# US 12,603,862 B2 · Methods and systems for efficient adaptive logging of cyber threat incidents > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,862 B2 - Document ID: US12603862B2 - Status: Granted - Kind: B2 - Application number: 18/820,959 - Filed: 2024-08-30 - Published: 2025-07-31 - Granted: 2026-04-14 - Earliest claimed: 2020-10-27 - Assignees: Centripetal Networks, Inc. - Applicants: Centripetal Networks, LLC - Inventors: John Fenton; Peter Geremia; Richard Goodwin; Sean Moore; Vincent Mutolo; Jess P. Parnell; Jonathan R. Rogers - Web page: https://patentgrep.com/patent/US12603862B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A packet-filtering network appliance such as a threat intelligence gateway (TIG) protects TCP/IP networks from Internet threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies are composed of packet filtering rules derived from cyber threat intelligence (CTI). Logs of rule-matching packets and their associated flows are sent to cyberanalysis applications located at security operations centers (SOCs) and operated by cyberanalysts. Some cyber threats/attacks, or incidents, are composed of many different flows occurring at a very high rate, which generates a flood of logs that may overwhelm computer, storage, network, and cyberanalysis resources, thereby compromising cyber defenses. The present disclosure describes incident logging, in which a single incident log efficiently incorporates the logs of the many flows that comprise the incident, thereby potentially reducing resource consumption while improving the informational/cyberanalytical value of the incident log for cyberanalysis when compared to the component flow logs. Incident logging vs. flow logging can be automatically and adaptively switched on or off depending on the combination of resource consumption and informational/cyberanalytical value. ## Claims ### Claim 1 A packet-filtering device comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the packet-filtering device to: receive a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein each of the plurality of packet-filtering rules was generated based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of cyber threat intelligence reports comprises the plurality of threat indicators, and wherein the plurality of threat indicators identify a plurality of subnet addresses; determine that a received first plurality of packets, associated with a first plurality of flows, matches at least one of the plurality of packet-filtering rules; based on determining that the first plurality of packets matches at least one of the plurality of packet-filtering rules, determine that the first plurality of packets originate from one or more of the identified subnet addresses; based on determining that the first plurality of packets originate from one or more of the identified subnet addresses, generate first flow log data comprising information about the first plurality of flows; send the first flow log data to another device; identify, based on determining that a flow logging rate satisfies a threshold flow logging rate, an incident associated with at least some of the first plurality of flows; determine that a received second plurality of packets, associated with a second plurality of flows, matches at least one of the plurality of packet-filtering rules; based on determining that the second plurality of packets matches at least one of the plurality of packet-filtering rules, determine that the second plurality of packets originate from one or more of the identified subnet addresses; based on determining that the second plurality of packets originate from one or more of the identified subnet addresses, generate incident log data associating the incident with the second plurality of flows; and send, to another device, the incident log data in lieu of second flow log data for the second plurality of flows. ### Claim 2 (depends on 1) The packet-filtering device of claim 1, wherein the incident log data indicates a start time of the incident. ### Claim 3 (depends on 1) The packet-filtering device of claim 1, wherein the incident log data indicates one or both of a flow volume or a flow rate associated with the incident. ### Claim 4 (depends on 1) The packet-filtering device of claim 1, wherein determining that the flow logging rate satisfies the threshold flow logging rate comprises determining that the flow logging rate exceeds the threshold flow logging rate. ### Claim 5 (depends on 1) The packet-filtering device of claim 1, wherein determining that the first plurality of packets originate from one or more of the identified subnet addresses comprises determining that the first plurality of packets originate from multiple subnet addresses of the identified subnet addresses. ### Claim 6 (depends on 1) The packet-filtering device of claim 1, wherein the instructions, when executed by the one or more processors, further cause the packet-filtering device to: determine a key associated with the incident and based on the one or more of the plurality of subnet addresses from which the first plurality of packets originate, wherein the incident log data comprises the key. ### Claim 7 (depends on 1) The packet-filtering device of claim 1, wherein the instructions, when executed by the one or more processors, further cause the packet-filtering device to: determine a key based on hashing one or more values associated with at least one flow of the second plurality of flows, wherein the incident log data comprises the key. ### Claim 8 A non-transitory computer-readable medium storing instructions that, when executed, configure a packet-filtering device to: receive a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein each of the plurality of packet-filtering rules was generated based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of cyber threat intelligence reports comprises the plurality of threat indicators, and wherein the plurality of threat indicators identify a plurality of subnet addresses; determine that a received