Patent ID: 11956338
Assignee: CENTRIPETAL NETWORKS, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 10:
11. A method comprising
determining, by a packet-filtering device, a first plurality of log entries corresponding to a first plurality of packets received by a network device from a first host located in a first network;
determining, by the packet-filtering device, a second plurality of log entries corresponding to a second plurality of packets transmitted by the network device to a second host located in a second network;
determining whether one of the first host or the second host are associated with potentially malicious activity;
detecting, by the packet-filtering device and based on the first plurality of log entries and the second plurality of log entries, a correlation between one or more packets of the first plurality of packets and one or more packets of the second plurality of packets by:
comparing the first plurality of log entries with the second plurality of log entries based on one or more of:
an ingress identifier,
an egress identifier,
network-layer information,
transport-layer information, or
application-layer information; and

determining, based on the comparing, the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality of packets;

determining, based on detecting the correlation between the one or more packets of the first plurality of packets and the one or more packets of the second plurality packets and based on a determination that one or the first host and the second host are associated with the potentially malicious activity, that the other host, of the first host or the second host, is also associated with the potentially malicious activity;
generating, by the packet-filtering device and in response to the determining that the other host is also associated with the potentially malicious activity, one or more rules configured to identify packets associated with the other host; and
provisioning one or more devices with the one or more rules configured to identify packets associated with the other host.