Patent ID: 11956338
Assignee: CENTRIPETAL NETWORKS, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A packet-filtering device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the packet-filtering device to:
determine a first plurality of log entries corresponding to a first plurality of packets received by a network device from a first host located in a first network;
determine a second plurality of log entries corresponding to a second plurality of packets transmitted by the network device to a second host located in a second network;
determine whether one of the first host or the second host are associated with potentially malicious activity;
detect, based on the first plurality of log entries and the second plurality of log entries, a correlation between one or more packets of the first plurality of packets and one or more packets of the second plurality of packets by:
comparing the first plurality of log entries with the second plurality of log entries based on one or more of:
an ingress identifier,
an egress identifier,
network-layer information,
transport-layer information, or
application-layer information; and

determining, based on the comparing, the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets;

determine, based on detecting the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets and based on a determination that one of the first host and the second host are associated with the potentially malicious activity, that the other host, of the first host or the second host, is also associated with the potentially malicious activity;
generate, in response to the determining that the other host is also associated with the potentially malicious activity, one or more rules configured to identify packets associated with the other host; and
provision one or more devices with the one or more rules configured to identify packets associated with the other host.