Methods, systems, articles of manufacture and apparatus to reduce computation corresponding to inspection of non-malicious data flows
Methods, apparatus, systems, and articles of manufacture are disclosed to improve the inspection of network data flows. An example apparatus includes memory, and processor circuitry to execute machine readable instructions to at least identify network domains accessible by at least one client device in a geographic location of interest, associate the identified network domains with Autonomous System Numbers (ASNs), create a list of respective ones of the ASNs that include a non-malicious status corresponding to Internet protocol (IP) addresses associated with respective ones of the identified network domains, and in response to receiving a reputation request corresponding to a destination IP address, cause inspection of a data flow to be skipped when the destination IP address is associated with the list of non-malicious ASNs.
1. An apparatus to inspect network data flows, the apparatus comprising:
interface circuitry;
machine readable instructions; and
at least one processor circuit to be programmed by the machine readable instructions to:
create a first list of first ones of a plurality of Autonomous System Numbers (ASNs) that include a non-malicious status, and a second list of second ones of the plurality of the ASNs that include an unknown status;
determine a first ASN of the plurality of ASNs associated with a destination Internet Protocol (IP) address based on a first reputation request from a first client device;
determine a reputation of the destination IP address based on the first ASN, the reputation corresponding to one of the first list or the second list;
cause a first inspection of a first data flow to occur for the first client device when the destination IP address is associated with the second list that includes the unknown status;
cause a second inspection of a second data flow to occur based on a result of the first inspection when a second reputation request is received from a second client device, the second reputation request directed to the destination IP address; and
after a determination that the second data flow is malicious, redirect the second client device to a block page to prevent connection to a malicious domain.
2. The apparatus as defined in claim 1 , wherein one or more of the at least one processor circuit is to designate the plurality of the ASNs with at least one of the non-malicious status or the unknown status based on at least one of reputation or category information.
3. The apparatus as defined in claim 1 , wherein one or more of the at least one processor circuit is to calculate a sharing ratio of the destination IP address.
4. The apparatus as defined in claim 3 , wherein one or more of the at least one processor circuit is to cause a network connection to be tunneled based on a threshold value of the sharing ratio.
5. The apparatus as defined in claim 3 , wherein one or more of the at least one processor circuit is to cause a virtual private network (VPN) tunnel to route the destination IP address when the sharing ratio satisfies a threshold value.
6. The apparatus as defined in claim 3 , wherein one or more of the at least one processor circuit is to bypass network tunneling when the sharing ratio does not satisfy a threshold value.
7. The apparatus as defined in claim 1 , wherein one or more of the at least one processor circuit is to retrieve handshake parameters corresponding to the first client device and the second client device associated with the destination IP address.
8. The apparatus as defined in claim 7 , wherein one or more of the at least one processor circuit is to:
compare the retrieved handshake parameters to handshake parameters of a greenlist; and
cause the second inspection of the second data flow when the retrieved handshake parameters do not match the handshake parameters of the greenlist.
9. The apparatus as defined in claim 1 , wherein one or more of the at least one processor circuit is to:
determine the reputation of the destination IP address at a first time;
determine an updated reputation of the destination IP address at a second time; and
determine to skip a third inspection of a third data flow based on the updated reputation, the skip of the third inspection to occur in response to a third reputation request, the third reputation request directed to the destination IP address.
10. The apparatus as defined in claim 1 , wherein the reputation of the destination IP address represents a level of security threat risk based on a leniency of a policy associated with the destination IP address.
11. An apparatus comprising:
greenlist generation circuitry to:
create a first list of first ones of a plurality of Autonomous System Numbers (ASNs) that include a non-malicious status, and a second list of second ones of the plurality of the ASNs that include an unknown status;
network traffic monitoring circuitry to;
determine a first ASN of the plurality of ASNs associated with a destination Internet Protocol (IP) address based on a first reputation request from a first client device;
determine a reputation of the destination IP address based on the first ASN, the reputation corresponding to one of the first list or the second list;
cause a first inspection of a first data flow to occur for the first client device when the destination IP address is associated with the second list that includes the unknown status;
cause a second inspection of a second data flow to occur based on a result of the first inspection when a second reputation request is received from a second client device, the second reputation request directed to the destination IP address; and
after a determination that the second data flow is malicious, redirect the second client device to a block page to prevent connection to a malicious domain.
12. The apparatus as defined in claim 11 , wherein the greenlist generation circuitry is to designate the plurality of the ASNs with at least one of the non-malicious status or the unknown status based on at least one of reputation information or category information.
13. The apparatus as defined in claim 11 , wherein the greenlist generation circuitry is to calculate a sharing ratio of the destination IP address.
14. The apparatus as defined in claim 13 , further including ASN reputation request handling circuitry to cause a network connection to be tunneled based on a threshold value of the sharing ratio.
15. The apparatus as defined in claim 13 , further including flow controlling circuitry to cause a virtual private network (VPN) tunnel to route the destination IP address when the sharing ratio satisfied a threshold value.
16. The apparatus as defined in claim 13 , further including flow controlling circuitry to bypass network tunneling when the sharing ratio does not satisfy a threshold value.
17. The apparatus as defined in claim 11 , further including handshake parameter receiver circuitry to retrieve handshake parameters corresponding to the first client device and the second client device associated with the destination IP address.
18. The apparatus as defined in claim 17 , further including handshake inspection circuitry to:
compare the retrieved handshake parameters to handshake parameters corresponding to a greenlist; and
cause the second inspection of the second data flow when the retrieved handshake parameters do not match the handshake parameters of the greenlist.
19. At least one non-transitory machine readable medium comprising instructions to cause at least one processor circuit to at least:
create a first list of first ones of a plurality of Autonomous System Numbers (ASNs) that include a non-malicious status, and a second list of second ones of the plurality of the ASNs that include an unknown status;
determine a first ASN of the plurality of ASNs associated with a destination Internet Protocol (IP) address based on a first reputation request from a first client device;
determine a reputation of the destination IP address based on the first ASN, the reputation corresponding to one of the first list or the second list;
cause a first inspection of a first data flow to occur for the first client device when the destination IP address is associated with the second list that includes the unknown status;
cause a second inspection of a second data flow to occur based on a result of the first inspection when a second reputation request is received from a second client device, the second reputation request directed to the destination IP address; and
after a determination that the second data flow is malicious, redirect the second client device to a block page to prevent connection to a malicious domain.
20. The at least one non-transitory machine readable medium as defined in claim 19 , wherein the instructions are to cause one or more of the at least one processor circuit to designate the ASNs with at least one of the non-malicious status or the unknown status based on at least one of reputation or category information.