Methods and systems for efficient packet filtering

A method comprising:

• receiving, by a packet gateway located at a boundary between a protected network and an unprotected network, a plurality of packets;
• testing, by the packet gateway and for each packet of the plurality of packets, at least one policy probabilistic data structure representing a security policy to determine whether each packet of the plurality of packets is associated with at least one rule of the security policy, wherein the security policy comprises a plurality of packet filtering rules;
• based on a determination that a first packet of the plurality of packets matches at least one packet matching criterion associated with the at least one policy probabilistic data structure, determining at least one of a plurality of policy subset probabilistic data structures;
• testing, for the first packet, the at least one of the plurality of policy subset probabilistic data structures;
• and
• based on the testing the at least one of the plurality of policy subset probabilistic data structures, filtering the first packet.

A method comprising:

• receiving, by a packet gateway, a plurality of packets;
• determining, based on packet header information, whether each of the plurality of packets comprises a Domain Name System (DNS) query request;
• based on a determination that a first packet of the plurality of packets comprises a first DNS query request, testing a DNS probabilistic data structure to determine if the first DNS query request is associated with a legitimate DNS query request;
• and
• based on a determination that the first packet of the plurality of packets does not comprise a legitimate DNS query request, dropping the first DNS query request.