# US 11,444,963 B1 · Efficient threat context-aware packet filtering for network protection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,963 B1 - Document ID: US11444963B1 - Status: Granted - Kind: B1 - Application number: 17/695,047 - Filed: 2022-03-15 - Granted: 2022-09-13 - Earliest claimed: 2021-04-20 - Assignees: Centripetal Networks, Inc. - Applicants: Centripetal Networks, Inc. - Inventors: Sean Moore; Jonathan R. Rogers; Vincent Mutolo; Peter P. Geremia - Web page: https://patentgrep.com/patent/US11444963B1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0254: {Stateful filtering} - H04L 63/0263: {Rule management} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/166: {at the transport layer} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A threat intelligence gateway (TIG) may protect TCP/IP networks from network (e.g., Internet) threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies may be composed of packet filtering rules with packet-matching criteria derived from cyber threat intelligence (CTI) associated with Internet threats. These CTI-derived packet-filtering rules may be created offline by policy creation and management servers, which may distribute the policies to subscribing TIGs that subsequently enforce the policies on in-transit packets. Each packet filtering rule may specify a disposition that may be applied to a matching in-transit packet, such as deny/block/drop the in-transit packet or pass/allow/forward the in-transit packet, and also may specify directives that may be applied to a matching in-transit packet, such as log, capture, spoof-tcp-rst, etc. Often, however, the selection of a rule's disposition and directives that best protect the associated network may not be optimally determined before a matching in-transit packet is observed by the associated TIG. In such cases, threat context information that may only be available (e.g., computable) at in-transit packet observation and/or filtering time, such as current time-of-day, current TIG/network location, current TIG/network administrator, the in-transit packet being determined to be part of an active attack on the network, etc., may be helpful to determine the disposition and directives that may best protect the network from the threat associated with the in-transit packet. The present disclosure describes examples of methods, systems, and apparatuses that may be used for efficiently determining (e.g., accessing and/or computing), in response to the in-transit packet, threat context information associated with an in-transit packet. The threat context information may be used to efficiently determine the disposition and/or one or more directives to apply to the in-transit packet. This may result in dispositions and/or directives being applied to in-transit packets that better protect the network as compared with solely using dispositions and directives that were predetermined prior to receiving the in-transit packet. ## Claims ### Claim 1 A method comprising: receiving, by a packet-filtering appliance configured to process packets in-transit traversing a boundary between a first network and a second network, a plurality of packet-filtering rules each indicating one or more criteria and one or more actions to be performed, wherein: the packet-filtering rules were automatically generated based on a plurality of threat indicators that were determined based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of threat indicators comprises a plurality of network addresses associated with one or more network threats identified by the one or more cyber threat intelligence providers, and a first packet-filtering rule of the plurality of packet-filtering rules indicates at least one criterion and comprises a disposition indication, wherein the disposition indication corresponds to a disposition that is to be determined after an in-transit packet matching the first packet-filtering rule is received; receiving, by the packet-filtering appliance from the first network and at a first time, a first in-transit packet destined to the second network; based on determining that the first in-transit packet matches the at least one criterion of the first packet-filtering rule, the packet-filtering appliance performing: determining first threat context information associated with the receiving the first in-transit packet; determining, based on the first threat context information, a first disposition; determining, based on the first disposition, a first directive; and applying the first disposition and the first directive to the first in-transit packet; receiving, by the packet-filtering appliance from the first network and at a second time, a second in-transit packet destined to the second network; and based on determining that the second in-transit packet matches the at least one criterion of the first packet-filtering rule, the packet-filtering appliance performing: determining second threat context information associated with the receiving the second in-transit packet, wherein the second threat context information has at least one value different from the first threat context information; determining, based on the second threat context information and independently from the determining the first disposition, a second disposition; determining, based on the second disposition, a second directive; and applying the second disposition and the second directive to the second in-transit packet. ### Claim 2 (depends on 1) The method of claim 1, wherein the second disposition is a same disposition as the first disposition, and wherein the second directive is a different directive than the first directive. ### Claim 3 (depends on 1) The method of claim 1, wherein one of the first disposition or the second disposition is to allow the first in-transit packet to proceed to the second network, and the other of the first disposition or the second disposition is to block the second in-transit packet from proceeding to the second network. ### Claim 4 (depends on 1) The method of claim 1, wherein the second disposition is different from the first disposition. ### Claim 5 (depends on 1) The method of claim 1, wherein the applying the first disposition to the first in-transit packet is performed before the receiving the second in-transit packet. ### Claim 6 (depends on 1) The method of claim 1, wherein the applying the first disposition to the first in-transit packet is completed before the receiving the second in-transit packet. ### Claim 7 (depends on 1) The method of claim 1, wherein the applying the first disposition to the first in-transit packet is completed after the receiving the second in-transit packet and before completing the applying the second disposition to the second in-transit packet. ### Claim 8 (depends on 1) The method