Patent Application
20210258286
Network security is becoming increasingly important as the information age continues to unfold. Network threats/attacks may take a variety of forms (e.g., unauthorized requests or data transfers, viruses, malware, large volumes of traffic designed to overwhelm resources, and the like).
To counter these kinds of threats and attacks, various cyber defense methodologies and systems have been developed and deployed. One variety of cyber defense system uses packet gateways, such as a threat intelligence gateway (TIG), to protect networks. A packet gateway may include an (inline) network packet filtering devices with a capability to apply sets of packet filtering rules to in-transit TCP/IP ((Transmission Control Protocol/Internet Protocol)) packets. The TIG may act as a gateway, or interface, between a network that has been protected, or secured, by cyber threat intelligence (CTI)(for example, a private enterprise network) and a network that is not similarly secured/protected (for example, the Internet).
The packet filtering rules may be based on databases of threat indicators supplied by sources of CTI, including CTI provider organizations. The set of packet filtering rules may represent a TIG-enforced security policy for securing/protecting a network. Threat indicators may be used as packet matching criterion for identifying risky packets. CTI indicators, or threat indicators, may include Internet network addresses (in the form of IP addresses, IP address ranges, L3/L4 ports and protocols, domain names, Uniform Resource Identifiers (URIs), and the like) of resources that may be controlled or operated by threat actors, or that may have otherwise been associated with malicious activity. CTI indicators/threat indicators may also include identifiers for certificates and associated certificate authorities that are used to secure some TCP/IP communications (e.g. X.509 certificates used by the Transport Layer Security (TLS) protocol to secure Hypertext Transfer Protocol (HTTP) -mediated sessions). CTI providers include threat metadata associated with each threat indicator including, for example, the threat/attack type, the threat name, the threat risk score, the threat actor (attribution), and the like. A TIG and associated applications may use the threat metadata to further increase protections from threats and further improve network security posture.
A network security policy manager may create a network security policy as a set of CTI-derived packet filtering rules by receiving threat indicators and associated threat metadata from one or more CTI providers and generating packet filtering rules based on the indicators and metadata. Each packet filtering rule includes at least (a) criterion for matching packet data, (b) an action or combination of actions to be applied to the packet if there is a match with the criterion, and (c) threat metadata. The matching criterion may include one or more pairs composed of a packet field name (e.g., the L3 source IP address field) and the field value. The field value may be a threat indicator in the form of a network address (for example, an IP address, domain name, URI, and the like) or an identifier for a certificate or a certificate authority. The action or combination of actions may include some combination of blocking or dropping the packet, allowing or forwarding the packet, logging the packet, capturing the packet, re-directing or re-routing the packet, and modifying the packet to protect the network. In the context of TIGs and CTI-derived policies, the rule action may be called a packet transformation function (PTF), which may transform a packet in such a way as to protect the network. For example, a PTF may transform a TCP SYN packet that is initiating a connection setup with a threat endpoint into a corresponding TCP RST packet that halts the connection setup process. The threat metadata may be used to compute a threat risk score, to select a threat analysis methodology to be applied to the packet and the communications associated with the packet, or select or compute the action(s) to be applied to the packet in accordance with the threat risk.
One or more TIGs may be inserted inline with, for example, one or more of the network's Internet access links. A policy manager of one or more TIGs may be configured to (a) receive CTI (threat indicators and associated metadata) from one or more CTI providers; (b) generate one or more policies composed of packet filtering rules derived from the threat indicators and metadata; and (c) download the one or more policies or transfer the one or more policies into one or more (subscribing) TIGs, which may be associated with the policy manager by a policy subscription. The TIGs may enforce the policies by applying the packet filtering rules to each in-transit packet as the packet traverses an Internet access link (in either direction).
The effectiveness of protecting networks using TIGs and associated CTI is often a function of the scope and quality of the CTI indicators and metadata being applied by the TIG, and of the performance of the TIG. At the present time of disclosure, in aggregate there are many millions of threat indicators (and associated threat metadata) available from multiple sources of CTI, with the indicators being in the form of IP addresses, 5-tuples, domain names, URIs, and the like, as well as certificate identifiers, certificate authority identifiers, and the like. These large databases of CTI may be translated into a similar number of packet filtering rules. Because the threat indicators that may actually be observed in a given network's communications traffic are not necessarily known, all available CTI or associated packet filtering rules may be applied by a TIG at any time to ensure effective protections. TIG policies may be composed of 1's, 10's, or 100's of millions of rules. As such, the TIG must be capable of applying the millions of packet filtering rules to each in-transit packet without adversely impacting network performance. 10 G and 40/100 G network links may be used at TIG insertion points, which means that packet transmission rates may be millions or tens of millions of packets per second. The TIG must filter each in-transit packet through the millions of rules in order to enforce the policy, without adversely affecting network performance. With such large policies and high packet rates, even when the policies are stored in main memory, and even when fast (e.g. sublinear) policy search algorithms are used, TIG performance may be insufficient and may result in unacceptable performance degradations. For example, high latencies may result in packet drops due to buffer overflows. The latency incurred during packet filtering should be low and packets should not be dropped (e.g. due to buffer overflows).
A TIG may be designed to achieve the necessary performance by some combination of (a) high-performance CPUs, which may be architected or configured for network packet processing; (b) fast/efficient algorithms and associated data structures for searching the rules for matches between the rules' indicators and the current in-transit packet's associated field values; and (c) storing the policy (which may include the millions of packet filtering rules) in high-speed local memory (for example, on-board SDRAM, which is often called main memory) so that the CPU(s) may access the main memory quickly via a high-speed, high-bandwidth data bus.
However, recent trends in networking are making it difficult or impractical for TIGs to perform at the levels necessary to maintain effective network protections. The growth rate of the quantity of CTI (measured by the number of threat indicators and associated metadata), and therefore the rate of growth of associated policies (measured in bytes, which is a function of the number of packet filtering rules and the size in bytes of those rules), is higher than the rates of improvements in processor speeds, processor costs, processor power requirements, memory speeds, memory densities, memory costs, etc. The result is that it is no longer practical for TIGs to handle increases in policy sizes by increasing the size of the memory. This problem is further compounded by ever-increasing network link speeds and ever-increasing network traffic volumes. Thus, there is a need for improvements in efficiencies of TIG technology such that large increases in the size of CTI-derived policies only require relatively small increases in computational resources that are necessary to maintain TIG performance at acceptable levels (e.g., relatively low latency and minimal to no packet drops) while providing effective network protections.
The following presents a simplified summary in order to establish a baseline understanding of some aspects of the disclosure. It is intended neither to identify key or critical elements of the disclosure nor to delineate the scope of the disclosure. The following summary merely presents some concepts of the disclosure in a simplified form as a prelude to the detailed description below.
Aspects of this disclosure relate to efficient packet filtering for cyber threat intelligence (CTI) applications. The packet filtering method may be time and space efficient. In practice, only a small fraction of packets filtered by any packet gateway will match any CTI-derived packet-filtering rule in the gateway-enforced security policy. Thus, a time-efficient method for determining if a packet will match any rule (or not) before searching the rules of the security policy may eliminate a large number of the policy searches. If the method is faster than a search through the policy, an expected search time may be significantly reduced when averaged over a sufficient amount of representative packet traffic. In addition, a security policy may include multiple rules that are identical except for the associated threat indicator values. The rules have the same action(s) and threat metadata. As such, space (e.g. memory resources) efficiencies may be achieved by associating the multiple different indicators with a single rule (e.g. the same action(s) and threat metadata).
Each CTI-derived rule in a policy may be characterized by the rule's indicator(s). For a given policy being enforced by a packet gateway, each indicator associated with each rule of a policy may be inserted into a set I. For CTI-derived rules, the indicators associated with the set I may be in the form of IP addresses, 5-tuples, domain names, URIs, and the like, as well as certificate identifiers, certificate authority identifiers, and the like. For exemplary purposes, which are not limiting in any way, three types of network-address indicators, IP addresses, domain names, and URIs, are being used in the following examples. Before the TIG filters a packet through the current policy, the TIG may extract any network addresses from the packet that may correspond with indicators in the set I. For example, the TIG may extract data such as the source and destination IP addresses in the IP (L3) packet header, a domain name and/or a URI from the application (L7) packet. The TIG may perform a set membership test based on the extracted network addresses.
The set may be represented in a probabilistic data structure, such as a Bloom filter, which may be tested to find a match to determine membership in the set. The set membership test may determine if any network addresses in a packet being filtered correspond to elements in the set I. If a match is determined, the TIG may search the policy to find the rule or rules that includes the matching indicator, and may apply the rule action(s) to the packet. The rule action(s) may include a drop action, a log action, a monitor action, or the like. If no match is found, the packet filtering/policy search may be skipped, and the TIG may forward the packet towards its destination.
A Bloom filter may be a time-efficient and space-efficient probabilistic data structure for determining the membership of elements in a set. A Bloom filter is parameterized by (1) the number of elements in the set N; (2) the storage size or number of storage/memory bits M needed to store the N elements; and (3) the false positive rate P. The false positive rate P is the probability that a membership test for an element X in the set I falsely returns a match value True (e.g. the membership test determines that X is a member of the set when in fact X is not a member of the set). The value of M is dependent on N and false positive rate P. For a fixed value of N (the number of elements in the set), storage size M varies inversely with the false positive rate. That is, as the false positive rate P decreases, the storage size M increases. The false positive rates may be selected for Bloom filters in the context of CTI applications and associated CTI-derived policies.
For example, for a Bloom filter that contains a set of 500 million domain names and a false positive rate P of 0.01, or 10−2, the storage size M may be approximately 600 MB. For comparison, the average size of domain names registered in the Internet DNS is approximately 20 bytes. Therefore, a simple uncompressed list of 500 million domain names needs approximately 10 GB of storage, which is about (10 G/600 M)=16.66 times larger than the storage size M. If the false positive rate P is decreased by a factor of 1000, to 0.00001 or 10−5, the storage size M increases to approximately 1.5 GB, a factor of only 2.5 (=1.5 G/600 M). This is space efficient. In general, the storage size M varies as the logarithm of the false positive rate P. The set membership test algorithm is similarly time efficient, with the theoretical time complexity function also being on the order of the logarithm of the false positive rate P. In practice, implementations of the set membership algorithm may be extremely fast and nearly constant time, even when the false positive rate P varies by several orders of magnitude.
To realize space efficiencies and time efficiencies, a probabilistic data structure such as a Bloom filter may be used to avoid unnecessary searches of packet filtering rules or to avoid repeated storage, for example, of a common rule action. For example, 500 million domain names may be stored in a Bloom filter of size approximately 600 MB (when the false positive rate P=0.01). In practice, a policy composed of 500 million packet filtering rules (with domain-name indicators) may require, for example, 50 GB to 500 GB of storage/memory if each rule averages 100-1000 bytes (for example, 20 bytes for the domain name indicator, 30 bytes to specify actions and associated options, and 50-950 bytes for metadata). That is, the Bloom filter may require less storage/memory, by 2-3 orders of magnitude, than a packet filtering rule based policy without a Bloom filter. By grouping a plurality of threat indicators that are associated with the same operator or action(s) (e.g. a Block operation) and the same metadata, the use of a Bloom filter may eliminate redundant storage associated with storing the action(s) and metadata separately for each rule and instead store the action(s) and metadata once for the Bloom filter containing the plurality of threat indicators. That is, rather than storing each rule and an associated rule action, a rule action may be associated with a particular Bloom filter and stored a single time as the rule action to be performed based on a test of the Bloom filter indicating a match. Thus, the memory/space requirements for a policy that integrates Bloom filter technology may be relatively much smaller, potentially by orders-of-magnitude, compared to the memory/space requirements for the packet filtering rule policies that do not integrate Bloom filter technology.
