Methods and systems for protecting a secured network

1. A method comprising:

receiving, by a server and from a first malicious host tracker services external to a network protected by at least one packet security gateway, malicious traffic information that comprises a first set of network addresses that have been determined, by the first malicious host tracker service, to be associated with malicious network traffic corresponding to a network threat;

automatically creating or altering, by the server and based on the first set of network addresses, a first packet filtering rule, of a set of packet filtering rules, that corresponds to the network threat, wherein the first packet filtering rule comprises:

one or more packet matching criteria comprising the first set of network addresses, and

one or more corresponding packet transformation functions to be applied to network traffic matching the one or more packet matching criteria;

transmitting, to the at least one packet security gateway, the first packet filtering rule, wherein the at least one packet security gateway is configured to use the first packet filtering rule to filter a first packet;

receiving, by the server and from a second malicious host tracker service, a second set of network addresses, wherein the second malicious host tracker service is different from the first malicious host tracker service;

identifying, by the server, the first packet filtering rule based on determining that:

the first set of network addresses includes at least one first network address of the second set of network addresses; and

the first set of network addresses does not include at least one second network address of the second set of network addresses; and

based on the identifying:

updating, by the server, the first packet filtering rule by modifying the first packet filtering rule to further include the at least one second network address; and

transmitting, by the server and to the at least one packet security gateway, the updated first packet filtering rule, wherein the at least one packet security gateway is configured to use the updated first packet filtering rule to filter a second packet.

2. The method of claim 1 , further comprising:

identifying at least two rules, of the set of packet filtering rules, that each specify a range of network addresses comprising the at least one first network address; and

combining the at least two rules into a rule that specifies a range of network addresses that includes network addresses specified by each of the at least two rules.

3. The method of claim 1 , further comprising:

removing duplicate network addresses from the set of packet filtering rules.

4. The method of claim 1 , wherein the set of packet filtering rule comprises:

a second packet filtering rule specifying a third set of network addresses for which associated packets should be forwarded to their intended destination, and

a fourth packet filtering rule specifying that all packets associated with network addresses outside the third set of network addresses should be dropped.

5. The method of claim 1 , further comprising:

combining at least two of the set of packet filtering rules into a rule that specifies:

a range of network addresses that includes the at least one first network address, and

an additional parameter.

6. The method of claim 5 , wherein the additional parameter comprises at least one Session Initiation Protocol (SIP) Uniform Resource Identifier (URI).

7. The method of claim 5 , wherein the additional parameter comprises at least one of:

transport-layer protocol information,

a source address within a specified range of source addresses,

a source port within a specified range of source ports,

a destination address within a specified range of destination addresses, or

a destination port within a specified range of destination ports.

8. The method of claim 1 , wherein at least one of the one or more corresponding packet transformation functions comprises a network protective action.

9. The method of claim 1 , wherein the one or more corresponding packet transformation functions comprise a packet digest logging function.

10. One or more non-transitory computer-readable media comprising instructions that, when executed by one or more computers, cause the one or more computers to:

receive, from a first malicious host tracker services external to a network protected by at least one packet security gateway, malicious traffic information that comprises a first set of network addresses that have been determined, by the first malicious host tracker services, to be associated with malicious network traffic corresponding to a network threat;

automatically create or alter, based on the first set of network addresses, a first packet filtering rule, of a set of packet filtering rules, that corresponds to the network threat, wherein the first packet filtering rule comprises:

one or more packet matching criteria comprising the first set of network addresses, and

one or more corresponding packet transformation functions to be applied to network traffic matching the one or more packet matching criteria;

transmit, to the at least one packet security gateway, the first packet filtering rule, wherein the at least one packet security gateway is configured to use the first packet filtering rule to filter a first packet;

receive, from a second malicious host tracker service, a second set of network addresses, wherein the second malicious host tracker service is different from the first malicious host tracker service;

identify the first packet filtering rule based on determining that:

the first set of network addresses includes at least one first network address of the second set of network addresses; and

the first set of network addresses does not include at least one second network address of the second set of network addresses; and

based on the identifying:

update the first packet filtering rule by modifying the first packet filtering rule to further include the at least one second network address; and

transmit, to the at least one packet security gateway, the updated first packet filtering rule, wherein the at least one packet security gateway is configured to use the updated first packet filtering rule to filter a second packet.

