Rule-based network-threat detection for encrypted communications

1. A method of filtering encrypted packets by a packet-filtering system comprising at least one processor and memory and configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, the method comprising:

receiving, from a plurality of different third-party networkthreat-intelligence providers located external to a network comprising the packet-filtering system, a plurality of network-threat indicators, wherein each of the plurality of different third-party network threat intelligence providers provides at least a portion of the plurality of network-threat indicators;

generating, based on the plurality of network-threat indicators, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;

receiving, by the packet-filtering system, a plurality of first-packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;

determining, by the packet-filtering system, that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;

generating, by the packet-filtering system and based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating:

an indication of the first packet-filtering rule; and

an Internet Protocol (IP) address corresponding to the domain name;

receiving, by the packet-filtering system and after the generating the log data, a plurality of second packets, wherein the plurality of second packets traverse the communications link and comprise:

encrypted data, and

respective packet headers comprising second unencrypted data;

determining, by the packet-filtering system and without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name; and

filtering, by the packet-filtering system and responsive to the determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, the plurality of second packets, comprising the encrypted data, based on at least one action specified by the first packet-filtering rule.

2. The method of claim 1 , wherein the encrypted data is associated with first transport-layer information, wherein the first unencrypted data is associated with second transport-layer information, and wherein the determining whetherthe plurality of second packets correspond to the potential network threat comprises:

determining, by the packet-filtering system, that the first transport-layer information corresponds to the second transport-layer information.

3. The method of claim 1 , wherein the filteringthe plurality of second packets comprises:

sending at least a portion of the filtered plurality of second packets to a proxy configured to apply the at least one action to the at least a portion of the filtered plurality of second packets.

4. The method of claim 3 , wherein the at least one action comprises dropping, by the proxy, the at least the portion of the filtered plurality of second packets.

5. The method of claim 1 , wherein the plurality of first packets comprises the IP address.

6. The method of claim 1 , wherein the plurality of first packets comprises a Domain Name System (DNS) query comprisingthe domain name.

7. The method of claim 6 , wherein the DNS query comprises the IP address corresponding to the domain name.

8. The method of claim 1 , wherein the plurality of first packets comprise a certificate message for an encrypted communication session, and wherein the at least one action comprises:

at least one of dropping or logging one or more of the plurality of second packets based on a determination that the certificate message comprises data indicating at least one of:

a serial number indicated by the first packet-filtering rule,

an issuer indicated by the first packet-filtering rule,

a validity time-range indicated by the first packet-filtering rule,

a key indicated by the first packet-filtering rule, or

a signing authority indicated by the first packet-filtering rule.

9. The method of claim 1 , wherein the at least one action is based on at least one of:

a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule,

data indicating a protocol version specified by the first packet-filtering rule,

data indicating a method specified by the first packet-filtering rule,

data indicating a request specified by the first packet-filtering rule, or

data indicating a command specified by the first packet-filtering rule.

10. The method of claim 1 , wherein the plurality of first packets comprise one or more packets comprising one or more handshake messages configured to establish an encrypted communication session.

11. One or more non-transitory computer-readable media comprising instructions that, when executed by at least one processor of a packet-filtering system configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules, cause the packet-filtering system to:

receive, from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, a plurality of network-threat indicators, wherein each of the plurality of different third-party network threat intelligence providers provides at least a portion of the plurality of network-threat indicators; and

generate, based on the plurality of network-threat indicators, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicatorof the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;

receive a plurality of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;

determine that the plurality of first packets are associated with the potential network threat correspondingto the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;

generate, based on the determining that the plurality of first packets are associated with the potential network threat correspondingto the first packet-filtering rule, log data indicating:

an indication of the first packet-filtering rule; and

an Internet Protocol (IP) address corresponding to the domain name;

receive, afterthe generatingthe log data, a plurality of second packets, wherein the plurality of second packets traverse the communications link and comprise:

encrypted data, and respective packet headers comprising second unencrypted data;

determine, without decrypting the encrypted data, whetherthe plurality of second packets are associated with the potential network threat correspondingto the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name; and

filter, responsive to the determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, the plurality of second packets, comprising the encrypted data, based on at least one action specified by the first packet-filtering rule.

12. The one or more non-transitory computer-readable media of claim 11 , wherein the encrypted data is associated with first transport-layerinformation, wherein the first unencrypted data is associated with second transport-layer information, and wherein the instructions, when executed by the at least one processor, cause the packet-filtering system to determine whetherthe plurality of second packets correspond to the potential networkthreat by causing the packet-filtering system to:

determine that the first transport-layer information corresponds to the second transport-layer information.

13. The one or more non-transitory computer-readable media of claim 11 , further comprising instructions that, when executed by the at least one processor, cause the packet-filtering system to filterthe plurality of second packets by causing the packet-filtering system to:

send at least a portion of the filtered plurality of second packets to a proxy configured to apply the at least one action to the at least a portion of the filtered plurality of second packets.

14. The one or more non-transitory computer-readable media of claim 13 , wherein the at least one action comprises dropping, by the proxy, the at least the portion of the filtered plurality of second packets.

15. The one or more non-transitory computer-readable media of claim 11 , wherein the plurality of first packets comprises the IP address.

