Systems and methods for low latency stateful threat detection and mitigation
Disclosed are systems and methods for securing a network. A method may include obtaining, by a detection engine, an encapsulated image defining an action for a predetermined data packet of interest; determining, by the detection engine, that the action defined by the encapsulated image should be applied to one or more data packets accessed by the detection engine; generating and deploying, by the detection engine, an action state including one or more attributes associated with the accessed data packet and the encapsulated image; determining, at a first execution engine executing parallel with the detection engine, that the one or more data packets comprises attributes matching the one or more attributes included in the deployed action state; and executing, by the first execution engine, the action included in the deployed action state on a received data packet to generate a processed data packet.
1. A method of securing a network, the method comprising:
obtaining, by a detection engine of at least one hardware processor, an encapsulated image defining an action for a predetermined data packet of interest, wherein the encapsulated image is an encapsulated snapshot of a stack machine operation including one or more of associated registers, stacks, heap, or code;
determining, by the detection engine, that the action defined by the encapsulated image should be applied to one or more data packets accessed by the detection engine;
as a result of determining that the action defined by the encapsulated image should be applied to the accessed data packet, generating and deploying, by the detection engine, an action state including one or more attributes associated with the accessed data packet and the encapsulated image;
determining, at a first execution engine of the at least one hardware processor, the first execution engine executing in parallel with the detection engine, that the one or more data packets comprises attributes matching the one or more attributes included in the deployed action state;
executing, by the first execution engine, the action included in the deployed action state on a received data packet to generate a processed data packet;
determining, by the first execution engine, that the first execution engine is not capable of executing the action included in the deployed action state;
terminating, by the first execution engine, the action; and
updating, by the first execution engine, the deployed action state based on the terminated action and the received data packet, wherein the updated action state includes a contextual state of the received data packet.
2. The method of claim 1 , further comprising:
updating, by the first execution engine, the deployed action state based on the executed action; and
transmitting, by the first execution engine, the updated action state and the processed data packet to a network connected device of the network configured to inspect the received updated action state and the processed data packet.
3. The method of claim 1 , further comprising:
determining, by a packet assembly compiler, the action for the predetermined data packet of interest; and
generating, by the packet assembly compiler, the encapsulated image defining the action.
4. The method of claim 1 , wherein the action comprises one or more of:
forwarding, dropping, redirecting, or rewriting, by the first execution engine, the received data packet.
5. The method of claim 1 , further comprising:
transferring, by the first execution engine, the updated action state and the received data packet to a second execution engine to execute the action, wherein the second execution engine is capable of executing the action, and wherein the second execution engine is configured to resume executing the action from the point of termination based on the updated action state and the received data packet.
6. The method of claim 1 , further comprising:
generating, by the first execution engine, a message including the updated action state and the received data packet; and
transmitting, by the first execution engine, the generated message to a network connected device to determine a cause for the termination based on the updated action state and the received data packet.
7. The method of claim 2 , further comprising:
transmitting, by the network connected device, a message to a packet assembly compiler, the message including the inspection of the received updated action state and the processed data packet; and
determining, by the packet assembly compiler, an updated action for the predetermined data packet of interest based on the message.
8. The method of claim 1 , wherein deploying, by the detection engine, the action state comprises determining a time to life (TTL) for the deployed action state.
9. The method of claim 1 , further comprising:
receiving, by the detection engine, external information regarding one or more predetermined data packets; and
determining, by the detection engine, that the action defined by the encapsulated image should be applied to the accessed data packet based on the received external information.
10. A system for securing a network, the system comprising:
at least one hardware processor including:
a detection engine configured to:
obtain an encapsulated image defining an action for a predetermined data packet of interest, wherein the encapsulated image is an encapsulated snapshot of a stack machine operation including one or more of associated registers, stacks, heap, or code,
determine that the action defined by the encapsulated image should be applied to one or more data packets accessed by the detection engine, and
generate and deploy an action state including one or more attributes associated with the accessed data packet and the encapsulated image as a result of determining that the action defined by the encapsulated image should be applied to the accessed data packet; and
a first execution engine configured to execute in parallel with the detection engine:
determine that the one or more data packets comprises attributes matching the one or more attributes included in the deployed action state, and
execute the action included in the deployed action state on a received data packet to generate a processed data packet,
determine that the first execution engine is not capable of executing the action included in the deployed action state,
terminate the action, and
update the deployed action state based on the terminated action and the received data packet, wherein the updated action state includes a contextual state of the received data packet.
11. The system of claim 10 , wherein the first execution engine is further configured to:
update the deployed action state based on the executed action; and
transmit the updated action state and the processed data packet to a network connected device of the network configured to inspect the received updated action state and the processed data packet.
12. The system of claim 10 , further comprising:
a packet assembly compiler configured to: determine the action for the predetermined data packet of interest, and generate the encapsulated image defining the action.
13. The system of claim 10 , wherein the action comprises one or more of:
forwarding, dropping, redirecting, or rewriting, by the first execution engine, the received data packet.
14. The system of claim 10 , wherein the first execution engine is further configured to:
transfer the updated action state and the received data packet to a second execution engine to execute the action, wherein the second execution engine is capable of executing the action, and wherein the second execution engine is configured to resume executing the action from the point of termination based on the updated action state and the received data packet.
15. The system of claim 10 , wherein the first execution engine is further configured to:
generate a message including the updated action state and the received data packet; and
transmit the generated message to a network connected device to determine a cause for the termination based on the updated action state and the received data packet.
16. The system of claim 11 , wherein the network connected device is further configured to transmit a message to a packet assembly compiler, the message including the inspection of the received updated action state and the processed data packet, and
wherein the packet assembly compiler is further configured to determine an updated action for the predetermined data packet of interest based on the message.
17. The system of claim 10 , wherein deploying, by the detection engine, the action state comprises determining a time to life (TTL) for the deployed action state.
18. The system of claim 10 , wherein the detection engine is further configured to:
receive external information regarding one or more predetermined data packets; and
determine that the action defined by the encapsulated image should be applied to the accessed data packet based on the received external information.