Rule-based network-threat detection

#Network security is becoming increasingly important as the information age continues to unfold. Network threats may take a variety of forms (e.g., unauthorized requests or data transfers, viruses, malware, large volumes of network traffic designed to overwhelm network resources, and the like). Many organizations subscribe to network-threat services that periodically provide information associated with network threats, for example, reports that include listings of network-threat indicators (e.g., network addresses, uniform resources identifiers (URIs), and the like). The information provided by such services may be utilized by organizations to identify network threats. For example, logs generated by the organization's network devices may be reviewed for data corresponding to the network-threat indicators provided by such services. But because the logs are generated based on the traffic processed by the network devices without regard to the network-threat indicators, this process is often tedious and time consuming and is exacerbated by the continuously evolving nature of potential threats. Accordingly, there is a need for rule-based network-threat detection.

#The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosure. It is intended neither to identify key or critical elements of the disclosure nor to delineate the scope of the disclosure. The following summary merely presents some concepts of the disclosure in a simplified form as a prelude to the description below.

#Aspects of this disclosure relate to rule-based network-threat detection. In accordance with embodiments of the disclosure, a packet-filtering device may receive packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to network-threat indicators. The packet-filtering device may receive packets and, for each packet, may determine that the packet corresponds to criteria specified by a packet-filtering rule. The criteria may correspond to one or more of the network-threat indicators. The packet-filtering device may apply an operator specified by the packet-filtering rule. The operator may be configured to cause the packet-filtering device to either prevent the packet from continuing toward its destination or allow the packet to continue toward its destination. The packet-filtering device may generate a log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and indicating whether the packet-filtering device prevented the packet from continuing toward its destination or allowed the packet to continue toward its destination.

#The present disclosure is pointed out with particularity in the appended claims. Features of the disclosure will become more apparent upon a review of this disclosure in its entirety, including the drawing figures provided herewith.

#Some features herein are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, in which like reference numerals refer to similar elements, and wherein:

#FIG. 1 depicts an illustrative environment for rule-based network-threat detection in accordance with one or more aspects of the disclosure;

#In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. It is to be understood that other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the disclosure.

#Various connections between elements are discussed in the following description. These connections are general and, unless specified otherwise, may be direct or indirect, wired or wireless. In this respect, the specification is not intended to be limiting.

#FIG. 1 depicts an illustrative environment for rule-based network-threat detection in accordance with one or more aspects of the disclosure. Referring to FIG. 1, environment 100 may include one or more networks. For example, environment 100 may include networks 102, 104, 106, and 108. Networks 102, 104, and 106 may comprise one or more networks (e.g., Local Area Networks (LANs), Wide Area Networks (WANs), Virtual Private Networks (VPNs), or combinations thereof) associated with one or more individuals or entities (e.g., governments, corporations, service providers, or other organizations). Network 108 may comprise one or more networks (e.g., LANs, WANs, VPNs, or combinations thereof) that interface networks 102, 104, and 106 with each other and one or more other networks (not illustrated). For example, network 108 may comprise the Internet, a similar network, or portions thereof.