US 11,539,664 B2 · Methods and systems for efficient adaptive logging of cyber threat incidents

Abstract

A packet-filtering network appliance such as a threat intelligence gateway (TIG) protects TCP/IP networks from Internet threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies are composed of packet filtering rules derived from cyber threat intelligence (CTI). Logs of rule-matching packets and their associated flows are sent to cyberanalysis applications located at security operations centers (SOCs) and operated by cyberanalysts. Some cyber threats/attacks, or incidents, are composed of many different flows occurring at a very high rate, which generates a flood of logs that may overwhelm computer, storage, network, and cyberanalysis resources, thereby compromising cyber defenses. The present disclosure describes incident logging, in which a single incident log efficiently incorporates the logs of the many flows that comprise the incident, thereby potentially reducing resource consumption while improving the informational/cyberanalytical value of the incident log for cyberanalysis when compared to the component flow logs. Incident logging vs. flow logging can be automatically and adaptively switched on or off depending on the combination of resource consumption and informational/cyberanalytical value.

Claims30

Dependent claims

A method comprising:

receiving, by a packet-filtering device, a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein the plurality of packet-filtering rules was generated based on threat indicators included in cyber threat intelligence reports from one or more cyber threat intelligence providers;
receiving, by the packet-filtering device, a first plurality of packets;
based on determining that the first plurality of packets each match at least one rule of one of the plurality of packet-filtering rules, performing, by the packet-filtering device:
logging at least one flow associated with the first plurality of packets;
and
capturing at least a portion of each of the first plurality of packets;
and
based on a flow logging rate exceeding a threshold flow logging rate, halting capture by the packet-filtering device of one or more further packets of the at least one flow, wherein the flow logging rate is associated with the at least one flow.

5 more elements

A packet-filtering device comprising:

one or more processors;
and
memory storing instructions that, when executed by the one or more processors, cause the packet-filtering device to:
receive a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein the plurality of packet-filtering rules was generated based on threat indicators included in cyber threat intelligence reports from one or more cyber threat intelligence providers;
receive a first plurality of packets;
based on determining that the first plurality of packets each match at least one rule of one of the plurality of packet-filtering rules:
log at least one flow associated with the first plurality of packets;
and
capture at least a portion of each of the first plurality of packets;
and
based on a flow logging rate exceeding a threshold flow logging rate, halt capture by the packet-filtering device of one or more further packets of the at least one flow, wherein the flow logging rate is associated with the at least one flow.

8 more elements

A non-transitory computer-readable medium storing instructions that, when executed, cause a packet-filtering device to:

receive a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein the plurality of packet-filtering rules was generated based on threat indicators included in cyber threat intelligence reports from one or more cyber threat intelligence providers;
receive a first plurality of packets;
based on determining that the first plurality of packets each match at least one rule of one of the plurality of packet-filtering rules:
log at least one flow associated with the first plurality of packets;
and
capture at least a portion of each of the first plurality of packets;
and
based on a flow logging rate exceeding a threshold flow logging rate, halt capture by the packet-filtering device of one or more further packets of the at least one flow, wherein the flow logging rate is associated with the at least one flow.

5 more elements

Dependencies are inferred from the claim text.

Methods and systems for efficient adaptive logging of cyber threat incidents

Life of this patent

Methods and systems for efficient adaptive logging of cyber threat incidents

Life of this patent

Abstract

Claims30