US 2026/0312934 A1 · INLINE MULTI-STAGE ATTACK DETECTION AND PREVENTION

Abstract

A firewall is configured with a rule(s) for filtering network traffic that, if matched, triggers forwarding of the network traffic to a multi-stage attack detector. The detector extracts designated data/metadata therefrom and stores the data/metadata in association with a unique identifier. Assuming a benign verdict for the first communication, the detector returns to the firewall the benign verdict and a temporary forwarding rule that specifies network traffic characteristics indicative of a potential multi-stage attack in subsequent communications and includes the unique identifier. The firewall forwards network traffic that matches the temporary forwarding rule and an indication of the identifier to the detector, which correlates data/metadata extracted from the network traffic with the previously extracted data/metadata associated with the identifier and evaluates the correlated data/metadata based on a multi-stage attack detection rule(s). If the correlated data/metadata satisfy a detection rule, the detector returns a malicious verdict to the firewall.

Claims20

Dependent claims

A method comprising:

based on obtaining first network traffic detected by a cybersecurity appliance, extracting first network traffic characteristics from the first network traffic and associating the extracted first network traffic characteristics with a unique identifier;
configuring a temporary forwarding rule for the cybersecurity appliance based on the extracted first network traffic characteristics, wherein the temporary forwarding rule comprises the unique identifier as metadata;
based on obtaining second network traffic in association with an indication of the unique identifier, extracting second network traffic characteristics from the second network traffic;
correlating the first network traffic characteristics and the second network traffic characteristics based on the unique identifier;
determining if the correlated first and second network traffic characteristics any of one or more rules for detecting multi-stage attacks;
and
based on determining that the correlated first and second network traffic characteristics satisfy a first of the one or more rules for detecting multi-stage attacks, indicating a malicious verdict for the second network traffic.

4 more elements

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:

extract at least one of first data and first metadata from first network traffic detected by a cybersecurity appliance and associate the extracted at least one of first data and first metadata with a unique identifier;
create a temporary forwarding rule for the cybersecurity appliance based on the extracted at least one of first data and first metadata, wherein the temporary forwarding rule comprises the unique identifier as metadata;
based on detection of second network traffic that matched the temporary forwarding rule, extract at least one of second data and second metadata from the second network traffic;
correlate the at least one of the first data and the first metadata with the at least one of the second data and the second metadata based on the unique identifier;
determine whether the correlated at least one of first data and first metadata and at least one of second data and second metadata satisfy any of one or more rules for detecting multi-stage attacks;
and
based on a determination that the correlated at least one of first data and first metadata and at least one of second data and second metadata satisfy a first of the one or more rules for detecting multi-stage attacks, indicate a malicious verdict for the second network traffic.

4 more elements

A system comprising:

an apparatus comprising,
a first processor;
and
a first machine-readable medium having instructions stored thereon that are executable by the first processor to cause the apparatus to,
based on detection of first network traffic, extract first network traffic characteristics from the first network traffic and associate the extracted first network traffic characteristics with a unique identifier;
create a temporary forwarding rule for a cybersecurity appliance based on the extracted first network traffic characteristics, wherein the temporary forwarding rule comprises the unique identifier as metadata;
based on detection of second network traffic in association with an indication of the unique identifier, extract second network traffic characteristics from the second network traffic;
correlate the first network traffic characteristics and the second network traffic characteristics based on the unique identifier;
determine if the correlated first and second network traffic characteristics any of one or more rules for detecting multi-stage attacks;
and
based on a determination that the correlated first and second network traffic characteristics satisfy a first of the one or more rules for detecting multi-stage attacks, indicate a malicious verdict for the second network traffic.

8 more elements

Dependencies are inferred from the claim text.

Inline multi-stage attack detection and prevention

Life of this patent

Inline multi-stage attack detection and prevention

Life of this patent

Abstract

Claims20