Correlating packets in communications networks

A method comprising

• determining, by a packet-filtering device, a first plurality of log entries corresponding to a first plurality of packets received by a network device from a first host located in a first network;
• determining, by the packet-filtering device, a second plurality of log entries corresponding to a second plurality of packets transmitted by the network device to a second host located in a second network;
• detecting, by the packet-filtering device and based on the first plurality of log entries and the second plurality of log entries, a correlation between one or more packets of the first plurality of packets and one or more packets of the second plurality of packets by:
• comparing the first plurality of log entries with the second plurality of log entries based on one or more of:
• an ingress identifier,
• an egress identifier,
• network-layer information,
• transport-layer information, or
• application-layer information;
• and
• determining, based on the comparing, the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets;
• determining, based on the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets, whether one of the first host or the second host are associated with potentially malicious activity by determining that at least one of the one or more packets of the first plurality of packets or at least one of the one or more packets of the second plurality of packets indicate potentially malicious activity;
• generating, in response to determining that one of the first host or the second host are associated with the potentially malicious activity, one or more rules configured to identify packets associated with both of the first host or the second host;
• and
• provisioning one or more devices with the one or more rules.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors of a packet-filtering device, cause the packet-filtering device to:

• determine a first plurality of log entries corresponding to a first plurality of packets received by a network device from a first host located in a first network;
• determine a second plurality of log entries corresponding to a second plurality of packets transmitted by the network device to a second host located in a second network;
• detect, based on the first plurality of log entries and the second plurality of log entries, a correlation between one or more packets of the first plurality of packets and one or more packets of the second plurality of packets by:
• comparing the first plurality of log entries with the second plurality of log entries based on one or more of:
• an ingress identifier,
• an egress identifier,
• network-layer information,
• transport-layer information, or
• application-layer information;
• and
• determining, based on the comparing, the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets;
• determine, based on the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets, whether one of the first host or the second host are associated with potentially malicious activity by determining that at least one of the one or more packets of the first plurality of packets or at least one of the one or more packets of the second plurality of packets indicate potentially malicious activity;
• generate, in response to determining that one of the first host or the second host are associated with the potentially malicious activity, one or more rules configured to identify packets associated with both of the first host or the second host;
• and
• provision one or more devices with the one or more rules.