For CTI applications, the false negative rate for a Bloom filter is always zero (regardless of the non-zero false positive rate P), which maintains the same level of, or preserves, security as a policy enforced without a Bloom filter. That is, if a test to determine if an element Xis a member of a set I returns a negative or false, then Xis definitely not a member of the set I. Thus, while a TIG using Bloom filter technology for time efficiency may, with the probability of the false positive rate P, unnecessarily search the policy/filter a packet, the TIG will never skip a policy search or not filter a packet when there is a matching rule in the policy.
While the term Bloom filter may be used throughout this specification, the choice of filter or data structure is exemplary and not meant to be limiting or restrictive in any way. Any data structure with sufficient time and space efficiencies for testing set membership, and which preserves security, may be used. For example, a Cuckoo filter is a probabilistic data structure that has similar time and space efficiencies as a Bloom filter. The Cuckoo filter also has the capability to efficiently delete or remove elements from a set, whereas a standard Bloom filter does not have the capability to remove elements from the set (although Bloom filter variants have been developed that support a delete capability). The capability to efficiently insert, update or delete elements from a set may prove useful in some applications, implementations, and/or embodiments. A security policy update may include an update to add or remove a rule, or to change a rule action associated with a particular threat indicator. For example, an update may change a rule action from a monitor action to a drop action. The data structures may support a plurality of functions, such as an Insert( )function for adding an element to the set, a Boolean-valued Member( )function for testing set membership of an element, and a Delete( )function for removing an element from a set. The following description also assumes that the data structure is probabilistic and is therefore associated with a (non-zero) false positive rate P, but again this choice is exemplary and not meant to be restrictive.
There are multiple ways that Bloom filter technology may improve efficiencies for CTI applications/TIG features. Below, eight exemplary methods are described. For purposes of simplification, the first six exemplary methods involve indicators in the form of network addresses (e.g. IPs, domain names, URLs, etc.), a seventh involves indicators in the form of certificate identifiers, and an eighth is generic with respect to indicator types.
In a first example, Bloom filter technology may be used to improve performance. For each rule in the set of filtering rules to be searched, an associated indicator may be extracted and the indicator may be inserted into a policy Bloom filter. The resultant policy Bloom filter may be stored in a main memory of packet filtering device. Prior to a search of a set of packet filtering rules for a match with the current in-transit packet's network address(es), a packet filtering device may determine if the network address is a member of the policy Bloom filter. If a result of the determination is TRUE or indicates a match, then the packet filtering device may search a corresponding set of rules for a matching rule and may apply the rule action(s) to the packet. If the packet filtering device determines a result of FALSE or does not indicate a match, then the device may skip an unnecessary search of the packet filtering rules (e.g. because no matching rule will be found). By skipping unnecessary searches, the average policy search time per packet may be reduced and TIG performance or throughput may be improved. Such a probabilistic data structure or Bloom filter may be referred to as a time-efficiency probabilistic data structure or Bloom filter, or policy probabilistic data structure or Bloom filter.
In a second example, a policy may include subsets of packet filtering rules that are identical except for their matching criterion or criteria associated with threat indicators. Rules may have the same action(s), the same threat metadata, and the same matching criterion or criteria, but the rules may not be associated with the same threat indicators. Space (e.g. memory usage) efficiencies for policy storage may be achieved by associating multiple different indicators with a single rule (e.g. the same action(s) and/or threat metadata). The TIG, or a policy management server, may, for example, sort or partition the plurality of rules of the security policy (or a portion of the security policy) into subsets based on the type of threat indicator(s) associated with the rules, and/or based on the actions and threat metadata associated with the rules. A subset associated with a single type of packet matching criterion or threat indicator may avoid unnecessary searches of rules associated with that subset. A search of the subset probabilistic data structure or Bloom filter may be skipped with the packet does not include the type of packet matching criterion associated with that subset. A subset associated with a single rule action may avoid unnecessary repeated storage of the rule action and unnecessary storage of individual rules, which may save memory space. For each such subset, an associated subset Bloom filter may be configured to contain all of the indicators of the associated rules, and the subset Bloom filter may be further associated with the common rule action(s) and threat metadata of the associated rules. The common rule action(s) and threat metadata of the subset may be stored a single time for the probabilistic data structure, rather than being stored for and associated with each rule of the subset. Then, for each such subset, the associated subset Bloom filter may replace the subset of rules in the policy, resulting in a reduction in space requirements for storing the policy. Thus, the policy may be represented as a collection of these probabilistic data structures or Bloom filters. During policy search, the packet filtering device tests if a packet's network addresses are members of any subset probabilistic data structure or Bloom filter. If the packet filtering device determines a match from a subset Bloom filter test, the action(s) and threat metadata associated with the subset Bloom filter may be applied to the packet. Time efficiencies may also be gained if the time to test an element, such as a network address, for membership in the subset Bloom filter is less than the time it would take to otherwise search through the subset of rules. In some applications, it may be useful to include a packet filtering rule that is applied when a Bloom filter membership test returns a FALSE or determines that there is not match of the packet with the set. That is, the subset Bloom filter may have two associated packet filtering rules, including a first rule that is applied when a membership test returns TRUE for an indication of a match and a second rule that is applied when a membership test returns FALSE for an indication of no match. Such a subset Bloom filter may be referred to as a space-efficiency Bloom filter.
In a third example, as TIG policies may become too large to be stored in available main memory, it may become impractical to increase main memory capacity sufficiently due to factors such as cost-of-goods, layout and density constraints, and power or heat limits. While secondary memory, which may be slower (e.g. as measured in read-access time) but correspondingly larger in storage capacity, denser, and cheaper (e.g. per byte) than primary main memory, may be added to the TIG. Such secondary memory may require some other RAM-like properties, such as byte-addressability, to support fast search algorithms. The capacity of the secondary memory may be sized to store policies that are too large to fit in the primary main memory. In order to ensure that TIG performance is sufficient, the ratio of secondary memory speed to primary main memory speed may be equal to or larger than the (expected) fraction of packets that will match the CTI-derived packet filtering rules. A time-efficiency Bloom filter that stores all of the indicators for the rules in the policy stored in secondary memory may be stored in the primary main memory. Before searching the policy stored in secondary memory, the packet filtering device may perform a fast initial search of the Bloom filter. If the initial search of the Bloom filter indicates a match, then the packet filtering device may perform a policy search and packet filtering via the secondary memory. If the initial search of the Bloom filter does not indicate a match, then the (relatively slow) search of the packet filtering rules in the secondary memory may be skipped.
In a fourth example, it may be advantageous to store Bloom filters and some portion of a packet filtering policy in a higher-speed memory (e.g., primary main memory) and other portions/the remainder of the policy in slower-speed memory (e.g., secondary memory). For example, it may be advantageous to store a first set of packet filtering rules with domain name and URI indicators in secondary memory, and store a second set of packet filtering rules with IP address and IP address range indicators in primary main memory, with time-efficiency Bloom filters corresponding to both rule sets stored in primary main memory. Depending on the kind of traffic associated with a particular protected network, it may be advantageous to prioritize (e.g. utilize higher speed memory) for certain types of rules. For example, it may be beneficial to use main memory for storing packet filtering rules with indicator types, such as IP addresses and IP address ranges, that are expected to be searched more frequently than rules with indicators types, such as domain names and URLs, that are expected to be searched less frequently. In a TCP/IP network, every packet contains IP addresses in the L3/IP header, whereas a smaller portion of packets contains domain names, and an even smaller portion contains URLs. Thus, if there is insufficient main memory to store all the filtering rules in a policy, then it may be beneficial, for example, to store rules with IP address indicators in main memory, and store rules with domain name and URL indicators in a secondary memory. For example, it may be beneficial to use main memory for storing rules associated with a popular protocol, such as HTTP/HTTPS (web) on port 80/443, as well higher frequency matching CTI rule properties (e.g. rules associated with lower fidelity threat indicators and rules associated with larger quantities of indicators by type) such as filtering rules for IP address and IP address range indicators that may be searched more frequently than filtering rules for domain name and URI indicators.
In a fifth example, it may be advantageous to integrate the methods described above in any combination, and with variations on the methods, in order to achieve further efficiencies. For example, a time-efficiency Bloom filter may be associated with a subset of CTI-derived packet filtering rules, and the subset may have some portion(s) of the rules represented by a space-efficiency Bloom filter(s). In practice, the combinations and variations that achieve the increased efficiency may depend on many factors, including factors such as CTI characteristics, performance requirements, costs, and operating environment.
In a sixth example, a Bloom filter or combination of filters as described above may be used to protect the Domain Name System (DNS) from some cyber attacks. The DNS is a service that translates human-readable domain names into machine-readable IP addresses. The DNS may be viewed as a large, globally distributed memory/store of {domain name, IP address} pairs and an associated processing system for translating human-readable domain names into machine-readable IP addresses. Many popular applications, for example the World Wide Web (WWW), depend on the DNS for efficient operation. Some cyber attacks on the DNS use bogus DNS query requests as the attack vector. A bogus DNS query request is a request to resolve a domain name that is not registered in the DNS.
There are at least two types of attacks on the DNS that may use bogus DNS query requests and that may be mitigated by processing methods described herein. First, a distributed denial-of-service (DDoS) attack on the DNS works by having many malware-infected devices issue bogus DNS query requests for domain names that are not registered in DNS. Such domain names may be generated in part by domain generation algorithms (DGAs), which may generate random alpha-numeric strings that are unlikely to match domain names that are registered in the DNS. The DNS may search futilely through a globally distributed database for a match that will never be found, which may require significantly more work/computational resources than searches for domain names that are registered in the DNS. If a sufficiently large number of these bogus requests are issued at the same time, then the DNS may expend a large amount of computational resources attempting to service the bogus requests, resulting in insufficient computational resources to service the legitimate DNS requests and may result in a denial of service. Many networked applications, such as the web, may use the DNS, so an effective DDoS attack on the DNS may act as an indirect attack on legitimate Internet applications that utilize the DNS. If the applications (for example, web browsers) are denied DNS service, then those applications do not know how to address packets such that the packets may be routed through the Internet to the target domains (for example, web servers).
Bloom filter technology and related efficiency methods may be used to mitigate such attacks. There are approximately 500 million domain names registered in the DNS. A (space efficiency) Bloom filter with the storage size M of approximately 600 MB and with a false positive rate P=0.01 may be configured with the N=500 million registered domain names. Copies of this Bloom filter may be distributed to, for example, (inline) packet filtering devices such as TIGs, that are configured to check if the domain name in any DNS query request is registered in DNS. If the Bloom filter test indicates that the DNS filter indicates a match (e.g. True), then the packet filtering device may forward the associated packet towards the packet's destination (for example, a DNS server). If the Bloom filter test indicates that the DNS filter indicates no match (e.g. False), the packet filtering device may drop the packet (and may, for example, generate and forward a corresponding packet containing the DNS query response with an appropriate return code). By dropping the packet, the search through the DNS is skipped. By locating these packet filtering devices configured with the Bloom filters at strategic points, for example, at Internet access links, and particularly Internet access links for networks operated by DNS infrastructure providers, then many of the bogus DNS query requests may be dropped/never serviced. Thus, many of the searches through the DNS are skipped, which may sufficiently mitigate the DDoS attack such that legitimate DNS query requests are serviced at acceptable rates;
A second type of DNS attack is an exfiltration attack that may exploit the DNS by encoding stolen sensitive information as the (bogus) domain name in DNS query requests. These bogus requests are sent to collection servers, which may be posing as DNS servers or may be legitimate DNS servers over which malicious actors have control, that may extract and record the domain names in the requests. By extracting and recording the stolen information presented in the DNS query requests, the sensitive information is exfiltrated or stolen. This type of cyber attack may be called a DNS tunneling attack.
