# US 10,122,687 B2 · Firewall techniques for colored objects on endpoints > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,687 B2 - Document ID: US10122687B2 - Status: Granted - Kind: B2 - Application number: 14/485,782 - Filed: 2014-09-14 - Published: 2016-06-30 - Granted: 2018-11-06 - Earliest claimed: 2014-09-14 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Andrew J. Thomas; Neil Robert Tyndale Watkiss; Daniel Salvatore Schiappa; Kenneth D. Ray - Web page: https://patentgrep.com/patent/US10122687B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility. ## Claims ### Claim 1 A method comprising: providing an application firewall deployed at a gateway and in communication with an endpoint through a network, the application firewall configured to provide conditional, rule-based access to network resources by an application executing on the endpoint; labeling data on the endpoint as secure data for type-dependent processing; monitoring the application executing on the endpoint; on the endpoint, coloring the application in response to a first observed action that includes an exposure to out-of-network data with a descriptor of a context for the first observed action, the descriptor including one or more attributes selected for a relevance to threat detection; applying a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a transmission, from the endpoint, of the data labeled as secure data; communicating the reportable event through the network from the endpoint to the application firewall; and limiting access by the application through the gateway to a network resource with the application firewall based on the reportable event. ### Claim 2 (depends on 1) The method of claim 1 further comprising applying firewall rules based on a reputation of the application when the application launches. ### Claim 3 (depends on 1) The method of claim 1 further comprising changing an access rule for the endpoint based upon the reportable event. ### Claim 4 (depends on 1) The method of claim 1 wherein the endpoint is a web server. ### Claim 5 (depends on 1) The method of claim 1 wherein the endpoint is a client device. ### Claim 6 (depends on 1) The method of claim 1 wherein the rule depends on a plurality of observed actions on the endpoint. ### Claim 7 (depends on 1) The method of claim 1 wherein the application firewall is included on the endpoint. ### Claim 8 (depends on 1) The method of claim 1 wherein the application firewall is included on a destination server. ### Claim 9 (depends on 1) The method of claim 1 wherein the application firewall is included as part of a routing of the network. ### Claim 10 (depends on 1) The method of claim 1 wherein the descriptor includes a category for an object, static threat detection information for the object, and a specific identifier of the object. ### Claim 11 (depends on 10) The method of claim 10 wherein the object is the application. ### Claim 12 (depends on 10) The method of claim 10 wherein the object is an item accessed by the application. ### Claim 13 (depends on 1) The method of claim 1, wherein the exposure to out-of-network data includes exposure to an external object known to be or suspected to be malicious. ### Claim 14 A computer program product comprising a non-transitory computer readable medium bearing computer executable code that, when executing on one or more computing devices, performs the steps of: providing an application firewall deployed at a gateway and in communication with an endpoint through a network, the application firewall configured to provide conditional, rule-based access to network resources by an application executing on the endpoint; labeling data on the endpoint as secure data for type-dependent processing; monitoring the application executing on the endpoint; on the endpoint, coloring the application in response to a first observed action that includes an exposure to out-of-network data with a descriptor of a context for the first observed action, the descriptor including one or more attributes selected for a relevance to threat detection; applying a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a transmission, from the endpoint, of the data labeled as secure data; communicating the reportable event through the network from the endpoint to the application firewall; and limiting access by the application through the gateway to a network resource with the application firewall based on the reportable event. ### Claim 15 (depends on 14) The computer program product of claim 14 wherein the computer executable code further performs the step of applying firewall rules based on a reputation of the application when the application launches. ### Claim 16 (depends on 14) The computer program product of claim 14 wherein the computer executable code further performs the step of changing an access rule for the endpoint based upon the reportable event. ### Claim 17 (depends on 14) The computer program product of claim 14 wherein the endpoint is a web server. ### Claim 18 (depends on 14) The computer program product of claim 14 wherein the endpoint is a client device. ### Claim 19 (depends on 14) The computer program product of claim 14 wherein the rule depends on a plurality of observed actions on the endpoint. ### Claim 20 A system comprising: an application firewall deployed at a gateway and in communication with an endpoint through a network, the application firewall configured to provide conditional, rule-based access to network resources by applications executing on endpoints in an enterprise; and an endpoint of the enterprise having a processor and a memory, the memory storing an application executing on the endpoint, and the processor configured to label data on the endpoint as secure data for type-dependent processing, monitor the application executing on the endpoint, to color the application in response to a first observed action that includes an exposure to out-of-network data with a descriptor of a context for the first observed action, the descriptor including one or more attributes selected for a relevance to threat detection, to apply a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a transmission, from the endpoint, of the data labeled as secure data, to communicate the reportable event through the network from the endpoint to the application firewall, and to limit access by the application through the gateway to a network resource with the application firewall based on the reportable event.