US 12,113,771 B2
Methods and systems for efficient adaptive logging of cyber threat incidents
John Fenton, Ashburn, VA (US); Peter Geremia, Portsmouth, NH (US); Richard Goodwin, York, ME (US); Sean Moore, Hollis, NH (US); Vincent Mutolo, Portsmouth, NH (US); Jess P. Parnell, Grayson, GA (US); and Jonathan R. Rogers, Hampton Falls, NH (US)
Assigned to Centripetal Networks, LLC, Portsmouth, NH (US)
Filed by Centripetal Networks, LLC, Portsmouth, NH (US)
Filed on Jun. 8, 2023, as Appl. No. 18/207,419.
Application 18/207,419 is a continuation of application No. 18/075,121, filed on Dec. 5, 2022, granted, now 11,736,440.
Application 18/075,121 is a continuation of application No. 17/838,478, filed on Jun. 13, 2022, granted, now 11,539,664, issued on Dec. 27, 2022.
Application 17/838,478 is a continuation of application No. 17/380,519, filed on Jul. 20, 2021, granted, now 11,362,996, issued on Jun. 14, 2022.
Claims priority of provisional application 63/106,166, filed on Oct. 27, 2020.
Prior Publication US 2024/0089235 A1, Mar. 14, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/0236 (2013.01) [H04L 63/1425 (2013.01); H04L 63/1458 (2013.01)] 24 Claims
OG exemplary drawing
 
1. A packet-filtering device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the packet-filtering device to perform:
receiving a plurality of packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to at least one of a plurality of threat indicators, wherein the plurality of packet-filtering rules was generated based on a plurality of cyber threat intelligence reports from one or more cyber threat intelligence providers, wherein the plurality of cyber threat intelligence reports comprises the plurality of threat indicators, and wherein the plurality of threat indicators comprises a plurality of network addresses;
determining an occurrence of an incident;
receiving, during the incident, a plurality of packets that match at least one of the plurality of packet-filtering rules, wherein the plurality of packets are in a plurality of flows associated with the incident;
based on a first one or more flows, of the plurality of flows, that causes one or more transmission control protocol (TCP) flow state transitions, generating flow log data associated with the first one or more flows;
based on a second one or more flows, of the plurality of flows, that does not cause any TCP flow state transition, generating incident log data associated with the second one or more flows;
sending the flow log data associated with the first one or more flows; and
sending, in lieu of flow log data associated with the second one or more flows, the incident log data associated with the second one or more flows.