# US 12,010,135 B2 · Rule-based network-threat detection for encrypted communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,135 B2 - Document ID: US12010135B2 - Status: Granted - Kind: B2 - Application number: 18/370,073 - Filed: 2023-09-19 - Published: 2024-01-04 - Granted: 2024-06-11 - Earliest claimed: 2015-12-23 - Assignees: Centripetal Networks, Inc. - Applicants: Centripetal Networks, LLC - Inventors: David K. Ahn; Sean Moore; Douglas M. Disabello - Web page: https://patentgrep.com/patent/US12010135B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 61/4511: using domain name system [DNS] - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0263: {Rule management} - H04L 63/0281: {Proxies} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 69/22: Parsing or analysis of headers - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A packet-filtering system configured to filter packets in accordance with packet-filtering rules may receive data indicating network-threat indicators and may configure the packet-filtering rules to cause the packet-filtering system to identify packets comprising unencrypted data, and packets comprising encrypted data. A portion of the unencrypted data may correspond to one or more of the network-threat indicators, and the packet-filtering rules may be configured to cause the packet-filtering system to determine, based on the portion of the unencrypted data, that the packets comprising encrypted data correspond to the one or more network-threat indicators. ## Claims ### Claim 1 A method of filtering encrypted packets by a packet-filtering system comprising at least one processor and memory and configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, the method comprising: receiving, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat; receiving, by the packet-filtering system, a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data; determining, by the packet-filtering system, that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria; generating, by the packet-filtering system and based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating: an indication of one or more actions or an indication of the first packet-filtering rule; and an Internet Protocol (IP) address corresponding to the domain name; receiving, by the packet-filtering system and after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise: encrypted data, and respective packet headers comprising second unencrypted data; determining, by the packet-filtering system and without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name; based on determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, filtering the plurality of second packets based on the first packet-filtering rule; determining, based on the logged indication of the one or more actions or the logged indication of the first packet-filtering rule, to apply a first action corresponding to the first packet-filtering rule; and sending at least a portion of the filtered plurality of second packets to a proxy configured to perform the first action corresponding to the first packet-filtering rule. ### Claim 2 (depends on 1) The method of claim 1, wherein the determining to apply the first action comprises selecting, from the one or more actions, the first action. ### Claim 3 (depends on 1) The method of claim 1, wherein the log data comprises the logged indication of the first packet-filtering rule, and wherein the determining to apply the first action comprises determining, based on the logged indication of the first packet-filtering rule, the first action. ### Claim 4 (depends on 3) The method of claim 3, wherein the first action comprises dropping, by the proxy, the at least the portion of the filtered plurality of second packets. ### Claim 5 (depends on 1) The method of claim 1, wherein the plurality of first packets comprises the IP address. ### Claim 6 (depends on 1) The method of claim 1, wherein the plurality of first packets comprises a Domain Name System (DNS) query comprising the domain name. ### Claim 7 (depends on 6) The method of claim 6, wherein the DNS query comprises the IP address corresponding to the domain name. ### Claim 8 (depends on 1) The method of claim 1, wherein the plurality of first packets comprise a certificate message for the encrypted communication session, and wherein the first action comprises: at least one of dropping or logging one or more of the plurality of second packets based on a determination that the certificate message comprises data indicating at least one of: a serial number indicated by the first packet-filtering rule, an issuer indicated by the first packet-filtering rule, a validity time-range indicated by the first packet-filtering rule, a key indicated by the first packet-filtering rule, or a signing authority indicated by the first packet-filtering rule. ### Claim 9 (depends on 1) The method of claim 1, wherein the first action is based on at least one of: a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule, data indicating a protocol version specified by the first packet-filtering rule, data indicating a method specified by the first packet-filtering rule, data indicating a request specified by the first packet-filtering rule, or data indicating a command specified by the first packet-filtering rule. ### Claim 10 (depends on 1) The method of claim 1, wherein the plurality of first packets comprise one or more packets comprising one or more handshake messages configured to establish the encrypted communication session. ### Claim 11 One or more non-transitory computer-readable media comprising instructions that, when executed by at least one processor of a packet-filtering system configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, cause the packet-filtering system to: receive, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat; receive a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data; determine that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria; generate, based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating: an indication of one or more actions or an indication of the first packet-filtering rule; and an Internet Protocol (IP) address corresponding to the domain name; receive, after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise: encrypted data, and respective packet headers comprising second unencrypted data; determine, without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name; based on determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, filter the plurality of second packets based on the first packet-filtering rule; determine, based on the logged indication of the one or more actions or the logged indication of the first packet-filtering rule, to apply a first action corresponding to the first packet-filtering rule; and send at least a portion of the filtered plurality of second packets to a proxy configured to perform the first action