To prevent such an attack, observe that it is unlikely that the domain names in such tunneling attack requests map to domain names that are registered in the DNS. Thus, to prevent such an attack, packet filtering devices configured with a (space-efficiency) Bloom filter, called the “DNS Bloom filter”, containing all the domain names registered in the DNS may be deployed at, for example, Internet access links for a protected enterprise networks. Each DNS query request may be filtered by a packet filtering device configured with the DNS Bloom filter. The packet filtering device may determine, based on a test of the DNS Bloom filter, if the domain name in any DNS query request is registered in DNS. If the packet filtering device determines that the DNS Bloom filter indicates a match (e.g. a membership test returns a True result), then the packet filtering device may forward the associated packet towards its destination (for example, a DNS server). If the packet filtering device determines that the DNS Bloom filter indicates no match (e.g. a False result), the packet filtering device may drop the associated packet, which may prevent a DNS tunneling attack.
For the foregoing DNS attack mitigation applications, it may be unnecessary to use CTI supplied by a CTI provider. Instead, those DNS attack mitigation applications may become a source of CTI data. When a membership test indicates no match (e.g. a false result), then the domain name being tested is determined to be not registered in the DNS. As such, the domain name may be identified as a threat indicator. The DNS attack mitigation applications therefore may be considered as sources of CTI, rather than consumers of CTI.
In a seventh example, Bloom filter technology may be used to improve performance and security by applying threat intelligence that is derived from certificates used to secure some network communications. For example, the Hypertext Transfer Protocol Secure (HTTPS) protocol for secure web/HTTP communications may use the TLS protocol to securely tunnel HTTP. During TLS tunnel setup handshakes, X.509 certificates may be exchanged between two network endpoints. These certificates may have been issued by certificate authority (CA) organizations. However, certificates and CAs may be used as attack vectors in various ways by malicious actors.
Accordingly, CTI may be provided and determined for certificate and CA data. For example, CTI may be associated with revoked certificates. A CA may decide to revoke certificates that the CA has issued because the CA may believe that the certificate has been compromised in some way. For example, the private keys used during certificate generation may be determined to be stolen. CAs may publish certificate revocation lists (CRLs) that contain the serial numbers of revoked certificates. A related threat indicator may include a source and certificate data pair (e.g. {CA-Identifier, Serial Number}, where “CA-Identifier” corresponds to the “Issuer Name” value of X.509 certificates issued by the CA) that uniquely identifies the certificate. A CA may provide a server for downloading a CRL upon request or that may be queried regarding a certificate's revocation status. CRLs and CRL servers may be used, for example, by TLS endpoint applications (e.g. web browsers) and intermediaries (e.g., SSL/TLS proxies) during communication session tunnel setup to determine if a certificate associated with the communication session has been revoked. When a certificate associated with the communication session has been determined to be revoked, the communication session tunnel setup may be terminated, alerted, monitored, or otherwise handled, in order to mitigate the risk associated with using a certificate that may be compromised.
In cases in which endpoints often do not check a certificate's revocation status, a resultant TLS tunnel may be readily decrypted by malicious actors. To mitigate such a threat, a CTI provider may collect CRL data published by a plurality of public certificate authorities, may convert the CRLs into threat indicators (e.g. {CA-Identifier, Serial Number} pairs), and may provide resultant CTI available to subscribers. These subscribers may include TIGs and/or security policy managers that service TIGs. As certificate-based CTI may include millions of indicators (there are approximately 20 million revoked certificates), a TIG may use time-efficiency and space-efficiency Bloom filters for this CTI and associated packet filtering rules when configuring a packet-filtering policy for securing a network. When a packet containing a certificate transits through the TIG, the TIG may extract the Issuer Name data from the certificate (which may correspond to the CA-Identifier), and a Serial Number from the certificate. The TIG may filter the packets based on the {CA-Identifier, Serial Number} pair through the appropriate Bloom filter(s) to determine the certificate's revocation status. If the certificate has been revoked, the TIG may apply an associated packet filtering rule to the associated packet determined to include the revoked certificate.
In an eighth example, a need to insert a rule or rules into an actively enforced policy may arise, for example, during a cyber attack event. A packet filtering rule may be inserted into a policy that is currently being enforced (inline) on network packet traffic by a packet filtering device, for example, a TIG, a network firewall, a router Access Control List (ACL), and the like. For performance and integrity reasons, the packet filtering rules of a policy may be ordered, sorted, indexed, and/or otherwise optimized in such a way that inserting a new packet filtering rule while maintaining optimality, performance, and integrity may be an expensive operation with respect to time and computational complexity and may cause allocation of additional memory and/or in-memory spatial reorganization of the data (rules) stored in memory. For example, a set of packet filtering rules may be sorted and indexed in such a way as to support a (sub-linear) binary search. Inserting a new packet filtering rule into the set may cause a memory allocation for storing the new rule and a re-indexing of the set to support the binary search. Thus, it may be impractical to insert a new rule into an active policy without causing a (temporary) halt in packet filtering service, which may cause a loss of packet transmission services, and/or may cause packet losses due to buffer overflows, and/or losses of the application or function derived from the packet filtering service (for example, network security).
Data structure filtering technology may be used to address the dynamic rule insertion problems of new memory allocation and reorganization that may cause disruptions in packet transmission service and/or loss of security. At least one empty space-efficiency Bloom filter may be provisioned, during policy creation or based on a change in a security policy, for use for rule insertion during active policy enforcement by a packet filtering device. Such dynamically fillable Bloom filters may be sized (M) to include up to some number (N) of elements (e.g. threat indicators) while keeping the false positive rate (P) below a specified value. For example, a dynamically fillable, initially empty Bloom filter may be provisioned that is associated with a “Block” action, and may allow the insertion of up to 100,000 indicators (of any type), at which point the false positive rate is 1012. When new indicators are (efficiently) inserted into the Bloom filter, there may be no need to allocate additional memory for storing the new indicator, nor may there be a need to reorganize the indicators in the set. Thus, adding new rules to the policy may not cause any new memory allocations nor any spatial reorganization of data in memory, and thus there is no loss of service or security. The side effect of indicator insertion is an increase in the Bloom filter's false positive rate. But, when less than 100,000 indicators have been inserted into this dynamically fillable Bloom filter, then the false positive rate will be less than the required maximum of 1012. When more than 100,000 indicators have been inserted, then the false positive rate may exceed the maximum false positive rate of 1012, but this may not cause loss of service or security. The insertion operation may not be considered efficient when the size of the set exceeds a threshold (e.g., time complexity of the search may vary with the magnitude of the logarithm of the false positive rate P) and does not cause any new memory allocations nor any spatial reorganization of data in memory. Thus, packet filtering service, and thus packet transmission service, should not be adversely affected by insertion of a rule into the active policy.
Another approach to the dynamic rule insertion problem is to allow for insertion of a new threat indicator and rule into an actively enforced policy without provisioning a dynamically fillable, initially empty Bloom filter. A new rule may be added or inserted into the active policy by inserting an associated indicator into an appropriate space-efficiency Bloom filter. As additional indicators are added, the associated filter's false positive rate will increase. Such a Bloom filter may have a threshold limit for additional indicators, and that limit may be associated with a threshold false positive rate considered to be tolerable for the associated application. The threshold false positive rate may be set by a system or policy administrator.
The first approach to rule insertions during active policy enforcement, using a dynamically fillable, initially empty Bloom filter, may be more effective when the number of rule insertions is expected to be relatively large compared to the number of rules in the policy (at policy creation time), and when false positive rates must be strictly maintained or have relatively low tolerances. The second approach to rule insertions during active policy enforcement may be more effective when the number of rule insertions is expected to be relatively small compared to the number of rules in the policy (at policy creation time), and when false positive rates have relatively high tolerances. As noted above, standard Bloom filters do not support element deletions from the set. As such, for applications that may require rule deletions, (probabilistic) data structures that have similar properties as standard Bloom filters but that also support efficient element deletions, such as some Bloom filter variants, Cuckoo filters, and the like, should be used to represent policies.
Bloom filters may also be used to ensure privacy for some CTI applications. For example, consider a first organization Org X that collects threat intelligence/threat indicators on threat actors in the form of network addresses. The first organization Org X may want to distribute a set of these indicators to a second organization Org Y, so that Org Y may search for/detect these indicators in network communications traffic. However, in some cases, such indicators may be considered highly sensitive (e.g. classified or sensitive personal information); therefore, Org X may not want to publish/distribute the indicators in a form that may compromise the privacy of the indicators. Org X may not want Org Y to be able to identify the indicators in the set, in case, for example, that Org Y leaks them to or allows them to be stolen by malicious actors. Yet Org X wants Org Y to be able to detect when these indicators appear in network communications traffic.
Bloom filter technology may be used to achieve these multiple objectives. Org X may Insert( )the indicators into a sensitive data Bloom filter B, and an indicator encoding algorithm may be used to populate sensitive data Bloom filter B. The Insert( )function encodes the set of indicators with an encryption key, such as a bit vector (e.g. an array of 0s and 1s), in such a way that it is computationally intractable to invert the key or bit vector and thus determine the indicators in the set, even when the encoding algorithm used by the Insert( )function is known. Thus, Org X can distribute sensitive data Bloom filter B to Org Y without compromising the privacy of the indicators contained in B. Furthermore, if the sensitive data Bloom filter B or the data structure's bit vector is stolen by malicious actors, the malicious actors similarly have no way of determining the indicators in the set. At the same time, Org Y can use a sensitive data Bloom filter B to detect occurrences of the indicators in network communications traffic by extracting network addresses in the traffic, and then testing the network addresses for membership in B.
Furthermore, the first organization Org X may want to control which external entities are able to perform membership tests on sensitive data Bloom filter B. For example, in some situations, Org X may want the second organization Org Y to be able to perform membership tests on sensitive data Bloom filter B, but Org X may not want a third organization Org Z, which is associated with some set of threat indicators, to be able to test for membership of those indicators in sensitive data Bloom filter B if Org Z has obtained a copy of the bit vector contained in sensitive data Bloom filter B. In other words, Org X may not want Org Z to know that Org X has collected threat intelligence associated with Org Z.
To perform a membership test Member( )on sensitive data Bloom filter B, the Member( )function must use the same encoding algorithm A used by the Insert( )function to populate the sensitive data Bloom filter B with the indicators. The encoding algorithm A is composed of specific arithmetic combinations of certain selected hash functions and simulated hash functions. Thus, Org X may secretly and/or securely share the encoding algorithm A with Org Y, and may separately distribute to Org Y only the bit vector contained in B instead of B itself. Org Y may perform membership tests on sensitive data Bloom filter B. Org X may not share the encoding algorithm A with Org Z, so that even if Org Z obtains a copy of the bit vector contained in B, Org Z cannot perform membership tests on sensitive data Bloom filter B.
The subject matter described herein may be implemented using any combination of hardware, software, or firmware. For example, the subject matter described herein may be implemented using a non-transitory machine-accessible and readable medium having stored thereon machine-executed instructions for controlling the machine to perform steps. Exemplary machine readable media suitable for implementing the subject matter described herein include disk memory devices, chip memory devices, programmable logic devices, application specific integrated circuits, and downloadable electrical signals. In addition, a machine readable medium that implements the subject matter described herein may be implemented using a single device or computing platform or may be distributed across multiple devices or computing platforms. Other details and features will be described in the sections that follow.
The present disclosure is pointed out with particularity in the appended claims. Features of the disclosure will become more apparent upon a review of this disclosure in its entirety, including the drawing figures provided herewith. Some features herein are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, in which like reference numerals refer to similar elements, and wherein:
In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. It is to be understood that other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the disclosure. In addition, reference may be made to particular applications, protocols, and embodiments in which aspects of the disclosure may be practiced. It is to be understood that other applications, protocols, and embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the disclosure.
Various connections between elements are discussed in the following description. These connections are general and, unless specified otherwise, may be direct or indirect, wired or wireless, physical or logical (e.g., virtual or software-defined), in any combination. In this respect, the specification is not intended to be limiting.
