Device discovery for cloud-based network security gateways

A system for identifying client devices violating an access policy in a private network, comprising:

• A. A network security gateway in a public network, the network security gateway comprising at least one hardware processor and memory holding instructions for execution on the at least one hardware processor to cause, upon execution, the network security gateway to:
• receive a first content request from a client in a private network, the first content request being routed through a network address translation (NAT) device that separates the private network from the public network;
• apply an access policy to the first content request, the access policy defined by an administrator of the private network and relating to any of security threats and acceptable use policies for the private network;
• generate a unique request identifier for the first content request;
• based on the application of the access policy, issue a redirect to a bouncer component in the private network;
• log the request identifier and sending a record with the request identifier to a log processor and reporting component;
• B, the log processor and reporting component comprising at least one hardware processor and memory holding instructions for execution on the at least one hardware processor to cause, upon execution, the log processor and reporting component to:
• receiving the record from the network security gateway;
• receive a record from the bouncer component, comprising the request identifier and client information;
• correlate the record from the network security gateway with the record from the bouncer component;
• and,
• generate any of:
• a user display, an alert based on the correlated records.

A method for identifying high-risk client devices in a private network, comprising:

• A. at a network security gateway in a public network:
• receiving a first content request from a client in a private network, the first content request being routed through a network address translation (NAT) device that separates the private network from the public network;
• applying an access policy to the first content request, the access policy defined by an administrator of the private network and relating to any of security threats and acceptable use policies for the private network;
• generating a unique request identifier for the first content request;
• based on the application of the access policy, issuing a redirect to a bouncer component in the private network;
• logging the request identifier and sending a record with the request identifier to a log processor and reporting component;
• B. at the log processor and reporting component, attempting to correlate records from the network security gateway and the bouncer component, said attempt to correlate comprising;
• receiving the record from the network security gateway;
• receiving a record from the bouncer component, comprising the request identifier and client information;
• and,
• at least one of:
• (i) failing to correlate the record from the network security gateway with any record from the bouncer component, and in response thereto, generating an alert that the client is failing to follow redirects;
• (ii) failing to correlate the record from the bouncer component with any record from the network security gateway, and in response thereto, generating an alert that the client is scanning the private network.