Enhanced flow-based computer network threat detection

An apparatus comprising:

• a network interface configured to enable network communications;
• and
• one or more processors coupled to a memory and the network interface,
• wherein the one or more processors are configured to:
• receive metadata of a network flow in a network;
• receive a zone definition that correlates the metadata of the network flow with a first zone of network devices in the network and a second zone of network devices in the network, wherein the network flow was transmitted from the first zone to the second zone;
• generate a flow record that includes the metadata;
• store the flow record in a flow record annotation database to generate a stored flow record;
• after generating the flow record, based on the zone definition, annotate the flow record with an indication of the first zone and the second zone to generate an annotated flow record;
• receive a security policy for the network flow, wherein the security policy is enforced based on the first zone and the second zone;
• based on the annotated flow record and the security policy, determine whether to generate a notification associated with a detection of a security threat associated with the network flow;
• and
• annotate the stored flow record based on an updated zone definition that correlates the metadata of the network flow with a third zone of network devices in the network or a fourth zone of network devices in the network, wherein the network flow was transmitted from the third zone or to the fourth zone.

One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:

• receive metadata of a network flow in a network;
• receive a zone definition that correlates the metadata of the network flow with a first zone of network devices in the network and a second zone of network devices in the network, wherein the network flow was transmitted from the first zone to the second zone;
• generate a flow record that includes the metadata;
• store the flow record in a flow record annotation database to generate a stored flow record;
• after generating the flow record, based on the zone definition, annotate the flow record with an indication of the first zone and the second zone to generate an annotated flow record;
• receive a security policy for the network flow, wherein the security policy is enforced based on the first zone and the second zone;
• based on the annotated flow record and the security policy, determine whether to generate a notification associated with a detection of a security threat associated with the network flow;
• and
• annotate the stored flow record based on an updated zone definition that correlates the metadata of the network flow with a third zone of network devices in the network or a fourth zone of network devices in the network, wherein the network flow was transmitted from the third zone or to the fourth zone.