least one threat identifier further comprises:

determining a number of network-threat-intelligence providers of one or more network-threat-intelligence providers from which the at least one threat identifier corresponding to the first packet was received; and

determining a second score for the at least one threat identifier corresponding to the first packet based on the number of network-threat-intelligence providers.

7. The method of claim 2, wherein the determining the at least one score associated with the at least one threat identifier further comprises determining the at least one score based on a number of the plurality of packets that correspond to the at least one threat identifier.

8. The method of claim 2, the method further comprising:

updating the at least one score based on one or more times at which one or more packets of a plurality of logged packets that corresponds to one or more packet-filtering rules were filtered by the packet-filtering device; and

updating the at least one score based on a number of the plurality of logged packets that correspond to the one or more packet-filtering rules.

9. The method of claim 2, wherein determining the at least one score further comprises determining the at least one score based on an identity of one or more network-threat-intelligence providers that provided network-threat indicators associated with a corresponding threat identifier, and a number of network-threat intelligence providers that provided network-threat indicators associated with a corresponding threat identifier.

10. The method of claim 2, wherein determining the at least one score further comprises determining the at least one score based on a destination of a packet of a plurality of logged packets that corresponds to the plurality of packet-filtering rules.

11. The method of claim 2, wherein communicating, by the packet-filtering device, the at least one score associated with the at least one threat identifier comprises communicating a plurality of scores, wherein each score is associated with a different threat identifier.

12. A packet-filtering device comprising:

at least one processor; and

memory storing instructions that when executed by the at least one processor cause the packet-filtering device to;

receive, by the packet-filtering device located at a boundary between a protected network and an unprotected network, a plurality of packets;

responsive to a determination by the packet-filtering device that a first packet of the plurality of packets corresponds to a first packet matching criterion specified by a first packet-filtering rule of a plurality of packet-filtering rules;

apply, to the first packet, a first operator specified by the first packet-filtering rule corresponding to the first packet matching criterion;

generate, for the first packet, a packet log entry comprising at least one threat identifier corresponding to the first packet; and

determine at least one score associated with the at least one threat identifier; and

communicate the at least one score associated with the at least one threat identifier,

wherein each of the plurality of packet-filtering rules specifies at least one packet matching criterion and at least one operator.

13. The packet-filtering device of claim 12, wherein applying the first operator specified by the first packet-filtering rule allows the first packet to continue toward a destination of the first packet, wherein instructions further cause the packet-filtering device to:

update the first packet-filtering rule corresponding to the first packet matching criterion to specify a second operator; and

responsive to a determination by the packet-filtering device that a second packet of the plurality of packets corresponds to the first packet matching criterion specified by an updated first packet-filtering rule, apply, to the second packet, the second operator specified by the updated first packet-filtering rule corresponding to the first packet matching criterion,

wherein applying the second operator specified by the updated first packet-filtering rule prevents the second packet from continuing toward a destination of the second packet.

14. The packet-filtering device of claim 12, wherein the instructions cause the packet-filtering device to determine the at least one score by causing the packet-filtering device to determine the at least one score based on at least one of a type of threat associated with the at least one threat identifier, geographic information, an anonymous proxy associated with the at least one threat identifier, or an actor associated with the at least one threat identifier.

15. The packet-filtering device of claim 12, wherein the instructions cause the packet-filtering device to:

update, based on the generated packet log entry, a packet flow log entry, wherein each packet flow entry consolidates a plurality of packet log entries corresponding to a common threat identifier,

wherein determining the at least one score associated with the at least one threat identifier comprises updating a score associated a packet flow log entry corresponding to the at least one threat identifier.

16. The packet-filtering device of claim 12, wherein the instructions cause the packet-filtering device to determine the at least one score by causing the packet-filtering device to determine the at least one score based on an identity of one or more network-threat-intelligence providers that provided network-threat indicators associated with a corresponding threat identifier, and a number of network-threat intelligence providers that provided network-threat indicators associated with a corresponding threat identifier.

17. One or more non-transitory computer-readable media comprising instructions that, when executed by at least one processor of a packet-filtering device, cause the packet-filtering device to:

receive, by a packet-filtering device located at a boundary between a protected network and an unprotected network, a plurality of packets;

responsive to a determination by the packet-filtering device that a first packet of the plurality of packets corresponds to a first packet matching criterion specified by a first packet-filtering rule of a plurality of packet-filtering rules;

apply, to the first packet, a first operator specified by the first packet-filtering rule corresponding to the first packet matching criterion;

generate, for the first packet, a packet log entry comprising at least one threat identifier corresponding to the first packet; and

determine at least one score associated with the at least one threat identifier; and

communicate the at least one score associated with the at least one threat identifier,

wherein each of the plurality of packet-filtering rules specifies at least one packet matching criterion and at least one operator.

18. The one or more non-transitory computer-readable media of claim 17, wherein applying the first operator specified by the first packet-filtering rule allows the first packet to continue toward a destination of the first packet, and further comprising instructions that cause the packet-filtering device to:

update the first packet-filtering rule corresponding to the first packet matching criterion to specify a second operator; and

responsive to a determination by the packet-filtering device that a second packet of the plurality of packets corresponds to the first packet matching criterion specified by an updated first packet-filtering rule, apply, to the second packet, the second operator specified by the updated first packet-filtering rule corresponding to the first packet matching criterion,

wherein applying the second operator specified by the updated first packet-filtering rule prevents the second packet from continuing toward a destination of the second packet.

19. The one or more non-transitory computer-readable media of claim 17, wherein the instructions cause the packet-filtering device to determine the at least one score by causing the packet-filtering device to determine the at least one score based on at least one of a type of threat associated with the at least one threat identifier, geographic information, an anonymous proxy associated with the at least one threat identifier, or an actor associated with the at least one threat identifier.

20. The one or more non-transitory computer-readable media of claim 17, further comprising instructions that cause the packet-filtering device to:

update, based on the generated packet log entry, a packet flow log entry, wherein each packet flow entry consolidates a plurality of packet log entries corresponding to a common threat identifier,

wherein determining the at least one score associated with the at least one threat identifier comprises updating a score associated a packet flow log entry corresponding to the at least one threat identifier.

21. The one or more non-transitory computer-readable media of claim 17, wherein the instructions cause the packet-filtering device to determine the at least one score by causing the packet-filtering device to determine the at least one score based on an identity of one or more network-threat-intelligence providers that provided network-threat indicators associated with a corresponding threat identifier, and a number of network-threat intelligence providers that provided network-threat indicators associated with a corresponding threat identifier.