Rule-based network-threat detection for encrypted communications

One or more non-transitory computer-readable media comprising instructions that, when executed by at least one processor of a packet-filtering system configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, cause the packet-filtering system to:

• receive, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;
• receive a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;
• determine that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;
• generate, based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating:
• an indication of one or more actions or an indication of the first packet-filtering rule;
• and
• an Internet Protocol (IP) address corresponding to the domain name;
• receive, after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise:
• encrypted data, and
• respective packet headers comprising second unencrypted data;
• determine, without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name;
• based on determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, filter the plurality of second packets based on the first packet-filtering rule;
• determine, based on the logged indication of the one or more actions or the logged indication of the first packet-filtering rule, to apply a first action corresponding to the first packet-filtering rule;
• and
• send at least a portion of the filtered plurality of second packets to a proxy configured to perform the first action corresponding to the first packet-filtering rule.

A packet-filtering apparatus comprising:

• at least one processor configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules;
• and
• memory storing instructions that when executed by the at least one processor cause the packet-filtering apparatus to:
• receive, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;
• receive a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;
• determine that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;
• generate, based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating:
• an indication of one or more actions or an indication of the first packet-filtering rule;
• and
• an Internet Protocol (IP) address corresponding to the domain name;
• receive, after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise:
• encrypted data, and
• respective packet headers comprising second unencrypted data;
• determine, without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name;
• based on determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, filter the plurality of second packets based on the first packet-filtering rule;
• determine, based on the logged indication of the one or more actions or the logged indication of the first packet-filtering rule, to apply a first action corresponding to the first packet-filtering rule;
• and
• send at least a portion of the filtered plurality of second packets to a proxy configured to perform the first action corresponding to the first packet-filtering rule.