Methods and systems for efficient threat context-aware packet filtering for network protection
A threat intelligence gateway (TIG) may protect TCP/IP networks from network (e.g., Internet) threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies may be composed of packet filtering rules with packet-matching criteria derived from cyber threat intelligence (CTI) associated with Internet threats. These CTI-derived packet-filtering rules may be created offline by policy creation and management servers, which may distribute the policies to subscribing TIGs that subsequently enforce the policies on in-transit packets. Each packet filtering rule may specify a disposition that may be applied to a matching in-transit packet, such as deny/block/drop the in-transit packet or pass/allow/forward the in-transit packet, and also may specify directives that may be applied to a matching in-transit packet, such as log, capture, spoof-tcp-rst, etc. Often, however, the selection of a rule's disposition_and directives that best protect the associated network may not be optimally determined before a matching in-transit packet is observed by the associated TIG. In such cases, threat context information that may only be available (e.g., computable) at in-transit packet observation and/or filtering time, such as current time-of-day, current TIG/network location, current TIG/network administrator, the in-transit packet being determined to be part of an active attack on the network, etc., may be helpful to determine the disposition_and directives that may best protect the network from the threat associated with the in-transit packet. The present disclosure describes examples of methods, systems, and apparatuses that may be used for efficiently determining (e.g., accessing and/or computing), in response to the in-transit packet, threat context information associated with an in-transit packet. The threat context information may be used to efficiently determine the disposition and/or one or more directives to apply to the in-transit packet. This may result in dispositions and/or directives being applied to in-transit packets that better protect the network as compared with solely using dispositions and directives that were predetermined prior to receiving the in-transit packet.
1. A method comprising:
receiving, by a packet-filtering appliance, a plurality of packet-filtering rules, wherein the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber intelligence reports from a plurality of cyber threat intelligence providers;
receiving, from a first network, an in-transit packet destined to a second network;
based on determining that the in-transit packet matches a first packet-filtering rule of the plurality of packet-filtering rules, determining an observation time of the in-transit packet;
determining, based on the observation time, a disposition; and
applying the disposition to the in-transit packet.
2. The method of claim 1 , wherein the packet-filtering appliance is a threat-intelligence gateway configured to protect the second network.
3. The method of claim 1 , wherein one of the first network and the second network is an unprotected network, and the other of the first network and the second network is a protected network.
4. The method of claim 1 , further comprising:
determining, based on the observation time of the in-transit packet, a directive; and
applying the directive.
5. The method of claim 1 , wherein the in-transit packet is one of a plurality of in-transit packets being received by the packet-filtering appliance at a particular packet rate, and wherein the determining the disposition is performed within a timeframe that is less than or equal to the inverse of the particular packet rate.
6. The method of claim 1 , wherein the determining the disposition is stateless.
7. The method of claim 1 , further comprising receiving, by the packet-filtering appliance and from the first network, a second in-transit packet destined to the second network, wherein the second in-transit packet is received by the packet-filtering appliance immediately subsequent to the in-transit packet, and wherein the determining the disposition is completed prior to the receiving the second in-transit packet.
8. The method of claim 1 , wherein the determining the observation time of the in-transit packet is further based on a determination that the first packet-filtering rule indicates no predetermined disposition to be applied to a matching packet.
9. The method of claim 1 , further comprising:
determining that a multi-packet multi-flow attack is active at a time that the in-transit packet is received by the packet-filtering appliance; and
based on determining that the in-transit packet matches the first packet-filtering rule, determining whether the in-transit packet is a member of the multi-packet multi-flow attack,
wherein the determining the disposition is further based on whether the in-transit packet is determined to be a member of the multi-packet multi-flow attack.
10. The method of claim 1 , wherein the second network is a network protected by the packet-filtering appliance, and wherein the determining the disposition is further based on a determination of whether the in-transit packet is associated with an attack occurring in one or more networks other than the second network.
11. The method of claim 1 , wherein the determining the disposition is further based on an identity of an administrator of the packet-filtering appliance.
12. The method of claim 1 , further comprising receiving analysis results from a threat analysis system, wherein the determining the disposition is further based on the analysis results.
13. The method of claim 1 , wherein the determining the disposition is further based on one or both of a flow state or a connection state of the in-transit packet.
14. The method of claim 1 , further comprising determining, based on the observation time of the in-transit packet, a directive, wherein the determining the disposition and the directive comprises determining the disposition and the directive using an artificial neural network, and wherein the artificial neural network comprises:
a plurality of input nodes each configured to receive a different aspect of threat context information, wherein the threat context information comprises the in-transit packet observation time; and
a plurality of output nodes, connected to the plurality of input nodes via a plurality of connecting nodes, each of the plurality of output nodes being configured to indicate a different disposition or a different directive.
