Back to results
US 12,592,947 B2Granted
Systems and methods for cyber threat detection based on new and/or updated cyber threat intelligence
AssigneeCentripetal Networks, Inc.
InventorsDavid K. Ahn, Jess P. Parnell, Cody Michael Baker
Life of this patent
Estimating the term…
Abstract
Systems, methods, and apparatuses are described for detection and/or analysis of cyber threats based on updated cyber threat intelligence associated with cyber threats. Packet filtering output data such as logs of packet communications and/or copies of packets may be generated based on first cyber threat intelligence associated with a cyber threat. Updated criteria based on subsequent updated cyber threat intelligence may then be applied to the packet filtering output data.
Claims20
A method for use with data received from one or more packet security gateways configured to apply packet matching criteria of packet filtering rules to network traffic traversing the one or more packet security gateways while in-transit between a protected network and an unprotected network, comprising:
- receiving, by a cyber threat analysis system comprising one or more servers, cyber threat intelligence data indicating a plurality of cyber threats, wherein the received cyber threat intelligence data comprises first cyber threat intelligence data that originated at a time prior to a beginning of a first time period and that indicates a first cyber threat of the plurality of cyber threats;
- receiving, by the cyber threat analysis system and from the one or more packet security gateways, data comprising:
- packet logs corresponding to packets filtered by the one or more packet security gateways based on the packet filtering rules, wherein the filtered packets comprise packets from network traffic traversing the one or more packet security gateways during the first time period, wherein the packet logs comprise network threat indicators matching criteria of the packet filtering rules, and wherein the criteria of the packet filtering rules are based on the cyber threat intelligence data, and
- captured packets comprising copies of at least a portion of the filtered packets;
- receiving, by the cyber threat analysis system, second cyber threat intelligence data that originated at a time after the beginning of the first time period;
- determining, by the cyber threat analysis system, based on the second cyber threat intelligence data potentially corresponding to the first cyber threat, updated criteria;
- identifying, by the cyber threat analysis system, a subset of the packet logs associated with the first cyber threat and a subset of the captured packets associated with the first cyber threat;
- generating, by the cyber threat analysis system and by applying the updated criteria to at least one of the subset of the packet logs or the subset of the captured packets, an updated set of packet logs associated with the first cyber threat;
- and
- outputting, by the cyber threat analysis system and based on the updated set of packet logs, one or more indications associated with the first cyber threat.
7 more elements
A cyber threat analysis system comprising one or more servers, wherein the one or more servers are configured to:
- receive cyber threat intelligence data indicating a plurality of cyber threats, wherein the received cyber threat intelligence data comprises first cyber threat intelligence data that originated at a time prior to a beginning of a first time period and that indicates a first cyber threat of the plurality of cyber threats;
- receive, from one or more packet security gateways configured to apply packet matching criteria of packet filtering rules to network traffic traversing the one or more packet security gateways while in-transit between a protected network and an unprotected network, data comprising:
- packet logs corresponding to packets filtered by the one or more packet security gateways based on the packet filtering rules, wherein the filtered packets comprise packets from network traffic traversing the one or more packet security gateways during the first time period, wherein the packet logs comprise network threat indicators matching criteria of the packet filtering rules, and wherein the criteria of the packet filtering rules are based on the cyber threat intelligence data, and
- captured packets comprising copies of at least a portion of the filtered packets;
- receive second cyber threat intelligence data that originated at a time after the beginning of the first time period;
- determine, based on the second cyber threat intelligence data potentially corresponding to the first cyber threat, updated criteria;
- identify a subset of the packet logs associated with the first cyber threat and a subset of the captured packets associated with the first cyber threat;
- generate, by applying the updated criteria to at least one of the subset of the packet logs or the subset of the captured packets, an updated set of packet logs associated with the first cyber threat;
- and
- output, by the cyber threat analysis system and based on the updated set of packet logs, one or more indications associated with the first cyber threat.
7 more elements
One or more non-transitory computer-readable media comprising stored instructions that, when executed by one or more processors of a cyber threat analysis system, cause the cyber threat analysis system to:
- receive cyber threat intelligence data indicating a plurality of cyber threats, wherein the received cyber threat intelligence data comprises first cyber threat intelligence data that originated at a time prior to a beginning of a first time period and that indicates a first cyber threat of the plurality of cyber threats;
- receive, from one or more packet security gateways configured to apply packet matching criteria of packet filtering rules to network traffic traversing the one or more packet security gateways while in-transit between a protected network and an unprotected network, data comprising:
- packet logs corresponding to packets filtered by the one or more packet security gateways based on the packet filtering rules, wherein the filtered packets comprise packets from network traffic traversing the one or more packet security gateways during the first time period, wherein the packet logs comprise network threat indicators matching criteria of the packet filtering rules, and wherein the criteria of the packet filtering rules are based on the cyber threat intelligence data, and
- captured packets comprising copies of at least a portion of the filtered packets;
- receive second cyber threat intelligence data that originated at a time after the beginning of the first time period;
- determine, based on the second cyber threat intelligence data potentially corresponding to the first cyber threat, updated criteria;
- identify a subset of the packet logs associated with the first cyber threat and a subset of the captured packets associated with the first cyber threat;
- generate, by applying the updated criteria to at least one of the subset of the packet logs or the subset of the captured packets, an updated set of packet logs associated with the first cyber threat;
- and
- output, by the cyber threat analysis system and based on the updated set of packet logs, one or more indications associated with the first cyber threat.
7 more elements
Dependencies are inferred from the claim text.