11. The one or more non-transitory computer-readable media of claim 10 , having instructions stored thereon, that when executed by the one or more computers, further cause the one or more computers to:

identify at least two rules, of the set of packet filtering rules, that each specify a range of network addresses comprising the at least one first network address; and

combine the at least two rules into a rule that specifies a range of network addresses that includes network addresses specified by each of the at least two rules.

12. The one or more non-transitory computer-readable media of claim 10 , having instructions stored thereon, that when executed by the one or more computers, further cause the one or more computers to:

remove duplicate network addresses from the set of packet filtering rules.

13. The one or more non-transitory computer-readable media of claim 10 , wherein the instructions stored further cause the one or more computers to:

combine at least two of the set of packet filtering rules into a rule that specifies:

a range of network addresses that includes the at least one first network address, and

an additional parameter.

14. The one or more non-transitory computer-readable media of claim 13 , wherein the additional parameter comprises at least one Session Initiation Protocol (SIP) Uniform Resource Identifier (URI).

15. The one or more non-transitory computer-readable media of claim 13 , wherein the additional parameter comprises at least one of:

transport-layer protocol information,

a source address within a specified range of source addresses,

a source port within a specified range of source ports,

a destination address within a specified range of destination addresses, or

a destination port within a specified range of destination ports.

16. The one or more non-transitory computer-readable media of claim 10 , wherein at least one of the one or more packet transformation functions comprises a network protective action.

17. A system comprising:

a server and at least one packet security gateway,

wherein the server comprises:

one or more first processors; and

first memory storing first instructions that, when executed by the one or more first processors, cause the server to:

receive, from a first malicious host tracker services external to a network protected by the at least one packet security gateway, malicious traffic information that comprises a first set of network addresses that have been determined, by the first malicious host tracker service, to be associated with malicious network traffic corresponding to a network threat;

automatically creating or altering, based on the first set of network addresses, first packet filtering rule, of a set of packet filtering rules, that corresponds to the network threat, wherein the first packet filtering rule comprises:

one or more packet matching criteria comprising the first set of network addresses, and

one or more corresponding packet transformation functions to be applied to network traffic matching the one or more packet matching criteria;

receive, from a second malicious host tracker service, a second set of network addresses, wherein the second malicious host tracker service is different from the first malicious host tracker service;

identify, by the server, the first packet filtering rule based on determining that:

the first set of network addresses includes at least one first network address of the second set of network addresses; and

the first set of network addresses does not include at least one second network address of the second set of network addresses; based on the identifying:

update the first packet filtering rule by modifying the first packet filtering rule to further include the at least one second network address; and

wherein the at least one packet security gateway comprises:

one or more second processors; and

second memory storing second instructions that, when executed by the one or more second processors, cause the at least one packet security gateway to:

use the first packet filtering rule to filter a first packet; and

use the updated first packet filtering rule to filter a second packet.

18. The system of claim 17 , wherein the first instructions, when executed by the one or more first processors, cause the server to:

identify at least two rules, of the set of packet filtering rules, that each specify a range of network addresses comprising the at least one first network address; and

combine the at least two rules into a rule that specifies a range of network addresses that includes network addresses specified by each of the at least two rules.

19. The system of claim 17 , wherein the first instructions, when executed by the one or more first processors, cause the server to:

remove duplicate network addresses from the set of packet filtering rules.

20. The system of claim 17 , wherein the first instructions, when executed by the one or more first processors, cause the server to:

combine at least two of the set of packet filtering rules into a rule that specifies:

a range of network addresses that includes the at least one first network address, and

an additional parameter.