Network 112 may be an exemplary enterprise network protecting its networked corporate assets using CTI-derived policies and a TIG 200 that implements aspects of the present disclosure, such as very large policies that require the space, time, and resource efficiencies achieved by the disclosure. TIG 200 may be subscribed to SPM 120 for policies derived from CTI that is supplied by many CTI providers and that spans a range of indicators, indicator types, attack types, risk values, indicator fidelities, etc., resulting in policies composed of tens of millions or hundreds of millions of packet filtering rules that may be characterized by their associated threat indicators.
Network 114 may be an exemplary network operated by a DNS infrastructure and managed services provider organization, with networked corporate assets that include DNS servers and proxies, for example hosts 132 and 133, that handle large volumes of DNS traffic, often on behalf of organizations that value high-performance DNS services, such as DNS domain name registry operators, authoritative name server providers, large global enterprises, content delivery network providers, ISPs, and the like. Network 114 is protected by TIG 250, which may be subscribed to SPM 120 for policies derived from CTI, and which may be configured with packet filtering logic that may determine if domain names included in packets are registered in DNS.
Network 116 may be a corporate enterprise network that is not protected/secured by TIGs and associated policies. Hosts 134 and 135 attached to Network 116 may be infected by malware or otherwise controlled by malicious actors.
Network 118 and associated networked assets may be controlled/operated by an organization of malicious actors. Network 118 is not protected/secured by TIGs and associated policies. Hosts 136 and 137 attached to Network 118 may be used by the organization to execute various attacks on remote network assets via Network 110 (e.g., the Internet), such as Networks 112, 114, and 116.
The memory modules 230-239 may form a hierarchy that is tiered/parameterized by speed (read/write access time), density (bytes per unit volume in 3D space), capacity (measured in bytes), and cost per byte. Capacity, measured in bytes, may be highly correlated with density, because of space limitations associated with the memory type and location. (Capacity and density may be used interchangeably in this disclosure). Smaller-enumerated memory modules (e.g. TIER-0 MEM 230) may be associated with higher speeds, lower capacities, and higher costs than the higher-enumerated memory modules (e.g. TIER-3 MEM 233). Generally, speed and cost decrease, and capacity increases, as the enumeration increases from 230 to 239. The parameters of adjacent tiers may vary by one or more orders of magnitude. For example, TIER-0 MEM 230 may be on-chip SRAM cache memory; TIER-1 MEM 231 may be on-PCB SDRAM “main memory”; TIER-2 MEM 232 may be on-PCB NVRAM (e.g. NAND FLASH SSD); TIER-3 MEM 233 may be magnetic mechanical/spinning disk; and so on, with TIER-N+1 MEM 239 identified with the globally distributed memory used, for example, by the Internet DNS to store {domain name, IP address} pairs and associated information.
The hierarchical memory may enable cost effective implementation of features described herein related to time and space efficiency. A policy or partition(s) of a policy, as well as any associated Bloom filters, may be stored in the highest speed memory with sufficient space/available capacity. The policies may be stored after processing policy rules to achieve time-efficiency and/or space-efficiency measures, such as using Bloom filters to exploit rule match rates/probabilities and rule redundancies. That is, the rules or a policy may be processed to minimize the size of a Bloom filter, to minimize the false positive rate of a Bloom filter, or to eliminate redundant rules within a Bloom filter. If a TIG's performance measurement value does not meet an acceptable threshold, a TIG may allocate one or more memory tiers to the memory hierarchy of a TIG configuration. The TIG may also provide a hierarchal system of Bloom filters to reduce the number of packet filtering rule searches in a policy without compromising security.
An SPM or a TIG may order and group the rules to meet some requirements and/or support TIG capabilities. For policies derived from CTI, the rules may be ordered/grouped in such a way as to improve security, improve TIG performance (for example, to decrease policy search time), improve cyberanalysis efficiency, etc. Rules may be ordered and sub-ordered, for example, by the indicator type and associated fidelity, or if the rules have identical actions and threat metadata (but have different indicators). The network-address indicator types may be URI, domain name, and IP address, and the associated rules may be ordered by decreasing fidelity. For example, URI rules may precede domain name rules, and domain name rules may precede IP address rules. Similarly, for certificate-related indicator types, certificates have higher fidelity than certificate authorities, which may be factored in to the ordering of associated packet filtering rules. Rules may also be ordered and sub-ordered by the rule action(s) or by order (in)dependencies. For example, rules with a block/deny/drop action may precede rules with non-blocking action(s). Rules that are order-independent may be re-arranged without changing the integrity of the policy. Various combinations of ordering and grouping criteria may be used. The rules may be ordered and grouped in such a way as to support/optimize time and/or space efficiencies.
In Step 3-2, the policy may be partitioned into subsets of rules where each subset may admit time and/or space efficiencies, according to the methods described herein. For example, a subset of rules with indicators that may be expected to have a relatively low rate of matching the network addresses of filtered packets may achieve a time efficiency by skipping the search for a matching rule, if it is known before initiating a search if the current network address does not match any of the indicators in the rules in the subset. Another space efficiency may be achieved if each rule in a subset has the same action(s) and same threat metadata (but a different indicator), as the subset of rules may be efficiently stored in memory as the set of (different) indicators associated with the single instance of the identical action(s) and threat metadata.
In Step 3-3, for each subset, a Bloom filter may be configured that contains each indicator for each rule in the subset. Each Bloom filter may be associated with a subset of rules, and may also be associated with the type or types of indicators the filter contains, in order to allow for further efficiencies. For example, a Bloom filter and its associated rule subset may only contain URI and domain name indicators; then the packet filtering device may search the policy for a rule with an indicator of type IP address, the search through a URI and domain name subset Bloom filter (and associated subset of rules) may be skipped. For time-efficiency Bloom filters, a pointer to a location in the (hierarchical) memory where the associated subset of filtering rules may be stored. The time-efficiency Bloom filter and its associated rule subset may be stored in the same tier of the memory hierarchy, or it may be the case that the Bloom filter may be stored in a different (e.g. faster) tier of the memory hierarchy than its associated subset because the subset of rules may be too large to fit in the same tier as its Bloom filter. Thus, the associated rule subset may be stored in a memory tier with more capacity (but with slower speed). The Bloom filter, to achieve space efficiency, may be associated with the single instance of the action(s) and threat metadata associated with all of the (different) indicators in the Bloom filter and associated subset of packet filtering rules.
In some cases, a rule subset may not produce time or space efficiencies, and/or there may be a requirement that the subset always be searched, and/or the rules may not be derived from CTI or otherwise may not be characterized by threat indicators. To associate a subset Bloom filter with each subset in the policy, a universal Bloom filter may be associated with such a rule subset that may always return TRUE value for any set membership test for any network address/element input. A universal Bloom filter may not require any memory/storage space for storing associated rule elements. A universal Bloom filter may be associated with one or more indicator types if each rule in the associated subset includes indicators of only those one or more indicator types. This may produce efficiencies when the rules in the associated subset only have indicators of type “IP address”, and the current network address being searched for may be a URL. Thus, even though the membership test for the URL being in the universal Bloom filter may return a TRUE result, the subset search may be safely skipped. The universal Bloom filter may be considered a special case of a time-efficiency Bloom filter.
Furthermore, in some situations, it may be advantageous to associate a single time-efficiency Bloom filter with multiple subsets or even all subsets (e.g. the entire policy). It may be more time-efficient to test for element membership in a single set X than to separately perform membership test for a plurality of subset Bloom filters associated with each subset associated with a partition of the single set X. For example, for a policy including a subset J of filtering rules associated with domain-name indicators and a subset K of filtering rules also associated with domain-name indicators, where the domain-name indicators in J are all different than the domain-name indicators in K. Two Bloom filters J′ and K′ may be generated that respectively contain the domain-name indicators of J and the domain-name indicators of K, and that a third Bloom filter L′, which acts as a combined subset filter, may be generated that contains the domain-name indicators of both J and K (each Bloom filter may have the same false positive rate P). The time to test membership in the single combined subset Bloom filter L′ may be less than the sum of the time to test membership in Bloom filter J′ and the time to test membership in Bloom filter K′.
Steps 3-2 and 3-3 are described herein as being executed by the TIG 200, but those steps may be executed by the SPM 120, or some portions of the steps may be divided between the TIG 200 and the SPM 120. If some portion of the Bloom filters may be computed by the SPM 120, the policy may be downloaded by the TIG 200, and the policy file may also include any associated Bloom filters and associated information. Another example is if the SPM 120 performs the partitioning of the policy into subsets and specifies the types(s) of efficiency, or Bloom filter(s), to be used (e.g., time efficiency, space efficiency, no efficiency (universal), etc.) for each subset, but then the TIG 200 configures the Bloom filters.
In Step 3-4, the subset Bloom filters and their associated subsets of the policy may be distributed, by the packet filtering device or the SPM 120, and may be stored in the memory hierarchy. Bloom filters and their associated subsets may be stored in the fastest memory module with sufficient available capacity. Time-efficiency Bloom filters may be stored in memory modules that are as fast as, or faster than, the memory storing rule subsets associated with the filter. Bloom filters may have priority over subsets of the policy with respect to memory capacity. The packet filtering device may determine a memory module for storing a Bloom filter or a rule subset of the policy based on a determined remaining capacity for each memory of the packet filtering device. The packet filtering device may prioritize storage of Bloom filters, such that a rule subset may not displace a Bloom filter for reasons of capacity.
In Step 3-5, the TIG 200 may receive at least one in-transit packet (via a network interface/device port) to begin the packet filtering process. In Step 3-6, network addresses and certificate-associated identifiers (if any) that may correspond to the threat indicators of the rules in the policy are extracted from the packet. The network addresses may be a source IP address and/or a destination IP address in an L3/IP-layer packet header, a domain name in a DNS query request message in a L7/applications-layer packet, a URL and domain name in an HTTP GET request method in the L7/applications-layer packet, and the like. The certificate-associated identifiers may include data extracted from fields contained in the X.509 certificates that may be included in TLS Certificate messages, such as the pair {Issuer Name, Serial Number} that uniquely identifies or characterizes an X.509 certificate, and identity data associated with the certificate authority that issued a certificate, which may include the certificate's Issuer Name.
In Step 3-7, the packet filtering device 200 may search for the network address or other identifier in each subset Bloom filter, as appropriate or based on a determination of associated threat indicator, for each network address and certificate-associated identifier (if any) extracted from the packet, and may search the data in the order corresponding to an ordering defined by the policy. The search may be conducted until either (T) the network address is found to be an element/member of a Bloom filter (a match is true result), or until (F) all of the Bloom filters have been searched unsuccessfully (a no match or match is false). Based on a no match result of the Bloom filter search, the network address or identifier may be determined not to be a member of any subset Bloom filter set and, thus, there is no filtering rule in the policy that will match and no filtering rule operator that must be applied. Based on the no match result (F), in Step 3-8F, packet filtering device 200 may halt the search process because it has been determined that there is no rule in the policy with a matching indicator, and may return the search processing to Step 3-5 to filter the next in-transit packet. Based on a match result (T), in Step 3-8T, packet filtering device 200 may search for a packet-filtering rule in the policy subset(s) associated with the Bloom filter with an indicator that matches the network address or identifier. In Step 3-9, packet filtering device 200 may apply the filtering rule's action(s) to the packet, and may return the packet processing to Step 3-5 to filter the next in-transit packet.
If multiple network addresses or certificate-associated identifiers are extracted from the packet in Step 3-6, packet filtering device 200 may, in Step 3-8, determine an order in which each network address or identifier may be searched for in the subset Bloom filters based on an indicator fidelity associated with each network address and identifier. For example, if a URL and an IP address are extracted from a packet, the packet filtering device 200 may search for the URL in the Bloom filters before conducting a similar search for the IP address, because (in general) URL indicators have higher fidelity than IP address indicators. Similarly, if a certificate identifier and a certificate authority identifier are extracted from a packet, the packet filtering device 200 may search for the certificate identifier in the subset Bloom filters before conducting a similar search for the certificate authority identifier, because (in general) certificate indicators may have higher fidelity than certificate authority indicators.