first plurality of packets, associated with a first plurality of flows, matches at least one of the plurality of packet-filtering rules; based on determining that the first plurality of packets matches at least one of the plurality of packet-filtering rules, determine that the first plurality of packets originate from one or more of the identified subnet addresses; based on determining that the first plurality of packets originate from one or more of the identified subnet addresses, generate first flow log data comprising information about the first plurality of flows; send the first flow log data to another device; identify, based on determining that a flow logging rate satisfies a threshold flow logging rate, an incident associated with at least some of the first plurality of flows; determine that a received second plurality of packets, associated with a second plurality of flows, matches at least one of the plurality of packet-filtering rules; based on determining that the second plurality of packets matches at least one of the plurality of packet-filtering rules, determine that the second plurality of packets originate from one or more of the identified subnet addresses; based on determining that the second plurality of packets originate from one or more of the identified subnet addresses, generate incident log data associating the incident with the second plurality of flows; and send, to another device, the incident log data in lieu of second flow log data for the second plurality of flows. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the incident log data indicates a start time of the incident. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the incident log data indicates one or both of a flow volume or a flow rate associated with the incident. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein determining that the flow logging rate satisfies the threshold flow logging rate comprises determining that the flow logging rate exceeds the threshold flow logging rate. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein determining that the first plurality of packets originate from one or more of the identified subnet addresses comprises determining that the first plurality of packets originate from multiple subnet addresses of the identified subnet addresses. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed, further configure the packet-filtering device to: determine a key associated with the incident and based on the one or more of the plurality of subnet addresses from which the first plurality of packets originate, wherein the incident log data comprises the key. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions, when executed, further configure the packet-filtering device to: determine a key based on hashing one or more values associated with at least one flow of the second plurality of flows, wherein the incident log data comprises the key. ### Claim 15 A method performed by a packet-filtering device, the method comprising: receiving a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein each of the plurality of packet-filtering rules was generated based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of cyber threat intelligence reports comprises the plurality of threat indicators, and wherein the plurality of threat indicators identify a plurality of subnet addresses; determining that a received first plurality of packets, associated with a first plurality of flows, matches at least one of the plurality of packet-filtering rules; based on determining that the first plurality of packets matches at least one of the plurality of packet-filtering rules, determining that the first plurality of packets originate from one or more of the identified subnet addresses; based on determining that the first plurality of packets originate from one or more of the identified subnet addresses, generating first flow log data comprising information about the first plurality of flows; sending the first flow log data to another device; identifying, based on determining that a flow logging rate satisfies a threshold flow logging rate, an incident associated with at least some of the first plurality of flows; determining that a received second plurality of packets, associated with a second plurality of flows, matches at least one of the plurality of packet-filtering rules; based on determining that the second plurality of packets matches at least one of the plurality of packet-filtering rules, determining that the second plurality of packets originate from one or more of the identified subnet addresses; based on determining that the second plurality of packets originate from one or more of the identified subnet addresses, generating incident log data associating the incident with the second plurality of flows; and sending, to another device, the incident log data in lieu of second flow log data for the second plurality of flows. ### Claim 16 (depends on 15) The method of claim 15, wherein the incident log data indicates a start time of the incident. ### Claim 17 (depends on 15) The method of claim 15, wherein the incident log data indicates one or both of a flow volume or a flow rate associated with the incident. ### Claim 18 (depends on 15) The method of claim 15, wherein determining that the first plurality of packets originate from one or more of the identified subnet addresses comprises determining that the first plurality of packets originate from multiple subnet addresses of the identified subnet addresses. ### Claim 19 (depends on 15) The method of claim 15, further comprising: determining a key associated with the incident and based on the one or more of the plurality of subnet addresses from which the first plurality of packets originate, wherein the incident log data comprises the key. ### Claim 20 (depends on 15) The method of claim 15, further comprising: determining a key based on hashing one or more values associated with at least one flow of the second plurality of flows, wherein the incident log data comprises the key.