Rule-based network-threat detection

A method configured to minimize latency between when a packet corresponding to a network threat crosses a boundary between a protected network and an unprotected network and when the network threat is included in an ordered list of network threats, the method comprising:

• receiving, by a packet-filtering device providing an interface across the boundary, a plurality of packet-filtering rules to be applied, by the packet-filtering device, to all network traffic traversing the boundary, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address that has been previously determined, by one or more of the plurality of independent network-threat-intelligence providers, to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• receiving a first packet crossing the boundary between the protected network and the unprotected network;
• filtering the first packet based on comparing the first packet to packet-matching criteria specified by the plurality of packet-filtering rules, wherein filtering the first packet comprises determining that the first packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• responsive to a determination that the filtered first packet matches the first packet-matching criteria of the first packet-filtering rule, and when the filtered first packet corresponding to the first potential network threat is filtered by the packet-filtering device, generating:
• a first log entry corresponding to the first potential network threat, and
• a first score for the first potential network threat based on information associated with the first potential network threat;
• causing at least a portion of the first log entry to be added to the ordered list of network threats by sending, to a second device, the first log entry, wherein an ordering of the ordered list of network threats is determined based on the first score for the first potential network threat;
• receiving, from the second device, an update configured to cause the packet-filtering device to reconfigure the first packet-filtering rule to affect scoring of network threats associated with the first packet-filtering rule;
• receiving a second packet crossing the boundary between the protected network and the unprotected network;
• filtering the second packet based on the reconfigured first packet-filtering rule, wherein filtering the second packet comprises determining that the second packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• generating, based on the filtering the second packet and based on the reconfigured first packet-filtering rule:
• a second log entry corresponding to the first potential network threat, and
• a second score for the first potential network threat different from the first score;
• causing a modification to the ordering of the ordered list of network threats based on the first score and the second score;
• and
• causing display of the ordered list of network threats.

A method configured to minimize latency between when a packet corresponding to a network threat crosses a boundary between a protected network and an unprotected network and when the network threat is included in an ordered list of network threats, the method comprising:

• receiving, by a packet-filtering device providing an interface across the boundary, a plurality of packet-filtering rules to be applied, by the packet-filtering device, to all network traffic traversing the boundary, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address that has been previously determined, by one or more of the plurality of independent network-threat-intelligence providers, to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• receiving a first packet crossing the boundary between the protected network and the unprotected network, wherein the first packet is part of a first packet flow;
• filtering the first packet based on comparing the first packet to packet-matching criteria specified by the plurality of packet-filtering rules, wherein filtering the first packet comprises determining that the first packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• responsive to a determination that the filtered first packet matches the first packet-matching criteria of the first packet-filtering rule, and when the filtered first packet corresponding to the first potential network threat is filtered by the packet-filtering device, generating:
• a first log entry corresponding to the first potential network threat, and
• a first score for the first potential network threat based on information associated with the first potential network threat;
• causing at least a portion of the first log entry to be added to the ordered list of network threats by sending, to a second device, the first log entry, wherein an ordering of the ordered list of network threats is determined based on the first score for the first potential network threat;
• modifying, based on the first log entry and the first score, a flow log entry corresponding to the first potential network threat;
• receiving, from the second device, an update configured to cause the packet-filtering device to reconfigure the first packet-filtering rule to affect scoring of network threats associated with the first packet-filtering rule;
• receiving a second packet crossing the boundary between the protected network and the unprotected network, wherein the second packet is part of the first packet flow;
• filtering the second packet based on the reconfigured first packet-filtering rule, wherein filtering the second packet comprises determining that the second packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• generating, based on the filtering the second packet and based on the reconfigured first packet-filtering rule, a second log entry corresponding to the first potential network threat, wherein the second log entry corresponds to a second score different from the first score;
• causing a modification to the ordering of the ordered list of network threats based on the first score and the second score;
• and
• modifying, based on the second log entry and the second score, the flow log entry corresponding to the first potential network threat.

One or more non-transitory computer-readable media storing instructions configured to minimize latency between when a packet corresponding to a network threat crosses a boundary between a protected network and an unprotected network and when the network threat is included in an ordered list of network threats, wherein the instructions, when executed by one or more processors of a packet-filtering device providing an interface across the boundary, cause the packet-filtering device to:

• receive, from a second device, a plurality of packet-filtering rules to be applied, by the packet-filtering device, to all network traffic traversing the boundary, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address that has been previously determined, by one or more of the plurality of independent network-threat-intelligence providers, to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• receive a first packet crossing the boundary between the protected network and the unprotected network;
• filter the first packet based on comparing the first packet to packet-matching criteria specified by the plurality of packet-filtering rules, wherein filtering the first packet comprises determining that the first packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• responsive to a determination that the filtered first packet matches the first packet-matching criteria of the first packet-filtering rule, and when the filtered first packet corresponding to the first potential network threat is filtered by the packet-filtering device, generate:
• a first log entry corresponding to the first potential network threat, and
• a first score for the first potential network threat based on information associated with the first potential network threat;
• send, to the second device, the first log entry;
• cause the first log entry to be added to the ordered list of network threats, wherein an ordering of the ordered list of network threats is determined based on the first score for the first potential network threat;
• receive, from the second device, an update configured to cause the packet-filtering device to reconfigure the first packet-filtering rule to affect scoring of network threats associated with the first packet-filtering rule;
• receive a second packet crossing the boundary between the protected network and the unprotected network;
• filter the second packet based on the reconfigured first packet-filtering rule, wherein filtering the second packet comprises determining that the second packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• generate, based on the filtering the second packet and based on the reconfigured first packet-filtering rule:
• a second log entry corresponding to the first potential network threat, and
• a second score for the first potential network threat different from the first score;
• cause a modification to the ordering of the ordered list of network threats based on the first score and the second score;
• and
• cause display of the ordered list of network threats.