In Step 4-1, the SPM 120 may send a file containing a policy to be enforced by TIG 200 on in-transit packets to the TIG's management interface MGMT I/F 240 (via Network 110 which may be, for example, the Internet). The policy file may include a header with a policy descriptor, which may include information such as a partitioning scheme partitioning the policy into two subsets, the type or types of efficiency to be applied to each subset, the size of the policy, the size of each subset, and the types of indicators in each subset. In Step 4-2, the MGMT I/F 240 may transfer (via BUS 210) the policy file to TIER-3 MEM 233, which may be lower speed memory such as a local mechanical/spinning magnetic disk (non-volatile, relatively large capacity, relatively cheap, relatively slow read/write access). In Step 4-3, the CPU 220 may retrieve the policy file header from the TIER-3 MEM 233. The policy file header may indicate how the policy is partitioned into subsets of rules, what efficiencies may be applied, and how the subsets may be distributed across multiple memory modules (if necessary, based on size information). As the CPU 220 processes the policy header file information, the CPU 220 may temporarily store portions of the information in, for example, TIER-0 MEM 230, which may be identified with on-chip cache memory, and in TIER-1 MEM 231, which may be identified with on-PCB main memory (not shown).
In Step 4-4, based on the policy file header information, the CPU 220 may retrieve subsets of packet filtering rules and may generate an associated subset Bloom filter. For example, CPU 220 may retrieve the first subset SS-1 from the disk 233, which is composed of packet filtering rules that have URL and domain name indicators. The policy header information may indicate that a policy wide time-efficiency Bloom filter should be generated for the first subset SS-1. CPU 220 may extract all of the indicators in the first subset, and may insert the extracted indicator data into a time-efficiency or policy Bloom filter B/F-1 (which may be configured for a false positive rate P). CPU 220 may associate the Bloom filter B/F-1 with the first subset SS-1, and may associated the Bloom filter B/F-1 with the types of indicators (“URL”, “domain name”) that the Bloom filter contains. In Step 4-5, the CPU 220 may analyze the memory capacity and may determine that main memory 231 has sufficient remaining available capacity to store the Bloom filter B/F-1 and its associated first subset SS-1, as well as the second subset SS-2. Accordingly, CPU 220 may store the time-efficiency Bloom filter B/F-1 and the first subset SS-1 in main memory 231.
In Step 4-6, based on the policy file header information, the CPU 220 may retrieve the second subset SS-2 from the disk 233, which may be composed of packet filtering rules that have indicators of type IP address and IP address range. Based on a determination that the policy header information specifies no specific subset efficiency for the second subset SS-2, the packet filtering device may generate a universal Bloom filter B/F-2 with types {“IP address”, “IP address range”} to be associated with SS-2. The universal Bloom filter B/F-2 may be related to a plurality of threat indicator types. Based on an analysis of the memory capacity, in Step 4-7, the CPU 220 may store the universal Bloom filter B/F-2 and the second subset SS-2 in main memory 231. When it is determined that each subset of a policy has been processed or stored, the TIG 200 may determine that configuration for packet filtering for the current policy is complete.
In Step 5-2, the network interface 212 of TIG 200 may receive and ingest the in-transit HTTP get domain name packet, and may transfer received packets via BUS 210 to CPU 220 for filtering. The CPU 220 may extract data to be used for packet filtering, such as (a) domain name www.enterprise-xyz.com from the request/packet, and (b) destination IP address 12.34.56.78. The CPU 220 may sort the extracted data based on policy rules and may search the policy for each indicator in decreasing order of indicator type fidelity as defined by the policy. The CPU 220 may search the policy for matching rules based on a higher fidelity indicator such as domain name www.enterprise-xyz.com. If no match is determined, CPU 220 may search for rules matching a lower fidelity indicator such as the IP address 12.34.56.78.
In Step 5-3, CPU 220 may test the indicator types associated with (and contained in) B/F-1, the time-efficiency Bloom filter for the first subset SS-1 of packet filtering rules, to determine if they match the type of www.enterprise-xyz.com (domain name). Since B/F-1 contains indicators of type “domain name” and “URL”, then CPU 220 may determine if www.enterprise-xyz.com is a member of B/F-1. When it is determined that a first subset SS-1 of the policy does not include a packet-filtering rule with the threat indicator www.enterprise-xyz.com, the B/F-1 membership test for www.enterprise-xyz.com returns FALSE or no match value, and the CPU 220 may skip a search through the first subset SS-1 of packet filtering rules. For a packet including an IP address, the CPU 220 may determine the indicator types associated with (and contained in) B/F-1, the Bloom filter associated with the first subset SS-1 of packet filtering rules, to determine if they match the type of 12.34.56.78 (IP address). Since B/F-1 contains indicators of type “domain name” and “URL”, CPU 220 may skip the membership test for B/F-1 (and therefore may skip the search through the rules of SS-1).
In Step 5-4, CPU 220 may then determine the indicator types associated with B/F-2, the universal Bloom filter associated with the second subset SS-2 of packet filtering rules. Since the indicator types associated with B/F-2 are “IP address” and “IP address range”, CPU 220 may skip the membership test for B/F-2 for the domain name www.enterprise-xyz.com and may also skip the search through the rules associated with the second subset SS-2. For a packet including the IP address 12.34.56.78, CPU 220 may determine the indicator types associated with B/F-2, the Bloom filter associated with the second subset SS-2 of packet filtering rules, to determine if they match the type of 12.34.56.78 (IP address). Since there is an indicator type match, CPU 220 may determine if the IP address associated with the packet 12.34.56.78 is contained in B/F-2. When the B/F-2 is a universal Bloom filter, the search may return a TRUE value. CPU 220 may search the second subset of rules for SS-2 for a packet-filtering rule with an indicator that matches 12.34.56.78. When no match is found, no actions or rule operators are applied to the packet, and the packet may be forwarded to its intended destination. Based on a determination of no match, in Step 5-5, the CPU 220 may transfer the packet to network interface 214 via BUS 210. In Step 5-6, the network interface 214 may forward packets that do not match a packet filtering rule to the network 110 towards the target destination web site www.enterprise-xyz.com (which is hosted by server 134 with IP address 12.34.56.78).
In Step 5-7, a human user operating an e-mail application hosted by desktop computer 131 attached to Network 112 may click on a URL link http://www.cyber-threat-network.com/download/malware.exe embedded in a phishing e-mail. Based on that action, the computer 131 may initiate a web/HTTP session with a web site named www.cyber-threat-network.com hosted by sending packets toward server 136 attached to Network 118. After resolving the domain name www.cyber-threat-network.com in the DNS to an IP address such as 87.65.43.21, the computer 131 may establish a TCP connection between computer 131 and 136 on port 80/HTTP, and the computer 131 may forward a packet towards 136 containing an HTTP GET request for the URL http://www.cyber-threat-network.com/download/malware.exe. In Step 5-8, the network interface 212 of TIG 200 may receive and ingest the in-transit packet and may transfer the packet via BUS 210 to CPU 220 for filtering. The CPU 220 may extract the (a) URL http://www.cyber-threat-network.com/download/malware.exe and (b) the destination IP address 87.65.43.21 from the request/packet. The CPU 220 logic may be configured to search the policy for indicators in decreasing fidelity. Based on the fidelity determined for each type of threat indicator associated with the packet, the CPU 220 may first search the policy for rules matching the URL (e.g. http://www.cyber-threat-network.com/download/malware.exe), then (if necessary) may search for rules matching 87.65.43.21.
In Step 5-9, CPU 220 may determine the indicator types associated with (and contained in) B/F-1, the Bloom filter for the first subset SS-1 of packet filtering rules, in comparison to the indicator types associated with the received request/packet to determine if the B/F-1 indicator types match the type URL (e.g. http://www.cyber-threat-network.com/download/malware.exe). When the B/F-1 contains indicators of type “domain name” and “URL”, the CPU 220 may determine if the URL http://www.cyber-threat-network.com/download/malware.exe is a member of B/F-1. When the first subset SS-1 in the policy does include a packet-filtering rule with the threat indicator http://www.cyber-threat-network.com/download/malware.exe, the B/F-1 membership test returns a TRUE value. Based on the determination of a match from the B/F-1 membership test, in Step 5-10, the CPU 220 may search through the first subset SS-1 of packet filtering rules to find the matching rule. The CPU 220 applies the action or operator for the rule, which may be to BLOCK, or drop, the packet. CPU 220 may then halt its search through the policy, and may return a value, for example a TCP RST packet, to the originating computer to terminate the connection request (not shown in
In Step 6-4, based on the policy file header information, the CPU 220 may retrieve the first subset SS-1, which may be composed of packet filtering rules that have URL and domain name indicators, from the disk 233. The policy header information may indicate that a time-efficiency Bloom filter should be constructed for the first subset SS-1, and the CPU 220 may extract all of the indicators in the first subset, and may insert those indicators into a Bloom filter B/F-1 (which has, for example, been configured for a false positive rate P). CPU 220 may associate the Bloom filter B/F-1 with the first subset SS-1, and with the indicator types (“URL”, “domain name”) of the rules contained in SS-1. In Step 6-5, based on policy header file information, the CPU 220 may determine that main memory 231 has sufficient available capacity to store subset SS-1, but does not have sufficient available capacity to store both subsets SS-1 and SS-2. Because of the lower likelihood that SS-1 will need to be searched, CPU 220 may determine that SS-1 will be stored in a secondary memory module TIER-2 MEM 232 (that has sufficient available capacity to store the first subset SS-1, but is slower than main memory 231). Based on the capacity determinations, in Step 6-5A, CPU 220 may store the first subset SS-1 in memory module 232, and may associate the memory location of SS-1 with its associated Bloom filter B/F-1. In Step 6-5B, CPU 220 may store the Bloom filter B/F-1 in main memory 231.
In Step 6-6, based on the policy file header information, the CPU 220 may retrieve the second subset SS-2 from the disk 233, which may be composed of packet filtering rules that have indicators of types “IP address” and “IP address range”. The policy header information may indicate that a time-efficiency Bloom filter should be constructed for SS-2. CPU 220 may extract all of the indicators in SS-2, and may insert the extracted threat indicators into a Bloom filter B/F-2 (which has, for example, been configured for a false positive rate P). CPU 220 may also associate the Bloom filter B/F-2 with the second subset SS-2, and may associate the Bloom filter B/F-with the types of indicators (“IP address”, “IP address range”) that it contains. In Step 6-7, the CPU 220 may determine that there is sufficient available memory in main memory 231 to store the Bloom filter B/F-2 and the second subset SS-2. Based on the capacity determination, the CPU 220 may store B/F-2 and the rules of the subset SS-2 in main memory 231. Based on a determination that the TIG 200 has completed configuration for efficient packet filtering for the received policy, the TIG 200 may begin to receive packets and begin filtering those packets using the generated Bloom filters.