of claim 1, wherein the determining the first threat context information comprises determining the first threat context information based on an observation time of the first in-transit packet. ### Claim 9 (depends on 1) The method of claim 1, wherein the determining the first threat context information comprises determining the first threat context information based on whether the first in-transit packet is a member of an attack that is active at a time that the first in-transit packet is received by the packet-filtering appliance. ### Claim 10 (depends on 1) The method of claim 1, wherein the determining the first threat context information comprises determining the first threat context information based on whether the first in-transit packet is a member of a multi-packet multi-flow attack that is active at a time that the first in-transit packet is received by the packet-filtering appliance. ### Claim 11 (depends on 1) The method of claim 1, wherein: the first threat context information comprises a first plurality of elements of information and the second threat context information comprises a second plurality of elements of information; the packet-filtering appliance comprises an artificial neural network comprising a plurality of input nodes and a plurality of output nodes; the determining the first disposition comprises: providing the first plurality of elements of information to at least some of the plurality of input nodes of the artificial neural network; and receiving, via at least one of the plurality of output nodes of the artificial neural network, an indication of the first disposition; and the determining the second disposition comprises: providing the second plurality of elements of information to at least some of the plurality of input nodes of the artificial neural network; and receiving, via at least one of the plurality of output nodes of the artificial neural network, an indication of the second disposition. ### Claim 12 A packet-filtering appliance configured to process packets in-transit traversing a boundary between a first network and a second network, the packet-filtering appliance comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions that, when executed by the one or more processors, configure the packet-filtering appliance to: receive a plurality of packet-filtering rules each indicating one or more criteria and one or more actions to be performed, wherein: the packet-filtering rules were automatically generated based on a plurality of threat indicators that were determined based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of threat indicators comprises a plurality of network addresses associated with one or more network threats identified by the one or more cyber threat intelligence providers, and a first packet-filtering rule of the plurality of packet-filtering rules indicates at least one criterion and comprises a disposition indication, wherein the disposition indication corresponds to a disposition that is to be determined after an in-transit packet matching the first packet-filtering rule is received; receive, from the first network and at a first time, a first in-transit packet destined to the second network; based on determining that the first in-transit packet matches the at least one criterion of the first packet-filtering rule: determine first threat context information associated with the receiving the first in-transit packet; determine, based on the first threat context information, a first disposition; determine, based on the first disposition, a first directive; and apply the first disposition and the first directive to the first in-transit packet; receive, from the first network and at a second time, a second in-transit packet destined to the second network; and based on determining that the second in-transit packet matches the at least one criterion of the first packet-filtering rule: determine second threat context information associated with receiving the second in-transit packet, wherein the second threat context information has at least one value different from the first threat context information; determine, based on the second threat context information and independently from determining the first disposition, a second disposition; determine, based on the second disposition, a second directive; and apply the second disposition and the second directive to the second in-transit packet. ### Claim 13 (depends on 12) The packet-filtering appliance of claim 12, wherein the second disposition is a same disposition as the first disposition, and wherein the second directive is a different directive than the first directive. ### Claim 14 (depends on 12) The packet-filtering appliance of claim 12, wherein one of the first disposition or the second disposition is to allow the first in-transit packet to proceed to the second network, and the other of the first disposition or the second disposition is to block the second in-transit packet from proceeding to the second network. ### Claim 15 (depends on 12) The packet-filtering appliance of claim 12, wherein the second disposition is different from the first disposition. ### Claim 16 (depends on 12) The packet-filtering appliance of claim 12, wherein the instructions, when executed by the one or more processors, configure the packet-filtering appliance to apply the first disposition the first in-transit packet before the second in-transit packet is received by the packet-filtering appliance. ### Claim 17 (depends on 12) The packet-filtering appliance of claim 12, wherein the instructions, when executed by the one or more processors, configure the packet-filtering appliance to complete applying the first disposition to the first in-transit packet before the second in-transit packet is received by the packet-filtering appliance. ### Claim 18 (depends on 12) The packet-filtering appliance of claim 12, wherein the instructions, when executed by the one or more processors, configure the packet-filtering appliance to complete applying the first disposition to the first in-transit packet after the second in-transit packet is received by the packet-filtering appliance and before completing applying the second disposition to the second in-transit packet. ### Claim 19 (depends on 12) The packet-filtering appliance of claim 12, wherein the instructions, when executed by the one or more processors, configure the packet-filtering appliance to determine the first threat context information based on an observation time of the first in-transit packet. ### Claim 20 (depends on 12) The packet-filtering appliance of claim 12, wherein the instructions, when executed by the one or more processors, configure the packet-filtering appliance to determine the first threat context information based on whether the first in-transit