Managing untyped network traffic flows
AssigneeSophos Limited
InventorChris Douglas Kraft
Life of this patent
Estimating the term…
Abstract
An enterprise security system is improved by managing network flows based on an application type. When a network message having an unknown application type is received at a gateway, firewall, or other network device/service from an endpoint, the endpoint that originated the network message may be queried for identifying information for the source of the network message and the application type may be determined, or the endpoint may periodically communicate application type information to the network device in a heartbeat or other periodic communication or the like. The network message may be managed along with other network traffic according to the application type.
Claims20
A computer program product for managing network flows for an enterprise network, the computer program product comprising computer executable code embodied on a non-transitory computer readable medium that, when executing on a network device, causes the network device to perform the steps of:
- receiving, at the network device for the enterprise network, a network message from a process executing on an endpoint associated with the enterprise network;
- in response to receiving the network message, transmitting a query to a local security agent on the endpoint, wherein:
- the query is for identifying information for a source of the network message,
- the query is directed to a process cache in a kernel space of the endpoint, and
- the process cache securely stores process metadata for processes executing on the endpoint;
- receiving, at the network device in response to the query, the process metadata including the identifying information for the source of the network message from the process cache that securely stores the process metadata in the kernel space of the endpoint, the identifying information including at least an application type for the source of the network message;
- and
- applying a security policy for the enterprise network to the network message according to the application type identified in the process metadata for the source of the network message.
A method comprising:
- receiving, at a network device, a network message from an endpoint associated with an enterprise network;
- in response to receiving the network message from the endpoint, transmitting, from the network device, a request for identifying information for a source of the network message to a local security agent on the endpoint, the request directed to a process cache securely storing process metadata in a kernel space of the endpoint;
- receiving, at the network device in response to the network message, the process metadata including the identifying information for the source of the network message from the process cache securely storing the process metadata in the kernel space of the endpoint;
- and
- applying, at the network device, a security policy for the enterprise network to the network message according to the identifying information in the process metadata for the source of the network message.
Dependencies are inferred from the claim text.