# US 12,003,485 B2 · Outbound/inbound lateral traffic punting based on process risk > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,485 B2 - Document ID: US12003485B2 - Status: Granted - Kind: B2 - Application number: 18/113,524 - Filed: 2023-02-23 - Published: 2023-06-29 - Granted: 2024-06-04 - Earliest claimed: 2017-09-15 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Ho Yu Lam; Robert Earle Ashley; Paul Theodore Mathison; Qiuming Li; Taylor Ettema - Web page: https://patentgrep.com/patent/US12003485B2 ## CPC - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0263: {Rule management} - H04L 47/20: Traffic policing - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for outbound/inbound lateral traffic punting based upon process risk are disclosed. In some embodiments, a system/process/computer program product for outbound/inbound lateral traffic punting based upon process risk includes receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, in which the process ID information identifies a process that is associated with an outbound or inbound network session on the EP device on the enterprise network, and the EP agent selected the network session for punting to the network device for inspection; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID. ## Claims ### Claim 1 A system, comprising: a processor of a network device configured to: receive process identification (ID) information from an endpoint (EP) agent executed on an EP device on an enterprise network, wherein the process ID information identifies a process that is associated with a network session, wherein the network session is an outbound network session or an inbound network session on the EP device on the enterprise network, wherein the process ID information indicates that it is a known process, an unknown process, or a known but unexpected process, wherein the process ID information is stored as a digest of a file name of a binary/executable associated with the process that initiated the network session, and wherein the EP agent selected the network session for punting to the network device for inspection; monitor network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and perform an action based on a security policy using the process ID information and the APP ID, wherein the security policy includes an EP security policy, wherein the EP agent implements the EP security policy to selectively punt the network session to the network device on the enterprise network, wherein the network device includes a firewall, wherein the security policy includes a fine-grained firewall policy, and wherein the firewall implements the fine-grained firewall policy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the network session and/or the process is determined to be suspicious based on the security policy and/or based on an EP security policy implemented by the EP agent. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the process ID information is determined to be an unknown or untrusted process, and wherein the network session and/or process is determined to be suspicious based on the security policy and/or based on an EP security policy implemented by the EP agent. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the process ID information is determined to be a known process that is not authorized for performing network sessions on the enterprise network that correspond to the APP ID based on the security policy, and wherein the network session and/or the process is determined to be suspicious based on the security policy. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the processor is further configured to perform the action based on the security policy using the process ID information and the APP ID, further comprising: determine whether a user associated with another EP device attempting to access a resource on the enterprise network has been authenticated, wherein the EP agent is being executed on the resource on the enterprise network; and in response to a determination that the user associated with the other EP device attempting to access the resource on the enterprise network has not been authenticated, authenticate the user associated with the other EP device to allow the other EP device access to the resource on the enterprise network for a period of time, wherein an IP associated with the authenticated user falls within an assigned IP address range or is locked down to an IP address range, or the authenticated user undergoes periodic multifactor authentication (MFA) requirements for authentication for the period of time, or both. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: verify that the network session was not previously inspected by another network device. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: correlate the process ID information and the APP ID at the network device; and detect a suspicious activity based on the correlated process ID information and the APP ID. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the security policy is a fine-grained firewall policy, and wherein the processor is further configured to: correlate the process ID information and the APP ID at the network device; and determine a responsive action to perform based on the process ID information and the APP ID for enforcement of the fine-grained firewall policy. ### Claim 9 (depends on 1) The system recited in claim 1, wherein to perform the action based on the security policy using the process ID information and the APP ID comprises one or more of the following: throttle the network session, block the network session, send a request to the EP agent to kill the process executing on the EP device, generate an alert, log the network session, send the process ID information and the APP ID to the EP agent, and send the process ID information and the APP ID to a security service to request a verdict based on the process ID information and the APP ID. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: establish a secure communication channel with the EP device for receiving the process ID information and sending a responsive action to perform based on the security policy using the process ID information and the APP ID, wherein the responsive action includes killing the process executing on the EP device and/or uninstalling an executable associated with the process on the EP device. ### Claim 11 A method, comprising: receiving process identification (ID) information at a network device from an endpoint (EP) agent executed on an EP device on an enterprise network, wherein the process ID information identifies a process that is associated with a network session, wherein the network session is an outbound network session or an inbound network session on the EP device on the enterprise network, wherein the process ID information indicates that it is a known process, an unknown process, or a known but unexpected process, wherein the process ID information is stored as a digest of a file name of a binary/executable associated with the process that initiated the network session, and wherein the EP agent selected the network session for punting to the network device for inspection; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID, wherein the security policy includes an EP security policy, wherein the EP agent implements the EP security policy to selectively punt the network session to the network device on the enterprise network, wherein the network device includes a firewall, wherein the security policy includes a fine-grained firewall policy, and wherein the firewall implements the fine-grained firewall policy. ### Claim 12 (depends on 11) The method of claim 11, wherein the network session and/or the process is determined to be suspicious based on the security policy and/or based on an EP security policy implemented by the EP agent. ### Claim 13 (depends on 11) The method of claim 11, wherein the process ID information is determined to be an unknown or untrusted process, and wherein the network session and/or process is determined to be suspicious based on the security policy and/or based on an EP security policy implemented by the EP agent. ### Claim 14 (depends on 11) The method of claim 11, wherein the process ID information is determined to be a known process that is not authorized for performing network sessions on the enterprise network that correspond to the APP ID based on the security policy, and wherein the network session and/or the process is determined to be suspicious based on the security policy. ### Claim 15 (depends on 11) The method of claim 11, wherein performing the action based on the security policy using the process ID information and the APP ID further comprises: determining whether a user associated with another EP device attempting to access a resource on the enterprise network has been authenticated, wherein the EP agent is being executed on the resource on the enterprise network; and in response to a determination that the user associated with the other EP device attempting to access the resource on the enterprise network has not been authenticated, authenticating the user associated with the other EP device to allow the other EP device access to the resource on the enterprise network for a period of time, wherein an IP associated with the authenticated user falls within an assigned IP address range or is locked down to an IP address range, or the authenticated user undergoes periodic multifactor authentication (MFA) requirements for authentication for the period of time, or both. ### Claim 16 A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: receiving process identification (ID) information at a network device from an endpoint (EP) agent executed on an EP device on an enterprise network, wherein the process ID information identifies a process that is associated with a network session, wherein the network session is an outbound network session or an inbound network session on the EP device on the enterprise network, wherein the process ID information indicates that it is a known process, an unknown process, or a known but unexpected process, wherein the process ID information is stored as a digest of a file name of a binary/executable associated with the process that initiated the network session, and wherein the EP agent selected the network session for punting to the network device for inspection; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID, wherein the security policy includes an EP security policy, wherein the EP agent implements the EP security policy to selectively punt the network session to the network device on the enterprise network, wherein the network device includes a firewall, wherein the security policy includes a fine-grained firewall policy, and wherein the firewall implements the fine-grained firewall policy. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein the network session and/or the process is determined to be suspicious based on the security policy and/or based on an EP security policy implemented by the EP agent. ### Claim 18 (depends on 16) The computer program product recited in claim 16, wherein the process ID information is determined to be an unknown or untrusted process, and wherein the network session and/or process is determined to be suspicious based on the security policy and/or based on an EP security policy implemented by the EP agent. ### Claim 19 (depends on 16) The computer program product recited in claim 16, wherein the process ID information is determined to be a known process that is not authorized for performing network sessions on the enterprise network that correspond to the APP ID based on the security policy, and wherein the network session and/or the process is determined to be suspicious based on the security policy.