US 11729144

US11729144B2 — Efficient Packet Capture for Cyber Threat Analysis

Title: Efficient packet capture for cyber threat analysis
Patent number: US11729144B2; Application No. US15/382,806; Publication US20170324709A1
Inventors: David K. Ahn, Sean Moore
Assignee (per source): Centripetal Networks LLC (originally Centripetal Networks LLC; assignment records list an earlier name, Centripetal Networks, Inc.)
Priority date: 2016-01-04; Filed: 2016-12-19; Published: 2023-08-15; Anticipated expiration: 2036-12-19; Status (source): Active
Source: https://patents.google.com/patent/[US11729144](/patent/US11729144)/en

Purpose and plain-language scope (per the supplied text): Conventional packet-capture approaches for cyber threat analysis are described as inefficient and costly, because threat traffic is only a small fraction of network traffic and most captured packets are never used; analysts also typically search logs one indicator at a time against large daily volumes of indicators. The disclosure addresses this by providing a purpose-built packet filter that detects threat incidents as packets cross a network boundary/security perimeter. Threat indicators from multiple threat intelligence providers may be aggregated and compared against each transiting packet. Threat filtering, threat incident logging, and threat packet capture may be integrated so the same indicators are applied at the same time and location.

In method terms, a computing device located at a boundary between a protected enterprise network and an unprotected network receives threat indicators from one or more providers; the indicators are combined based on a source address and port, a destination address and port, and a protocol type ("5-tuple"); packet capture and packet filtering rules are generated from the combined indicators; and packets are filtered on a packet-by-packet basis using those rules. The excerpt also states combining may be based on hostname/FQDN or URI, and that capture may include threat context information and bidirectional flows.

What the excerpt does not establish: The full claim set (the text is explicitly an excerpt, with later text omitted); specific embodiment details, figures, or dependent-claim scope; the identity of any prior art; litigation, validity, or legal status conclusions (status and assignee are expressly noted in the source as assumptions, not legal conclusions).