corresponding to the first packet-filtering rule. ### Claim 12 (depends on 11) The one or more non-transitory computer-readable media of claim 11, wherein the instructions, when executed by the at least one processor, cause the packet-filtering system to determine to apply the first action by causing the packet-filtering system to select, from the one or more actions, the first action. ### Claim 13 (depends on 11) The one or more non-transitory computer-readable media of claim 11, wherein the log data comprises the logged indication of the first packet-filtering rule, and wherein the instructions, when executed by the at least one processor, cause the packet-filtering system to determine, based on the logged indication of the first packet-filtering rule, the first action. ### Claim 14 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the first action comprises dropping, by the proxy, the at least the portion of the filtered plurality of second packets. ### Claim 15 (depends on 11) The one or more non-transitory computer-readable media of claim 11, wherein the plurality of first packets comprises the IP address. ### Claim 16 (depends on 11) The one or more non-transitory computer-readable media of claim 11, wherein the plurality of first packets comprises a Domain Name System (DNS) query comprising the domain name. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the DNS query comprises the IP address corresponding to the domain name. ### Claim 18 (depends on 11) The one or more non-transitory computer-readable media of claim 11, wherein the plurality of first packets comprise a certificate message for the encrypted communication session, and wherein the first action comprises: at least one of dropping or logging one or more of the plurality of second packets based on a determination that the certificate message comprises data indicating at least one of: a serial number indicated by the first packet-filtering rule, an issuer indicated by the first packet-filtering rule, a validity time-range indicated by the first packet-filtering rule, a key indicated by the first packet-filtering rule, or a signing authority indicated by the first packet-filtering rule. ### Claim 19 (depends on 11) The one or more non-transitory computer-readable media of claim 11, wherein the first action is based on at least one of: a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule, data indicating a protocol version specified by the first packet-filtering rule, data indicating a method specified by the first packet-filtering rule, data indicating a request specified by the first packet-filtering rule, or data indicating a command specified by the first packet-filtering rule. ### Claim 20 A packet-filtering apparatus comprising: at least one processor configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules; and memory storing instructions that when executed by the at least one processor cause the packet-filtering apparatus to: receive, from a rule provider device, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat indicators received from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat; receive a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data; determine that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria; generate, based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating: an indication of one or more actions or an indication of the first packet-filtering rule; and an Internet Protocol (IP) address corresponding to the domain name; receive, after the generating the log data, a plurality of second packets of an encrypted communication session, wherein the plurality of second packets traverse the communications link and comprise: encrypted data, and respective packet headers comprising second unencrypted data; determine, without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name; based on determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, filter the plurality of second packets based on the first packet-filtering rule; determine, based on the logged indication of the one or more actions or the logged indication of the first packet-filtering rule, to apply a first action corresponding to the first packet-filtering rule; and send at least a portion of the filtered plurality of second packets to a proxy configured to perform the first action corresponding to the first packet-filtering rule. ### Claim 21 (depends on 20) The packet-filtering apparatus of claim 20, wherein the instructions, when executed by the at least one processor, cause the packet-filtering apparatus to determine to apply the first action by causing the packet-filtering apparatus to select, from the one or more actions, the first action. ### Claim 22 (depends on 20) The packet-filtering apparatus of claim 20, wherein the log data comprises the logged indication of the first packet-filtering rule, and wherein the instructions, when executed by the at least one processor, cause the packet-filtering apparatus to determine, based on the logged indication of the first packet-filtering rule, the first action. ### Claim 23 (depends on 22) The packet-filtering apparatus of claim 22, wherein the first action comprises dropping, by the proxy, the at least the portion of the filtered plurality of second packets. ### Claim 24 (depends on 20) The packet-filtering apparatus of claim 20, wherein the plurality of first packets comprises the IP address. ### Claim 25 (depends on 20) The packet-filtering apparatus of claim 20, wherein the plurality of first packets comprises a Domain Name System (DNS) query comprising the domain name. ### Claim 26 (depends on 25) The packet-filtering apparatus of claim 25, wherein the DNS query comprises the IP address corresponding to the domain name. ### Claim 27 (depends on 20) The packet-filtering apparatus of claim 20, wherein the plurality of first packets comprise a certificate message for the encrypted communication session, and wherein the first action comprises: at least one of dropping or logging one or more of the plurality of second packets based on a determination that the certificate message comprises data indicating at least one of: a serial number indicated by the first packet-filtering rule, an issuer indicated by the first packet-filtering rule, a validity time-range indicated by the first packet-filtering rule, a key indicated by the first packet-filtering rule, or a signing authority indicated by the first packet-filtering rule. ### Claim 28 (depends on 20) The packet-filtering apparatus of claim 20, wherein the first action is based on at least one of: a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule, data indicating a protocol version specified by the first packet-filtering rule, data indicating a method specified by the first packet-filtering rule, data indicating a request specified by the first packet-filtering rule, or data indicating a command specified by the first packet-filtering rule.