One or more non-transitory computer-readable media storing instructions configured to minimize latency between when a packet corresponding to a network threat crosses a boundary between a protected network and an unprotected network and when the network threat is included in an ordered list of network threats, wherein the instructions, when executed by one or more processors of a packet-filtering device providing an interface across the boundary, cause the packet-filtering device to:

• receive a plurality of packet-filtering rules to be applied, by the packet-filtering device, to all network traffic traversing the boundary, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address that has been previously determined, by one or more of the plurality of independent network-threat-intelligence providers, to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• receive a first packet crossing the boundary between the protected network and the unprotected network;
• filter the first packet based on comparing the first packet to packet-matching criteria specified by the plurality of packet-filtering rules, wherein filtering the first packet comprises determining that the first packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• responsive to a determination that the filtered first packet matches the first packet-matching criteria of the first packet-filtering rule, and when the filtered first packet corresponding to the first potential network threat is filtered by the packet-filtering device, generate:
• a first log entry corresponding to the first potential network threat, and
• a first score for the first potential network threat based on information associated with the first potential network threat;
• cause at least a portion of the first log entry to be added to the ordered list of network threats by sending, to a second device, the first log entry, wherein an ordering of the ordered list of network threats is determined based on the first score for the first potential network threat;
• receive, from the second device, an update configured to cause the packet-filtering device to reconfigure the first packet-filtering rule to affect scoring of network threats associated with the first packet-filtering rule;
• receive a second packet crossing the boundary between the protected network and the unprotected network;
• filter the second packet based on the reconfigured first packet-filtering rule, wherein filtering the second packet comprises determining that the second packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• generate, based on the filtering the second packet and based on the reconfigured first packet-filtering rule:
• a second log entry corresponding to the first potential network threat, and
• a second score for the first potential network threat different from the first score;
• cause a modification to the ordering of the ordered list of network threats based on the first score and the second score;
• and
• cause display of the ordered list of network threats.

One or more non-transitory computer-readable media storing instructions configured to minimize latency between when a packet corresponding to a network threat crosses a boundary between a protected network and an unprotected network and when the network threat is included in an ordered list of network threats, wherein the instructions, when executed by one or more processors of a packet-filtering device providing an interface across the boundary, cause the packet-filtering device to:

• receive a plurality of packet-filtering rules to be applied, by the packet-filtering device, to all network traffic traversing the boundary, wherein the plurality of packet-filtering rules were generated based on a plurality of network-threat-intelligence reports supplied by a plurality of independent network-threat-intelligence providers, wherein each network-threat-intelligence report comprises one or more network threat indicators each comprising at least one respective network address that has been previously determined, by one or more of the plurality of independent network-threat-intelligence providers, to be associated with a potential network threat, and wherein a first packet-filtering rule of the plurality of packet-filtering rules specifies one or more first packet-matching criteria corresponding to one or more first network-threat indicators associated with a first potential network threat;
• receive a first packet crossing the boundary between the protected network and the unprotected network, wherein the first packet is part of a first packet flow;
• filter the first packet based on comparing the first packet to packet-matching criteria specified by the plurality of packet-filtering rules, wherein filtering the first packet comprises determining that the first packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• responsive to a determination that the filtered first packet matches the first packet-matching criteria of the first packet-filtering rule, and when the filtered first packet corresponding to the first potential network threat is filtered by the packet-filtering device, generate:
• a first log entry corresponding to the first potential network threat, and
• a first score for the first potential network threat based on information associated with the first potential network threat;
• cause at least a portion of the first log entry to be added to the ordered list of network threats by sending, to a second device, the first log entry, wherein an ordering of the ordered list of network threats is determined based on the first score for the first potential network threat;
• modify, based on the first log entry and the first score, a flow log entry corresponding to the first potential network threat;
• receive, from the second device, an update configured to cause the packet-filtering device to reconfigure the first packet-filtering rule to affect scoring of network threats associated with the first packet-filtering rule;
• receive a second packet crossing the boundary between the protected network and the unprotected network, wherein the second packet is part of the first packet flow;
• filter the second packet based on the reconfigured first packet-filtering rule, wherein filtering the second packet comprises determining that the second packet corresponds to the one or more first network-threat indicators associated with the first potential network threat;
• generate, based on the filtering the second packet and based on the reconfigured first packet-filtering rule, a second log entry corresponding to the first potential network threat, wherein the second log entry corresponds to a second score different from the first score;
• cause a modification to the ordering of the ordered list of network threats based on the first score and the second score;
• and
• modify, based on the second log entry and the second score, the flow log entry corresponding to the first potential network threat.