15. A method comprising:
receiving, by a packet-filtering appliance, a plurality of packet-filtering rules, wherein the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber intelligence reports from a plurality of cyber threat intelligence providers;
receiving, from a first network, an in-transit packet destined to a second network;
based on determining that the in-transit packet matches a first packet-filtering rule of the plurality of packet-filtering rules, wherein the first packet-filtering rule indicates no predetermined disposition to be applied to a matching packet, determining threat context information that is based on an observation time of the in-transit packet;
determining, based on the threat context information, a disposition; and
applying the disposition to the in-transit packet.
16. The method of claim 15 , wherein the determining the threat context information comprises determining the threat context information using a computation that has a constant-time or logarithmic-time complexity.
17. The method of claim 15 , further comprising:
determining, based on the threat context information, a directive; and
applying the directive.
18. The method of claim 15 , wherein the in-transit packet is one of a plurality of in-transit packets being received by the packet-filtering appliance at a particular packet rate, and wherein the determining the disposition is performed within a timeframe that is less than or equal to the inverse of the particular packet rate.
19. The method of claim 15 , wherein the determining the threat context information comprises:
determining that a multi-packet multi-flow attack is active at a time that the in-transit packet is received by the packet-filtering appliance; and
based on determining that the in-transit packet matches the first packet-filtering rule, determining whether the in-transit packet is a member of the multi-packet multi-flow attack,
wherein the determining the disposition based on the threat context information is based on whether the in-transit packet is determined to be a member of the multi-packet multi-flow attack.
20. A non-transitory computer-readable medium storing instruction that, when executed, configure a packet-filtering appliance to:
receive a plurality of packet-filtering rules, wherein the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber intelligence reports from a plurality of cyber threat intelligence providers;
receive, from a first network, an in-transit packet destined to a second network;
based on determining that the in-transit packet matches a first packet-filtering rule of the plurality of packet-filtering rules, determine an observation time of the in-transit packet;
determine, based on the observation time, a disposition; and
apply the disposition to the in-transit packet.
21. The non-transitory computer-readable medium of claim 20 , wherein the instructions, when executed, configure the packet-filtering appliance to:
determine, based on the observation time of the in-transit packet, a directive; and
apply the directive.
22. The non-transitory computer-readable medium of claim 20 , wherein the in-transit packet is one of a plurality of in-transit packets being received by the packet-filtering appliance at a particular packet rate, and wherein the instructions, when executed, configure the packet-filtering appliance to determine the disposition within a timeframe that is less than or equal to the inverse of the particular packet rate.
23. The non-transitory computer-readable medium of claim 20 , wherein the instructions, when executed, configure the packet-filtering appliance to determine the disposition using a stateless process.
24. The non-transitory computer-readable medium of claim 20 , wherein the instructions, when executed, configure the packet-filtering appliance to receive, from the first network, a second in-transit packet destined to the second network, wherein the second in-transit packet is immediately subsequent to the in-transit packet, and wherein the instructions, when executed, configure the packet-filtering appliance to determine the disposition is prior to receiving the second in-transit packet.
25. The non-transitory computer-readable medium of claim 20 , wherein the instructions, when executed, configure the packet-filtering appliance to determine the observation time based on a determination that the first packet-filtering rule indicates no predetermined disposition to be applied to a matching packet.
26. A non-transitory computer-readable medium storing instruction that, when executed, configure a packet-filtering appliance to:
receive a plurality of packet-filtering rules, wherein the packet-filtering rules were determined based on a plurality of threat indicators that were determined based on cyber intelligence reports from a plurality of cyber threat intelligence providers;
receive, from a first network, an in-transit packet destined to a second network;
based on determining that the in-transit packet matches a first packet-filtering rule of the plurality of packet-filtering rules, wherein the first packet-filtering rule indicates no predetermined disposition to be applied to a matching packet, determine threat context information that is based on an observation time of the in-transit packet;
determine, based on the threat context information, a disposition; and
apply the disposition to the in-transit packet.
27. The non-transitory computer-readable medium of claim 26 , wherein the instructions, when executed, configure the packet-filtering appliance to determine the threat context information using a computation that has a constant-time or logarithmic-time complexity.
28. The non-transitory computer-readable medium of claim 26 , wherein the instructions, when executed, configure the packet-filtering appliance to:
determine, based on the threat context information, a directive; and
apply the directive.
29. The non-transitory computer-readable medium of claim 26 , wherein the in-transit packet is one of a plurality of in-transit packets being received by the packet-filtering appliance at a particular packet rate, and wherein the instructions, when executed, configure the packet-filtering appliance to determining the disposition within a timeframe that is less than or equal to the inverse of the particular packet rate.
30. The non-transitory computer-readable medium of claim 26 , wherein the instructions, when executed, configure the packet-filtering appliance to determine the threat context information by at least:
determining that a multi-packet multi-flow attack is active at a time that the in-transit packet is received by the packet-filtering appliance; and
based on determining that the in-transit packet matches the first packet-filtering rule, determining whether the in-transit packet is a member of the multi-packet multi-flow attack,
wherein the instructions, when executed, configure the packet-filtering appliance to determine the disposition based on whether the in-transit packet is determined to be a member of the multi-packet multi-flow attack.