16. The one or more non-transitory computer-readable media of claim 11 , wherein the plurality of first packets comprises a Domain Name System (DNS) query comprising the domain name.

17. The one or more non-transitory computer-readable media of claim 6 , wherein the DNS query comprises the IP address correspondingto the domain name.

18. The one or more non-transitory computer-readable media of claim 11 , wherein the at least one action comprises:

at least one of dropping or logging one or more of the plurality of second packets based on a determination that the certificate message comprises data indicating at least one of:

a serial numberindicated by the first packet-filtering rule,

an issuer indicated by the first packet-filtering rule,

a validity ti me-range indicated by the first packet-filtering rule,

a key indicated by the first packet-filtering rule, or

a signing authority indicated by the first packet-filtering rule.

19. The one or more non-transitory computer-readable media of claim 11 , wherein the at least one action is based on at least one of:

a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule,

data indicating a protocol version specified by the first packet-filtering rule,

data indicating a method specified by the first packet-filtering rule,

data indicating a request specified by the first packet-filtering rule, or

data indicating a command specified by the first packet-filtering rule.

20. A packet-filtering apparatus comprising:

at least one processor configured to filter packets traversing a communications link between a first network and a second network in accordance with a plurality of packet-filtering rules; and

memory storing instructions that when executed by the at least one processor cause the packet-filtering apparatus to:

receive, from a plurality of different third-party network threat-intelligence providers located external to a network comprising the packet-filtering system, a plurality of network-threat indicators, wherein each of the plurality of different third-party network threat intelligence providers provides at least a portion of the plurality of network-threat indicators;

generate, based on the plurality of network-threat indicators, the plurality of packet-filtering rules, wherein the plurality of packet-filtering rules comprises a first packet-filtering rule configured to identify packets comprising data corresponding to a first network-threat indicator of the plurality of network-threat indicators, and wherein the first network-threat indicator comprises domain name criteria associated with a potential network threat;

receive a plural ity of first packets, wherein the plurality of first packets traverse the communications link and comprise first unencrypted data;

determine that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule of the plurality of packet-filtering rules by determining whether a domain name in the first unencrypted data matches the domain name criteria;

generate, based on the determining that the plurality of first packets are associated with the potential network threat corresponding to the first packet-filtering rule, log data indicating:

an indication of the first packet-filtering rule; and

an Internet Protocol (IP) address corresponding to the domain name;

receive, afterthe generating the log data, a plurality of second packets, wherein the plurality of second packets traverse the communications link and comprise:

encrypted data, and

respective packet headers comprising second unencrypted data;

determine, without decrypting the encrypted data, whether the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule by determining that the second unencrypted data corresponds to the logged IP address corresponding to the domain name; and

filter, responsive to the determining that the plurality of second packets are associated with the potential network threat corresponding to the first packet-filtering rule, the plurality of second packets, comprising the encrypted data, based on at least one action specified by the first packet-filtering rule.

21. The packet-filtering apparatus of claim 20 , wherein the encrypted data is associated with first transport-layer information, wherein the first unencrypted data is associated with second transport-layer information, and wherein the instructions, when executed by the at least one processor, cause the packet-filtering apparatus to determine whetherthe plurality of second packets correspond to the potential network threat by causing the packet-filtering apparatus to:

determine that the first transport-layer information corresponds to the second transport-layer information.

22. The packet-filtering apparatus of claim 20 , wherein the instructions, when executed by the at least one processor, cause the packet-filtering apparatus to filter the plurality of second packets by causing the packet-filtering apparatus to:

send at least a portion of the filtered plurality of second packets to a proxy configured to apply the at least one action to the at least a portion of the filtered plurality of second packets.

23. The packet-filtering apparatus of claim 22 , wherein the at least one action comprises dropping, by the proxy, the at leastthe portion of the filtered plurality of second packets.

24. The packet-filtering apparatus of claim 20 , wherein the plurality of first packets comprises the IP address.

25. The packet-filtering apparatus of claim 20 , wherein the plurality of first packets comprises a Domain Name System (DNS) query comprising the domain name.

26. The packet-filtering apparatus of claim 25 , wherein the DNS query comprisesthe IP address corresponding to the domain name.

27. The packet-filtering apparatus of claim 20 , wherein the plurality of first packets comprise a certificate message for an encrypted communication session, and wherein at least one action comprises:

at least one of dropping or logging one or more of the plurality of second packets based on a determination thatthe certificate message comprises data indicating at least one of:

a serial numberindicated by the first packet-filtering rule,

an issuer indicated by the first packet-filtering rule,

a validity ti me-range indicated by the first packet-filtering rule,

a key indicated by the first packet-filtering rule, or

a signing authority indicated by the first packet-filtering rule.

28. The packet-filtering apparatus of claim 20 , wherein the at least one action is based on at least one of:

a uniform resource identifier (URI), domain name, or network address specified by the first packet-filtering rule,

data indicating a protocol version specified b the first packet-filtering rule,

data indicating a method specified by the first packet-filtering rule,

data indicating a request specified by the first packet-filtering rule, or

data indicating a command specified by the first packet-filtering rule.