Methods and systems for protecting a secured network

A packet security gateway that provides an interface across a boundary of a network protected by the packet security gateway and one or more networks other than the network protected by the packet security gateway, the packet security gateway comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the packet security gateway to:
• receive, from a security policy management server located in the one or more networks other than the network protected by the packet security gateway, a dynamic security policy comprising a first set of packet filtering rules to be applied to all network traffic traversing the boundary via the packet security gateway, wherein one or more first packet filtering rules of the first set of packet filtering rules were automatically created by the security policy management server based on malicious traffic information received from one or more malicious host tracker services, and wherein each packet filtering rule of the first set of packet filtering rules comprises:
• at least one packet matching criterion,
• one or more corresponding packet transformation functions, and
• metadata indicating at least one malicious host tracker service, of the one or more malicious host tracker services, corresponding to the respective packet filtering rule, wherein the metadata comprises an identification of a feed managed by the at least one malicious host tracker service that provides network addresses of malicious hosts;
• perform packet filtering on a first portion of packets associated with the network protected by the packet security gateway based on the first set of packet filtering rules by performing at least one of multiple packet transformation functions specified by one or more packet filtering rules of the first set of packet filtering rules on the first portion of packets, wherein the at least one of the multiple packet transformation functions specified by the one or more packet filtering rules of the first set of packet filtering rules corresponds to a packet digest logging function that supports a network communications awareness service and comprises generating a record comprising:
• first data, from a packet, that matches first packet matching criterion of a packet filtering rule, wherein the packet filtering rule corresponds to the packet digest logging function;
• and
• second data that comprises:
• the first packet matching criterion,
• the one or more corresponding packet transformation functions, and
• the metadata indicating the at least one malicious host tracker service corresponding to the respective packet filtering rule,
• wherein the network communications awareness service is provided based on one or more criteria that are indicative of packet communications that are of interest to an organization that operates the network;
• reformat, in accordance with a logging system standard, the record;
• and
• forward, to the network communications awareness service, the reformatted record.

One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors of a packet-filtering device that provides an interface across a boundary of a network protected by the packet-filtering device and one or more networks other than the network protected by the packet-filtering device, cause the packet-filtering device to:

• receive, from a security policy management server located in the one or more networks other than the network protected by the packet-filtering device, a dynamic security policy comprising a first set of packet filtering rules to be applied to all network traffic traversing the boundary via the packet-filtering device, wherein one or more first packet filtering rules of the first set of packet filtering rules were automatically created by the security policy management server based on malicious traffic information received from one or more malicious host tracker services, and wherein each packet filtering rule of the first set of packet filtering rules comprises:
• at least one packet matching criterion,
• one or more corresponding packet transformation functions, and
• metadata indicating at least one malicious host tracker service, of the one or more malicious host tracker services, corresponding to the respective packet filtering rule, wherein the metadata comprises an identification of a feed managed by the at least one malicious host tracker service that provides network addresses of malicious hosts;
• perform packet filtering on a first portion of packets associated with the network protected by the packet-filtering device based on the first set of packet filtering rules by performing at least one of multiple packet transformation functions specified by one or more packet filtering rules of the first set of packet filtering rules on the first portion of packets, wherein the at least one of the multiple packet transformation functions specified by the one or more packet filtering rules of the first set of packet filtering rules corresponds to a packet digest logging function that supports a network communications awareness service and comprises generating a record comprising:
• first data, from a packet, that matches first packet matching criterion of a packet filtering rule, wherein the packet filtering rule corresponds to the packet digest logging function;
• and
• second data that comprises:
• the first packet matching criterion,
• the one or more corresponding packet transformation functions, and
• the metadata indicating the at least one malicious host tracker service corresponding to the respective packet filtering rule,
• wherein the network communications awareness service is provided based on one or more criteria that are indicative of packet communications that are of interest to an organization that operates the network;
• reformat, in accordance with a logging system standard, the record;
• and
• forward, to the network communications awareness service, the reformatted record.