packet is a member of an attack that is active at a time that the first in-transit packet is received by the packet-filtering appliance. ### Claim 21 (depends on 12) The packet-filtering appliance of claim 12, wherein the instructions, when executed by the one or more processors, configure the packet-filtering appliance to determine the first threat context information based on whether the first in-transit packet is a member of a multi-packet multi-flow attack that is active at a time that the first in-transit packet is received by the packet-filtering appliance. ### Claim 22 (depends on 12) The packet-filtering appliance of claim 12, wherein: the first threat context information comprises a first plurality of elements of information and the second threat context information comprises a second plurality of elements of information; the packet-filtering appliance comprises an artificial neural network comprising a plurality of input nodes and a plurality of output nodes; and the instructions, when executed by the one or more processors, configure the packet-filtering appliance to: determine the first disposition by: providing the first plurality of elements of information to at least some of the plurality of input nodes of the artificial neural network; and receiving, via at least one of the plurality of output nodes of the artificial neural network, an indication of the first disposition; and determine the second disposition by: providing the second plurality of elements of information to at least some of the plurality of input nodes of the artificial neural network; and receiving, via at least one of the plurality of output nodes of the artificial neural network, an indication of the second disposition. ### Claim 23 One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors of a packet-filtering appliance configured to process packets in-transit traversing a boundary between a first network and a second network, cause: receiving, by the packet-filtering appliance, a plurality of packet-filtering rules each indicating one or more criteria and one or more actions to be performed, wherein: the packet-filtering rules were automatically generated based on a plurality of threat indicators that were determined based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of threat indicators comprises a plurality of network addresses associated with one or more network threats identified by the one or more cyber threat intelligence providers, and a first packet-filtering rule of the plurality of packet-filtering rules indicates at least one criterion and comprises a disposition indication, wherein the disposition indication corresponds to a disposition that is to be determined after an in-transit packet matching the first packet-filtering rule is received; receiving, by the packet-filtering appliance from the first network and at a first time, a first in-transit packet destined to the second network; based on determining that the first in-transit packet matches the at least one criterion of the first packet-filtering rule, the packet-filtering appliance performing: determining first threat context information associated with the receiving the first in-transit packet; determining, based on the first threat context information, a first disposition; determining, based on the first disposition, a first directive; and applying the first disposition and the first directive to the first in-transit packet; receiving, by the packet-filtering appliance from the first network and at a second time, a second in-transit packet destined to the second network; and based on determining that the second in-transit packet matches the at least one criterion of the first packet-filtering rule, the packet-filtering appliance performing: determining second threat context information associated with the receiving the second in-transit packet, wherein the second threat context information has at least one value different from the first threat context information; determining, based on the second threat context information and independently from the determining the first disposition, a second disposition; determining, based on the second disposition, a second directive; and applying the second disposition and the second directive to the second in-transit packet. ### Claim 24 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein the second disposition is a same disposition as the first disposition, and wherein the second directive is a different directive than the first directive. ### Claim 25 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein one of the first disposition or the second disposition is to allow the first in-transit packet to proceed to the second network, and the other of the first disposition or the second disposition is to block the second in-transit packet from proceeding to the second network. ### Claim 26 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein the second disposition is different from the first disposition. ### Claim 27 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein the instructions, when executed by the one or more processors of the packet-filtering appliance, cause the applying the first disposition to the first in-transit packet to be: performed before the receiving the second in-transit packet; completed before the receiving the second in-transit packet; or completed after the receiving the second in-transit packet and before completing the applying the second disposition to the second in-transit packet. ### Claim 28 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein the instructions, when executed by the one or more processors of the packet-filtering appliance, cause the determining the first threat context information by determining the first threat context information based on an observation time of the first in-transit packet. ### Claim 29 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein the instructions, when executed by the one or more processors of the packet-filtering appliance, cause the determining the first threat context information by determining the first threat context information based on whether the first in-transit packet is a member of an attack that is active at a time that the first in-transit packet is received by the packet-filtering appliance. ### Claim 30 (depends on 23) The one or more non-transitory computer-readable media of claim 23, wherein the instructions, when executed by the one or more processors of the packet-filtering appliance, cause the determining the first threat context information by determining the first threat context information based on whether the first in-transit packet is a member of a multi-packet multi-flow attack that is active at a time that the first in-transit packet is received by the packet-filtering appliance.