Rule-based network-threat detection

A packet-filtering device comprising:

• at least one processor;
• and
• a memory storing instructions that when executed by the at least one processor cause the packet-filtering device to:
• receive a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of network-threat indicators;
• receive a plurality of packets, wherein the plurality of packets comprises a first packet and a second packet;
• responsive to a determination that the first packet corresponds to one or more criteria, specified by a packet-filtering rule of the plurality of packet-filtering rules, that correspond to one or more network-threat indicators of the plurality of network-threat indicators:
• apply, to the first packet, an operator specified by the packet-filtering rule and configured to cause the packet-filtering device to either prevent the first packet from continuing toward a destination of the first packet or allow the first packet to continue toward the destination of the first packet;
• generate a packet-log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and indicating whether the packet-filtering device prevented the first packet from continuing toward the destination of the first packet or allowed the first packet to continue toward the destination of the first packet;
• generate, based on the packet-log entry, data indicating whether the packet-filtering device prevented the first packet from continuing toward the destination of the first packet or allowed the first packet to continue toward the destination of the first packet;
• communicate, to a user device, the data;
• and
• causing, based on the communicated data and in an interface, display of the data indicating whether the packet-filtering device prevented the first packet from continuing toward the destination of the first packet or allowed the first packet to continue toward the destination of the first packet;
• and
• determine, by the packet-filtering device and based on a plurality of network-threat-intelligence reports produced by one or more network-threat-intelligence providers, an ordering of a plurality of network threats,
• wherein a first network threat of the plurality of network threats corresponds to a first packet-filtering rule, the first packet-filtering rule based on one or more network-threat indicators included in a first portion of the plurality of network-threat-intelligence reports,
• a second network threat of the plurality of network threats corresponds to a second packet-filtering rule, the second packet-filtering rule based on one or more network-threat indicators included in a second portion of the plurality of network-threat-intelligence reports, and
• determining the ordering comprises determining an order of the first network threat relative to the second network threat based on a determination that of whether the first portion of the plurality of network-threat-intelligence reports was received from a greater number of the one or more network-threat-intelligence providers than the second portion of the plurality of network-threat-intelligence reports.

One or more non-transitory computer-readable media comprising instructions that when executed by at least one processor of a packet-filtering device cause the packet-filtering device to:

• receive a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of network-threat indicators;
• receive a plurality of packets, wherein the plurality of packets comprises a first packet and a second packet;
• responsive to a determination that the first packet corresponds to one or more criteria, specified by a packet-filtering rule of the plurality of packet-filtering rules, that correspond to one or more network-threat indicators of the plurality of network-threat indicators:
• apply, to the first packet, an operator specified by the packet-filtering rule and configured to cause the packet-filtering device to either prevent the first packet from continuing toward a destination of the first packet or allow the first packet to continue toward the destination of the first packet;
• generate a packet-log entry comprising information from the packet-filtering rule that identifies the one or more network-threat indicators and indicating whether the packet-filtering device prevented the first packet from continuing toward the destination of the first packet or allowed the first packet to continue toward the destination of the first packet;
• generate, based on the packet-log entry, data indicating whether the packet-filtering device prevented the first packet from continuing toward the destination of the first packet or allowed the packet to continue toward the destination of the first packet;
• communicate, to a user device, the data;
• and
• causing, based on the communicated data and in an interface, display of the data indicating whether the packet-filtering device prevented the first packet from continuing toward the destination of the first packet or allowed the first packet to continue toward the destination of the first packet;
• and
• determine, based on a plurality of network-threat-intelligence reports produced by one or more network-threat-intelligence providers, an ordering of a plurality of network threats;
• wherein a first network threat of the plurality of network threats corresponds to a first packet-filtering rule, the first packet-filtering rule based on one or more network-threat indicators included in a first portion of the plurality of network-threat-intelligence reports,
• a second network threat of the plurality of network threats corresponds to a second packet-filtering rule, the second packet-filtering rule based on one or more network-threat indicators included in a second portion of the plurality of network-threat-intelligence reports, and
• determining the ordering comprises determining an order of the first network threat relative to the second network threat based on a determination that of whether the first portion of the plurality of network-threat-intelligence reports was received from a greater number of the one or more network-threat-intelligence providers than the second portion of the plurality of network-threat-intelligence reports.