The first subset SS-1 of packet filtering rules may be represented by a space-efficiency probabilistic data structure or Bloom filter B/F-1 and the associated information as discussed below, such as an associated threat indicator type and an associated rule action. The indicators for the rules are the elements of the set of all domain names that are registered in the Internet DNS. These indicators are contained in the DNS Bloom filter B/F-1. The memory module associated with SS-1 may be the Internet DNS itself, which may be considered a globally distributed database of {domain name, IP address} pairs. This memory module may be identified with TIER-N+1 MEM 239 of
The second and third subsets, respectively SS-2 and SS-3, are also represented by, respectively, space-efficiency Bloom filters B/F-2 and B/F-3 (and associated information). For exemplary purposes, suppose both B/F-2 and B/F-3 are derived from a list of domain names from a single CTI provider (and thus any corresponding rules may have the same threat metadata), but each of the corresponding packet filtering rules have a single action: one of either a BLOCK action (e.g. an operation to drop the packet) or a MONITOR action (e.g. an operation to allow/forward the packet, but that may also log and capture the packet for possible subsequent threat analysis). The SS-2 may contain all of the rules with the BLOCK action, and accordingly associated B/F-2 may contain or represent all of the indicators for the rules with the BLOCK action. SS-3 may contain all of the rules with the MONITOR action, and accordingly the associated B/F-3 may contain all of the indicators for the rules with the MONITOR action. Thus, any determination of the TRUE result to a test of B/F-2 may result in the application of a BLOCK action and may store the CTI provider and associated threat metadata, and packet and environmental data as a log of the threat event (for subsequent use in, for example, cyberanalysis applications). Similarly, any determination of the TRUE result for a test of the B/F-3 may result in the application of a MONITOR action and may store the CTI provider and associated threat metadata, and packet and environmental data as a log of the threat event. The FALSE rule for both B/F-2 and B/F-3 may result in the application of a null operation or action, which may signal the packet filtering logic to continue searching the policy for a matching rule. The false positive rate P2 associated with B/F-2 may be limited to (much) smaller/lower than the false positive rate P3 associated with B/F-3. As rule subset SS-2 is composed of only BLOCK rules, a false positive/TRUE membership test result for B/F-2 means that the current packet may be blocked/dropped when it should not be, which is highly undesirable, assuming that the current packet is part of a legitimate business communication of the network being protected. As rule subset SS-3 is composed of only MONITOR rules, a false positive/TRUE membership test result does not result in the dropping/blocking of legitimate business traffic. In practice, the false positive rate P2 may be, for example, 1/1012 (one in a trillion). That is, it is expected that only one in a trillion legitimate HTTP GET requests, for example, may be mistakenly dropped, an event that may never occur in practice; whereas typical values for the false positive rate P3 may be, for example, 1/103 (one in a thousand) or 1/106 (one in a million). As discussed above, the system cost for lower false positive rates P for Bloom filters is an increase in memory space requirements. However, memory space requirements may vary with the logarithm of the false positive rate P. Thus, a Bloom filter for a set of N elements with a false positive rate of 1/1012 requires only twice the memory space as a Bloom filter for the same set of N elements with a false positive rate of 1/106, even though the false positive rates differ by a factor of one million. These decisions may be made based on capacity thresholds associated with each memory provided in a packet filtering device, and are an example of selecting false positive rates for space-efficiency Bloom filters. The fourth subset SS-4 may include packet filtering rules that have indicators of type “IP address”. The indicators may be contained in a time-efficiency Bloom filter B/F-4 that is computed by the policy manager SPM 120. The fourth subset SS-4 may not use a space-efficiency Bloom filter for representation.
False positive rates may be selected as follows. False positives are undesirable, thus relatively low false positive rates are desirable. One of the benefits of the disclosed systems and methods is improvement of the efficiency of memory/storage space usage; but because a Bloom filter's size (e.g. memory/space requirement) increases as the false positive rate decreases, it is (conversely) undesirable for false positive rates to be unnecessarily low. Thus, to select a false positive rate, the system should factor in the adverse effects of a false positive. For a time-efficiency Bloom filter, the adverse effect of a false positive is that the associated subset of packet filtering rules is unnecessarily searched, so there is a (small) time/latency cost; however, as a matching rule for a false positive will not be found, no action will be applied (in error) to the current packet and the adverse effect is only a delay in response. For a space-efficiency Bloom filter, however, the adverse effect of a false positive is that the action(s) of a matching rule will be applied in error to the current packet. If the action is to block/drop the (legitimate) packet, or otherwise modify/transform the packet, then the adverse effect of the false positive may be considered significantly adverse. If the actions are to allow the (legitimate) packet but log and capture a copy of it for subsequent cyber analysis, then the adverse effects are not as serious. Considering all of these factors, a method of selecting false positive rates will select such that (1) the false positive rates for time-efficiency Bloom filters may be higher than false positive rates for space-efficiency Bloom filters; (2) the false positive rates for space-efficiency or subset Bloom filters may be determined in part by the associated action(s): (a) when the action(s) cause the current in-transit packet to be dropped/blocked, the false positive rate should be relatively low, and also should be absolutely low such that in practice, a false positive may never occur (e.g., 1/1012, or one in a trillion); (b) when the action(s) do not cause the current in-transit packet to be dropped/blocked, then the false positive rate can be relatively higher, but also relatively lower than the false positive rates for time-efficiency Bloom filters. Finally, the false positive rate for a universal Bloom filter may be undefined, so a rate may not need to be selected for universal Bloom filters.
The illustration in
In Step 8-6, based on the policy file header information, the CPU 220 may retrieve two rule subsets SS-2 and SS-3 from the disk 233. As discussed above, SS-2 and SS-3 may be represented by space-efficiency Bloom filters B/F-2 and B/F-3 and associated information. In Step 8-7, when it is determined that there is sufficient available capacity in main memory 231, CPU 200 may store B/F-2 and B/F-3 and associated information, which may include rules for SS-2 and SS-3, in TIER-1 MEM 231. In Step 8-8, based on the policy file header information, the CPU 220 may retrieve the subset SS-4 from the disk 233 and may compute a time-efficiency Bloom filter B/F-4, which contains all of the indicators (of type “IP address”) associated with the packet filtering rules in SS-4. In Step 8-9, when it is determined that there is sufficient available capacity in main memory 231, CPU 200 may store B/F-4 and SS-4 in TIER-1 MEM 231. The TIG 200 may then be configured for efficient packet filtering for the current policy and may begin processing packets.
In Step 9-1, for example, a human user operating an e-mail application hosted by desktop computer 131 attached to Network 112 may click on a URL link http://www.cyber-threat-network.com/download/malware.exe in a phishing e-mail. The computer 131 may initiate a web/HTTP session with a web site named www.cyber-threat-network.com hosted by server 136 attached to Network 118. Before the computer 131 can connect to the web site, however, the desktop computer 131 may need to resolve the domain name www.cyber-threat-network.com to an IP address. Accordingly, computer 131 may generate and forward a packet containing a DNS query request (to resolve www.cyber-threat-network.com to its IP address) towards the Internet DNS service. The packet's destination IP address field value that may be contained in the L3/IP header, for example 18.27.36.45, may be the IP address of the DNS server that computer 131 has been configured to contact for DNS service. The packet's destination port in the L4/TCP header may be 53, the port for DNS service. In Step 9-2, the network interface 212 of TIG 200 may receive and ingest the in-transit packet and may transfer the packet via BUS 210 to CPU 220 for filtering. CPU 220 may extract the (a) domain name www.cyber-threat-network.com from the DNS query request, and (b) the destination IP address 18.27.36.45. The packet filtering logic may be configured to filter for domain name indicators before filtering for IP address indicators. Thus, domain name www.cyber-threat-network.com may be filtered first through the policy.
In Step 9-3, CPU 220 may check the indicator types associated with (and contained in) B/F-1, the (space-efficiency) Bloom filter containing all of the domain names currently registered in the Internet DNS, to determine if the Bloom filter indicator types match the type (“domain name”) of www.cyber-threat-network.com. Since B/F-1 contains indicators of type “domain name”, then CPU 220 checks if domain name www.cyber-threat-network.com is a member of B/F-1. When the www.cyber-threat-network.com has been registered in the Internet DNS, the membership test may return a TRUE result. In Step 9-4, CPU 220 may transform the packet containing the DNS query request into a packet containing the corresponding DNS query response by sending the packet containing the request towards the Internet DNS (via network interface 214), represented by TIER-N+1 MEM 239. The CPU 220 may halt the search through the policy. In Step 9-5, Internet DNS 239 may generate a packet containing the corresponding DNS query response, which may include the resolved IP address (e.g. 87.65.43.21) for the domain name www.cyber-threat-network.com, and may send the packet to Host 131.
In Step 9-6, after resolving www.cyber-threat-network.com in the DNS, and establishing a TCP connection between computer 131 and host 136 on port 80/HTTP (the packets of which are efficiently filtered through the TIG 200 policy without a match), computer 131 may forward a packet towards 136 containing an HTTP GET request for http://www.cyber-threat-network.com/download/malware.exe. In Step 9-7, the network interface 212 of TIG 200 may receive and ingest the in-transit packet and may transfer the received packet via BUS 210 to CPU 220 for filtering. CPU 220 may extract from the packet (a) the URL http://www.cyber-threat-network.com/download/malware.exe, (b) the domain name www.cyber-threat-network.com, and (c) the destination IP address 87.65.43.21. The CPU 220 logic may be configured to search the policy for indicators in order of decreasing fidelity and, thus, CPU 220 may first search the policy for rules matching the URL http://www.cyber-threat-network.com/download/malware.exe, then search the domain name www.cyber-threat-network.com, and then search the IP address 87.65.43.21.
In Step 9-8, CPU 220 may determine the indicator types associated with (and contained in) B/F-1, the Bloom filter for the first subset SS-1 of packet filtering rules, to determine if they match the indicator type of URL http://www.cyber-threat-network.com/download/malware.exe (which is “URL”). When B/F-1 contains indicators of type “domain name” (but not “URL”), CPU 220 may skip the membership test for B/F-1 (and thus the search through SS-1). Similarly, the indicator types may be checked for B/F-2, B/F-3, and B/F-4 without a type match. Thus, the policy may not be searched when no rule exists that has an indicator that will match http://www.cyber-threat-network.com/download/malware.exe. In Step 9-9, CPU may search the policy for a rule with an indicator matching the domain name www.cyber-threat-network.com. The membership test of B/F-1 may return a TRUE value (e.g. www.cyber-threat-network.com is registered in the DNS). When the current packet is not a DNS query request, there is no rule action to be applied based on the indication of match from the membership test of B/F-1, and the policy search may continue. When a membership test in (space-efficiency) B/F-2 returns TRUE (e.g. a rule exists that has an indicator that will match http://www.cyber-threat-network.com/download/malware.exe), and the associated rule action is BLOCK, the packet may be dropped, which may prevent the malware download from occurring.
In Step 10-1, the malware executing on host 130 may send a packet addressed to Host 135 (with IP address, for example, 45.36.27.18) and destination port 53 (DNS) that may contain a DNS query request with the (bogus) domain name “visa5234334164939009.www.legit-domain.com”, which actually contains a credit card number. In Step 10-2, the network interface 212 of TIG 200 may receive and ingest the in-transit packet and may transfer the packet via BUS 210 to CPU 220 for filtering. CPU 220 may extract the (a) domain name visa5234334164939009.www.legit-domain.com, and (b) the destination IP address 45.36.27.18, from the DNS query request. The packet filtering logic may have been configured to filter for domain name indicators before filtering for IP address indicators. Thus, visa5234334164939009.www.legit-domain.com may be filtered first through the policy.
In Step 10-3, CPU 220 checks the indicator types associated with (and contained in) B/F-1, the (space-efficiency) DNS Bloom filter containing all of the domain names currently registered in the Internet DNS, to determine if they match the type (“domain name”) of visa5234334164939009.www.legit-domain.com. Since B/F-1 contains indicators of type “domain name”, then CPU 220 may check if domain name visa5234334164939009.www.legit-domain.com is a member of B/F-1. Since the bogus domain name visa5234334164939009.www.legit-domain.com has not been registered in the Internet DNS, the membership test returns FALSE value. In Step 10-4, CPU 220 may apply an operator or action associated with the FALSE result for a test of B/F-1 for DNS query requests. The false result action may be to (a) drop the current packet containing the DNS query request for visa5234334164939009.www.legit-domain.com, thereby preventing the exfiltration/DNS tunneling attack; (b) apply a packet transformation function that generates a packet containing the corresponding DNS query response with RCODE=3 (NXDOMAIN); and (c) may send the DNS query response towards the host 131. Based on the FALSE result for a test of B/F-1, the CPU 220 may halt the search through the policy.
