Methods and Systems for Efficient Encrypted SNI Filtering for Cybersecurity Applications

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause a packet filtering device to:

• receive one or more policies comprising a plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on one or more network threat indicators comprising a plurality of domain names associated with one or more threats;
• receive, from a first device, a plurality of packets, wherein the plurality of packets comprises ciphertext comprising an encrypted server name indication (eSNI) value;
• determine whether a plaintext hostname is resolvable from the ciphertext;
• determine, based on a determination that the plaintext hostname is resolvable from the ciphertext, whether the plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats;
• and
• apply, based on a determination that the plaintext hostname matches a first domain name indicated by a first packet-filtering rule of the plurality of packet-filtering rules, a packet filtering operation to the plurality of packets.

A method comprising:

• receiving, by a packet filtering device, one or more policies comprising a plurality of packet-filtering rules, wherein the plurality of packet-filtering rules were generated based on one or more network threat indicators comprising a plurality of domain names associated with one or more threats;
• receiving, from a first device, a plurality of packets, wherein the plurality of packets comprises ciphertext comprising an encrypted server name indication (eSNI) value;
• determining whether a plaintext hostname is resolvable from the ciphertext;
• determining, based on a determination that the plaintext hostname is resolvable from the ciphertext, whether the plaintext hostname matches at least one domain name of the plurality of domain names associated with one or more threats;
• and
• applying, based on a determination that the plaintext hostname matches a first domain name indicated by a first packet-filtering rule of the plurality of packet-filtering rules, a packet filtering operation to the plurality of packets.