Method and system for network access control based on traffic monitoring and vulnerability detection using process related information

A system for network access control based on traffic monitoring and vulnerability detection using process related information, the system comprising:

• computer executable code embodied in a non-transitory computer readable medium that, when executing one or more processors provide a plurality of process intercepting units, a pattern matching unit, and an intrusion prevention unit,
• a plurality of devices for receiving at least one connection request from a process running on a host, each of the plurality of devices comprising a process intercepting unit of the plurality of process intercepting units configured for extracting the process related information and forwarding information including one or more of process related information, connection information, and network packet information,
• the pattern matching unit configured for receiving the information from the process intercepting unit and forwarding the information;
• and
• the intrusion prevention unit configured for receiving the information from the pattern matching unit, the intrusion prevention unit including a processing unit and a database, the database including a plurality of signatures defining a set of rules to detect attacks or intrusive activities on a network that can occur through the process, the plurality of signatures prepared based on information relating to the process, the intrusion prevention unit further configured to verify the information from the pattern matching unit against the plurality of signatures stored in the database to identify and detect a known vulnerability in network activities, establish a verification report based on the known vulnerability, and send the verification report to the pattern matching unit,
• wherein the pattern matching unit is further configured to receive the verification report from the intrusion prevention unit, verify whether the verification report is applicable to the process associated with network packet by matching a first signature identification code in the verification report with a second signature identification code stored in an application process information database, and send an authorization decision to the process intercepting unit regarding allowing continuing or blocking of the connection request from the process running on the host.