DNS infrastructure provider networks such as Network 114 are designed and configured to receive many DNS query requests to service by, for example, DNS name servers 132 and 133; thus, during a DDoS attack on the DNS using bogus DNS requests as an attack vector, such networks may receive many of these bogus DNS requests. The TIG 250 may be configured as in
Host 131 that may be attached to (TIG-protected) network 112, and hosts 134 and 135 that may be attached to (unprotected) network 116, may be infected by malware that may issue bogus DNS requests when commanded by, for example, host 136 attached to network 118 (operated by malicious actors). Further, the DNS infrastructure (not shown) of the networked environment of
In Step 11-1, host 134 may generate and send a bogus DNS query request to resolve domain name ppk6h0ec.www.example-132.net towards DNS Server 132. In Step 11-2, host 135 may generate and send a bogus DNS query request to resolve domain name 61kwrari.www.example-132.net towards DNS Server 132, which may be sent simultaneously with the request from host 134. In Step 11-3, host 130 may generate and send a legitimate DNS query request to resolve domain name www.example-132.net towards DNS server 132, which may be sent simultaneously with requests from other hosts. In Step 11-4, host 131 may generate and send a bogus DNS query request to resolve domain name hyqlyn2c.www.example-133.net towards DNS Server 133, which may be sent simultaneously with requests from other hosts.
In Step 11-5, TIG 200 (a) may receive and ingest the legitimate DNS query request from 130, (b) may test B/F-1 to determine that domain name www.example-132.net is registered in the DNS, and (c) forwards the DNS query request towards DNS server 132. In Step 11-6, TIG 200 (a) may receive and ingest the bogus DNS query request from 131, (b) may test a DNS probabilistic data structure, B/F-1, to determine that a bogus domain name hyqlyn2c.www.example-133.net is not registered in the DNS, (c) may drop the DNS query request (packet), (d) may decide to generate/spoof the corresponding DNS query response with RCODE=3 (NXDOMAIN), and (e) may send the DNS query response back to origin host 131. In Step 11-7, TIG 250 (a) may receive and ingest the bogus DNS query request from 134, (b) may test B/F-1 to determine that bogus domain name ppk6h0ec.www.example-132.net is not registered in the DNS, (c) may drop the DNS query request (packet), (d) may decide to spoof/generate the corresponding DNS query response with RCODE=3 (NXDOMAIN), and (e) may send the DNS query response back to origin host 134. In Step 11-8, TIG 250 (a) may receive and ingest the bogus DNS query request from 135, (b) may test the B/F-1 to determine that bogus domain name 61kwrari.www.example-132.net is not registered in the DNS, (c) may drop the DNS query request (packet), (d) may decide to generate the corresponding DNS query response with RCODE=3 (NXDOMAIN), and (e) may send the DNS query response back to origin host 135.
In Step 11-9, TIG 250 (a) may receive and ingest the legitimate DNS query request from 130, (b) may test the B/F-1 to determine that domain name www.example-132.com is registered in the DNS, and (c) may forward the DNS query request towards DNS server 132. In Step 11-10, DNS server 132 (a) may receive the DNS query request from 130 to resolve www.example-132.com, (b) may service the request by searching the DNS for the IP address 12.34.56.78 assigned to www.example-132.com, (c) may generate the corresponding DNS query response, and (d) may send the DNS query response back to origin host 130. Based on the tests of domain name B/F-1, TIGs 200 and 250 may prevent the bogus DNS query requests from expending/wasting any DNS resources trying to resolve unregistered domain names. The denial-of-service attack may be remediated/prevented. Thus, the DNS may be fully available to service the legitimate DNS query requests.
In Step 12-1, the SPM 120 may send a file containing a next policy to be enforced by TIG 200 on in-transit packets to the TIG's management interface MGMT I/F 240 (via Network 110 which may be identified with, for example, the Internet). The policy file may include a header with a policy descriptor, which may include information such as a partitioning scheme of the set of packet filtering rules into subsets, the type or types of efficiency to be applied to each subset, the size of the policy, the size of each subset, and the types of indicators in each subset.
In Step 12-2, the MGMT I/F 240 may transfer (via BUS 210) the policy file to TIER-3 MEM 233, which may be identified with a local mechanical/spinning magnetic disk (non-volatile, relatively large capacity, relatively cheap, relatively slow read/write access). In Step 12-3, the CPU 220 may retrieve the policy file header from the disk 233. The policy file header may indicate how the policy is partitioned into subsets of rules, what efficiencies may be applied, and how the subsets may be distributed across multiple memory modules (if necessary, based on size information). As the CPU 220 processes the policy header file information, the CPU may temporarily store portions of the information in other portions of memory, such as TIER-0 MEM 230, which may be identified with on-chip cache memory, and in TIER-1 MEM 231, which may be identified with on-PCB main memory. These temporary storage events are not shown.
The policy descriptor data may specify a plurality of information. The policy descriptor data may specify that SS-1 is a subset of packet filtering rules, where each rule may include (a) a threat indicator of type Certificate-Identifier, which is a pair {CA-Identifier, Serial Number}; (b) a BLOCK packet operator or transformation function; and (c) the threat metadata such as “<threat-type=revoked certificate>”. SS-1 may be encoded as a space-efficiency Bloom filter B/F-1 using a false positive rate P=10−12. The policy descriptor data may specify that SS-2 is a subset of packet filtering rules, where each rule may include (a) a threat indicator of type domain name; (b) a BLOCK packet operator or transformation function; and (c) the threat metadata such as “<threat-type=credentials phishing site>”. SS-2 may be encoded as a space-efficiency Bloom filter B/F-2 using a false positive rate P=10−12. The policy descriptor data may specify that SS-3 is a subset of packet filtering rules, where each rule may include (a) a threat indicator of type domain name; (b) a MONITOR packet operator or transformation function; and (c) the threat metadata such as “<threat-type=malware CDN>”. SS-3 may be encoded as a space-efficiency Bloom filter B/F-3 using a false positive rate P=10′. The policy descriptor data may specify a time-efficiency Bloom filter B/F-ALL associated with and containing all of the threat indicators in SS-1, SS-2, and SS-3, and with a false positive rate P=10−3.
In Step 12-4, based on the policy file header information, the CPU 220 may retrieve the first subset SS-1 from the disk 233. CPU 220 may extract all of the indicators (of type Certificate-Identifier) in SS-1, and may insert the indicators into both the space-efficiency Bloom filter B/F-1 (with a false positive rate P=10−12) and the time-efficiency Bloom filter B/F-ALL (with a false positive rate P=10−3). CPU 220 may associate the Bloom filter B/F-1 with the packet transformation function BLOCK, with the threat metadata “<threat-type=revoked certificate>”, and with the indicator type Certificate-Identifier. CPU 220 may associate the indicator type Certificate-Identifier with B/F-ALL. In Step 12-5, the CPU 220 may determine that main memory 231 has sufficient remaining available capacity to store the Bloom filter B/F-1 (which represents SS-1). Based on the capacity determination, CPU 220 may store the space-efficiency Bloom filter B/F-1 in main memory 231.
In Step 12-6, based on the policy file header information, the CPU 220 may retrieve the second subset SS-2 from the disk 233. CPU 220 may extract all of the indicators (of type Domain-Name) in SS-2, and may insert the indicators into both the space-efficiency Bloom filter B/F-2 and the time-efficiency Bloom filter B/F-ALL. CPU 220 may associate the Bloom filter B/F-2 with the packet transformation function BLOCK, with the threat metadata “<threat-type=credentials phishing site>”, and with the indicator type Domain-Name. CPU 220 may associate the indicator type Domain-Name with B/F-ALL. After that operation, B/F-ALL is associated with two types of indicators (Certificate-Identifier and Domain-Name). In Step 12-7, the CPU 220 may determine that main memory 231 has sufficient remaining available capacity to store the Bloom filter B/F-2 (which represents SS-2). Based on the capacity determination, CPU 220 may store the space-efficiency Bloom filter B/F-2 in main memory 231.
In Step 12-8, based on the policy file header information, the CPU 220 may retrieve the third subset SS-3 from the disk 233. CPU 220 may extract all of the indicators (of type Domain-Name) in SS-3, and may insert the indicators into both the space-efficiency Bloom filter B/F-3 and the time-efficiency Bloom filter B/F-ALL. CPU 220 may associate the Bloom filter B/F-3 with the packet transformation function MONITOR, with the threat metadata “<threat-type=malware CDN>”, and with the indicator type Domain-Name. The CPU 220 may determine that the indicator type Domain-Name has already been associated with B/F-ALL, as discussed in Step 12-6 above. In Step 12-9, the CPU 220 may determine that main memory 231 has sufficient remaining available capacity to store the Bloom filter B/F-3 (which represents SS-3). Based on the capacity determination, CPU 220 may store the space-efficiency Bloom filter B/F-3 in main memory 231. In Step 12-10, the CPU 220 may determines that main memory 231 has sufficient remaining available capacity to store the Bloom filter B/F-ALL (which contains all of the threat indicators in SS-1, SS-2, and SS-3). Accordingly, CPU 220 may store the time-efficiency Bloom filter B/F-ALL in main memory 231. Based on a determination that all rule subsets of the policy have been processes, the TIG 200 may be determined to be configured for efficient packet filtering for the current policy and may begin to receive packets for filtering.
In Step 13-1, for example, a human user operating a web browser hosted by desktop computer 130 attached to Network 112 may initiate a (secured) web/HTTPS session with a web site named www.enterprise-xyz.com hosted by server 134 attached to Network 116. Host 130 may resolve www.enterprise-xyz.com in the DNS to an IP address (e.g. 12.34.56.78), and may establish a TCP connection between 130 and 134 on port 443/HTTPS (not shown in
In Step 13-2, the network interface 212 of TIG 200 may receive and ingest the in-transit packet and may transfer it via BUS 210 to CPU 220 for filtering. CPU 220 may extract the domain name www.enterprise-xyz.com from the SNI field in the ClientHello message. In Step 13-3, CPU 220 may determine if the filter B/F-ALL contains indicators of type Domain-Name, which may return a TRUE value. CPU 220 may test if www.enterprise-xyz.com is a member of B/F-ALL, which may return a FALSE value. Base on the false value indicating the domain name is not in the policy, the CPU 220 may skip the search through the policy. In Step 13-4, the CPU 220 may transfer the packet to network interface 214 via BUS 210. In Step 13-5, the network interface 214 may forward the packet into the network 110 towards the target destination web site www.enterprise-xyz.com, which may be hosted by server 134 with the IP address 12.34.56.78. Server 134 may receive and ingest the packet at port 443, may process the ClientHello message, and may respond to the ClientHello by sending a packet containing a TLS ServerHello message back to host 130 (not shown in
In Step 13-6, host 134 may send a packet containing a TLS Certificate message towards host 130. The packet may be received and ingested by the TIG (via network interface 214) and processed by CPU 220. CPU 220 may extract the “Issuer Name” and “Serial Number” values from the certificate and associate those values with a Certificate-ID. In Step 13-7, CPU 220 may determine if B/F-ALL contains indicators of type Certificate-Identifier associated with the filtered packet, which may return TRUE result. The CPU 220 may determine if B/F-ALL contains Certificate-ID associated with the filtered packet, which may return TRUE result. Based on the TRUE result, the CPU 220 may test the rules associated with B/F-ALL to determine any rules and operations associated with the packet data being tested. In Step 13-8, CPU 220 may determine if B/F-1 contains indicators of type Certificate-Identifier, which may return a TRUE result. Based on the TRUE result, the CPU 220 may determine if B/F-1 contains Certificate-ID, which may return a TRUE result. Based on the TRUE result associated with the Certificate-ID, the certificate for www.enterprise-xyz.com may be determined to have been revoked by the certificate authority that issued the certificate, and the system may determine that site administrators have not yet obtained and installed a new (unrevoked) certificate.
