Rule-based network-threat detection

A packet-filtering device located at a boundary between a protected network and an unprotected network and configured to minimize latency between when packets corresponding to a network threat cross the boundary and when the packets corresponding to the network threat are included in an ordered list of network threats, the packet-filtering device comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the packet-filtering device to:
• receive, from a rule provider device, a plurality of packet-filtering rules generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address previously determined by one or more of the plurality of independent network-threat-intelligence providers to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies:
• one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• at least one first network-threat-intelligence report that supplied the first network-threat indicators;
• and
• at least one first network-threat-intelligence provider that supplied the first network-threat-intelligence report;
• filter a plurality of packets based on comparing each packet of the plurality of packets to packet-matching criteria specified by the plurality of packet-filtering rules;
• generate, based on the filtering, a first log entry corresponding to the first potential network threat when a packet corresponding to the first potential network threat is received at the packet-filtering device, by:
• responsive to a determination that a first packet of the plurality of packets matches the first packet-matching criteria of the first packet-filtering rule, generating a first log entry corresponding to the first packet that comprises:
• an indication of the first packet-filtering rule;
• and
• an indication of the first packet;
• determining a first score for the first log entry based on:
• the first network-threat-intelligence provider specified by the first packet-filtering rule indicated by the first log entry, and
• a type of threat indicated by the first network-threat-intelligence report specified by the first packet-filtering rule indicated by the first log entry;
• and
• adding the first score to the first log entry;
• cause the first log entry to be added to the ordered list of network threats, wherein an ordering of the ordered list of network threats is determined based on the first score of the first log entry and a second score of a second log entry;
• and
• provide the ordered list of network threats, including the first log entry and the second log entry, to a user of a user device.

One or more non-transitory computer-readable media storing instructions for minimizing latency between when packets corresponding to a network threat cross a boundary between a protected network and an unprotected network and when the packets corresponding to the network threat are included in an ordered list of network threats, wherein the instructions, when executed by one or more processors of a packet-filtering device at the boundary, cause the packet-filtering device to:

• receive, from a rule provider device, a plurality of packet-filtering rules generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address previously determined by one or more of the plurality of independent network-threat-intelligence providers to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies:
• one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• at least one first network-threat-intelligence report that supplied the first network-threat indicators;
• and
• at least one first network-threat-intelligence provider that supplied the first network-threat-intelligence report;
• filter a plurality of packets based on comparing each packet of the plurality of packets to packet-matching criteria specified by the plurality of packet-filtering rules;
• generate, based on the filtering, a first log entry corresponding to the first potential network threat when a packet corresponding to the first potential network threat is received at the packet-filtering device, by:
• responsive to a determination that a first packet of the plurality of packets matches the first packet-matching criteria of the first packet-filtering rule, generating a first log entry corresponding to the first packet that comprises:
• an indication of the first packet-filtering rule;
• and
• an indication of the first packet;
• determining a first score for the first log entry based on:
• the first network-threat-intelligence provider specified by the first packet-filtering rule indicated by the first log entry, and
• a type of threat indicated by the first network-threat-intelligence report specified by the first packet-filtering rule indicated by the first log entry;
• and
• adding the first score to the first log entry;
• cause the first log entry to be added to the ordered list of network threats, wherein an ordering of the ordered list of network threats is determined based on the first score of the first log entry and a second score of a second log entry;
• and
• provide the ordered list of network threats, including the first log entry and the second log entry, to a user of a user device.