In Step 13-9, CPU 220 may apply the packet transformation function BLOCK associated with B/F-1, which may cause the packet to be dropped, and may cause a TCP RST packet to be sent to host 130 (via network interface 212) to terminate the TCP connection, thereby halting the TLS tunnel setup handshake process.
The functions and steps described herein may be embodied in computer-usable data or computer-executable instructions, such as in one or more program modules, executed by one or more computers or other devices to perform one or more functions described herein. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types when executed by one or more processors in a computer or other data-processing device. The computer-executable instructions may be stored on a computer-readable medium such as a hard disk, optical disk, removable storage media, solid-state memory, RAM, etc. As will be appreciated, the functionality of the program modules may be combined or distributed as desired. In addition, the functionality may be embodied in whole or in part in firmware or hardware equivalents, such as integrated circuits, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGA), and the like. Particular data structures may be used to more effectively implement one or more aspects of the disclosure, and such data structures are contemplated to be within the scope of computer-executable instructions and computer-usable data described herein.
Although not required, one of ordinary skill in the art will appreciate that various aspects described herein may be embodied as a method, system, apparatus, or one or more computer-readable media storing computer-executable instructions. Accordingly, aspects may take the form of an entirely hardware embodiment, an entirely software embodiment, an entirely firmware embodiment, or an embodiment combining software, hardware, and firmware aspects in any combination.
As described herein, the various methods and acts may be operative across one or more computing devices and networks. The functionality may be distributed in any manner or may be located in a single computing device (e.g., a server, client computer, or the like).
Computer software, hardware, and networks may be utilized in a variety of different system environments, including standalone, networked, remote-access (also known as remote desktop), virtualized, and/or cloud-based environments, among others.
The term “network” as used herein and depicted in the drawings refers not only to systems in which remote storage devices are coupled together via one or more communication paths, but also to stand-alone devices that may be coupled, from time to time, to such systems that have storage capability. Consequently, the term “network” includes not only a “physical network” but also a “content network,” which is comprised of the data—attributable to a single entity—which resides across all physical networks.
The components may include data server 1103, web server 1105, and client computers 1107, 1109. Data server 1103 provides overall access, control and administration of databases and control software for performing one or more illustrative aspects describe herein. Data server 1103 may be connected to web server 1105 through which users interact with and obtain data as requested. Alternatively, data server 1103 may act as a web server itself and be directly connected to the Internet. Data server 1103 may be connected to web server 1105 through the local area network 1133, the wide area network 1101 (e.g., the Internet), via direct or indirect connection, or via some other network. Users may interact with the data server 1103 using remote computers 1107, 1109, e.g., using a web browser to connect to the data server 1103 via one or more externally exposed web sites hosted by web server 1105. Client computers 1107, 1109 may be used in concert with data server 1103 to access data stored therein, or may be used for other purposes. For example, from client device 1107 a user may access web server 1105 using an Internet browser, as is known in the art, or by executing a software application that communicates with web server 1105 and/or data server 1103 over a computer network (such as the Internet).
Servers and applications may be combined on the same physical machines, and retain separate virtual or logical addresses, or may reside on separate physical machines.
Each component 1103, 1105, 1107, 1109 may be any type of known computer, server, or data processing device. Data server 1103, e.g., may include a processor 1111 controlling overall operation of the data server 1103. Data server 1103 may further include random access memory (RAM) 1113, read only memory (ROM) 1115, network interface 1117, input/output interfaces 1119 (e.g., keyboard, mouse, display, printer, etc.), and memory 1121. Input/output (I/O) 1119 may include a variety of interface units and drives for reading, writing, displaying, and/or printing data or files. Memory 1121 may further store operating system software 1123 for controlling overall operation of the data processing device 1103, control logic 1125 for instructing data server 1103 to perform aspects described herein, and other application software 1127 providing secondary, support, and/or other functionality which may or might not be used in conjunction with aspects described herein. The control logic may also be referred to herein as the data server software 1125. Functionality of the data server software may refer to operations or decisions made automatically based on rules coded into the control logic, made manually by a user providing input into the system, and/or a combination of automatic processing based on user input (e.g., queries, data updates, etc.).
Memory 1121 may also store data used in performance of one or more aspects described herein, including a first database 1129 and a second database 1131. The first database may include the second database (e.g., as a separate table, report, etc.). That is, the information can be stored in a single database, or separated into different logical, virtual, or physical databases, depending on system design. Devices 1105, 1107, and 1109 may have similar or different architecture as described with respect to device 1103. Those of skill in the art will appreciate that the functionality of data processing device 1103 (or device 1105, 1107, or 1109) as described herein may be spread across multiple data processing devices, for example, to distribute processing load across multiple computers, to segregate transactions based on geographic location, user access level, quality of service (QoS), etc.
One or more aspects may be embodied in computer-usable or readable data and/or computer-executable instructions, such as in one or more program modules, executed by one or more computers or other devices as described herein. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types when executed by a processor in a computer or other device. The modules may be written in a source code programming language that is subsequently compiled for execution, or may be written in a scripting language such as (but not limited to) Hypertext Markup Language (HTML) or Extensible Markup Language (XML). The computer executable instructions may be stored on a computer readable medium such as a nonvolatile storage device. Any suitable computer readable storage media may be utilized, including hard disks, CD-ROMs, optical storage devices, magnetic storage devices, and/or any combination thereof. In addition, various transmission (non-storage) media representing data or events as described herein may be transferred between a source and a destination in the form of electromagnetic waves traveling through signal-conducting media such as metal wires, optical fibers, and/or wireless transmission media (e.g., air and/or space). Various aspects described herein may be embodied as a method, a data processing system, or a computer program product. Therefore, various functionalities may be embodied in whole or in part in software, firmware, and/or hardware or hardware equivalents such as integrated circuits, field programmable gate arrays (FPGA), and the like. Particular data structures may be used to more effectively implement one or more aspects described herein, and such data structures are contemplated within the scope of computer executable instructions and computer-usable data described herein.
With further reference to
I/O module 1209 may include a mouse, keypad, touch screen, scanner, optical reader, and/or stylus (or other input device(s)) through which a user of computing device 201 may provide input, and may also include one or more of a speaker for providing audio output and one or more of a video display device for providing textual, audiovisual, and/or graphical output. Software may be stored within memory 1215 and/or other storage to provide instructions to processor 1203 for configuring computing device 1201 into a special purpose computing device in order to perform various functions as described herein. For example, memory 1215 may store software used by the computing device 1201, such as an operating system 1217, application programs 1219, and an associated database 1221.
Computing device 1201 may operate in a networked environment supporting connections to one or more remote computers, such as terminals 1240 (also referred to as client devices). The terminals 1240 may be personal computers, mobile devices, laptop computers, tablets, or servers that include many or all of the elements described above with respect to the computing device 1103 or 1201. The network connections depicted in
Aspects described herein may also be operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of other computing systems, environments, and/or configurations that may be suitable for use with aspects described herein include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network personal computers (PCs), minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
As shown in
The client machine(s) 1240 may be referred to as a single client machine 1240 or a single group of client machines 1240, while server(s) 1206 may be referred to as a single server 1206 or a single group of servers 1206. In one embodiment a single client machine 1240 communicates with more than one server 1206, while in another embodiment a single server 1206 communicates with more than one client machine 1240. In yet another embodiment, a single client machine 1240 communicates with a single server 1206.
A client machine 1240 may be referenced by any one of the following non-exhaustive terms: client machine(s); client(s); client computer(s); client device(s); client computing device(s); local machine; remote machine; client node(s); endpoint(s); or endpoint node(s). The server 1206 may be referenced by any one of the following non-exhaustive terms: server(s), local machine; remote machine; server farm(s), or host computing device(s).
In one embodiment, the client machine 1240 may be a virtual machine. The virtual machine may be any virtual machine, while in some embodiments the virtual machine may be any virtual machine managed by a Type 1 or Type 2 hypervisor, for example, a hypervisor developed by Citrix, IBM, VMware, or any other hypervisor. In some aspects, the virtual machine may be managed by a hypervisor, while in other aspects the virtual machine may be managed by a hypervisor executing on a server 1206 or a hypervisor executing on a client 1240.
A client device 1240 may display application output generated by an application remotely executing on a server 1206 or other remotely located machine, and the client device 1240 may execute a virtual machine receiver program or application to display the output in an application window, a browser, or other output window. In one example, the application is a desktop, while in other examples the application is an application that generates or presents a desktop. A desktop may include a graphical shell providing a user interface for an instance of an operating system in which local and/or remote applications can be integrated. Applications, as used herein, are programs that execute after an instance of an operating system (and, optionally, also the desktop) has been loaded.
The server 1206 may use a remote presentation protocol or other program to send data to a thin-client or remote-display application executing on the client to present display output generated by an application executing on the server 1206. The thin-client or remote-display protocol can be a protocol such as the Independent Computing Architecture (ICA) protocol developed by Citrix Systems, Inc. of Ft. Lauderdale, Fla.; or the Remote Desktop Protocol (RDP) manufactured by the Microsoft Corporation of Redmond, Washington.
A remote computing environment may include more than one server 1206a-1206n such that the servers 1206a-1206n are logically grouped together into a server farm 1206, for example, in a cloud computing environment. The server farm 1206 may include servers 1206 that are geographically dispersed while and logically grouped together, or servers 1206 that are located proximate to each other while logically grouped together. Geographically dispersed servers 1206a-1206n within a server farm 1206 may communicate using a WAN (wide), MAN (metropolitan), or LAN (local), where different geographic regions can be characterized as: different continents; different regions of a continent; different countries; different states; different cities; different campuses; different rooms; or any combination of the preceding geographical locations. The server farm 1206 may be administered as a single entity, or the server farm 1206 may include multiple server farms.
A server farm may include servers 1206 that execute a substantially similar type of operating system platform (e.g., WINDOWS, UNIX, LINUX, iOS, ANDROID, SYMBIAN, etc.) The server farm 1206 may include a first group of one or more servers that execute a first type of operating system platform, and a second group of one or more servers that execute a second type of operating system platform.
Server 1206 may be configured as any type of server, as needed, e.g., a file server, an application server, a web server, a proxy server, an appliance, a network appliance, a gateway, an application gateway, a gateway server, a virtualization server, a deployment server, a Secure Sockets Layer (SSL) VPN server, a firewall, a web server, an application server or as a master application server, a server executing an active directory, or a server executing an application acceleration program that provides firewall functionality, application functionality, or load balancing functionality. Other server types may also be used.
A first server 1206a may receive requests from a client machine 1240, forwards the request to a second server 1206b (not shown), and responds to the request generated by the client machine 1240 with a response from the second server 1206b (not shown.) First server 1206a may acquire an enumeration of applications available to the client machine 1240 and well as address information associated with an application server 1206 hosting an application identified within the enumeration of applications. First server 1206a can then present a response to the client's request using a web interface, and communicate directly with the client 1240 to provide the client 1240 with access to an identified application. One or more clients 1240 and/or one or more servers 1206 may transmit data over network 1230, e.g., network 1101.
Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one of ordinary skill in the art will appreciate that the steps illustrated in the illustrative figures may be performed in other than the recited order and that one or more illustrated steps may be optional. Any and all features in the following claims may be combined or rearranged in any way possible.
This application is a continuation of and claims priority to U.S. patent application Ser. No. 16/399,700, filed Apr. 30, 2019, and entitled “Methods and Systems for Efficient Packet Filtering.” The entire contents of the aforementioned application is hereby incorporated by reference herein. Aspects described herein generally relate to computer hardware and software and network security. In particular, one or more aspects of the disclosure generally relate to computer hardware and software for efficient filtering of in-transit packets against packet filtering rules derived from cyber threat intelligence.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 16399700 | Apr 2019 | US |
| Child | 17224233 | US |
