Security threat monitoring for network-accessible devices

A computer-implemented method, comprising:

• monitoring network traffic on a computer network that includes a plurality of endpoints;
• associating a software application executing on at least one endpoint of the plurality of endpoints with the monitored network traffic;
• determining a security status score for the at least one endpoint based on a comparison of the monitored network traffic and previous patterns of network activity associated with the software application, wherein the previous patterns of network activity are associated with updating one or more software files stored at the at least one endpoint;
• wherein determining the security status score includes,
• determining a level of match between network traffic features associated with destination IP addresses for the at least one endpoint with the previous patterns of network activity, and
• adjusting the security status score based on the level of match such that endpoints with destination IP addresses that have a first level of match to the previous patterns of network activity are assigned higher security status scores than security status scores assigned to endpoints that have a second level of match, wherein the first level of match is greater than the second level of match;
• and
• generating an indication of a threat status for the at least one endpoint based on the security status score.

A threat management computer system for managing security threats on an enterprise network, comprising:

• a memory with instructions stored thereon;
• one or more processing devices, coupled to the memory, the one or more processing devices configured to access the memory and execute the instructions;
• and
• one or more network devices coupled to the one or more processing devices and configured to receive requests issued by a plurality of client devices, wherein the instructions cause the one or more processing devices to perform operations including:
• monitoring network traffic on a computer network that includes a plurality of endpoints, wherein the network traffic for each endpoint includes sent data that is transmitted from the endpoint and received data that is received by the endpoint over the computer network;
• identifying a first software application of a plurality of software applications executing on at least one endpoint of the plurality of endpoints from one or more of the sent data or the received data;
• determining a level of match between network traffic features associated with destination Internet Protocol (IP) addresses for the at least one endpoint with a known pattern of update activity associated with the first software application;
• determining a security status score for the at least one endpoint based on a comparison of the sent data and the received data with the known pattern of update activity associated with the first software application and the determined level of match, wherein the known pattern of update activity includes an update to one or more software files accessible by one or more of the plurality of software applications;
• wherein determining the security status score includes adjusting the security status score based on the level of match such that endpoints with destination IP addresses that have a first level of match to the known pattern of update activity are assigned higher security status scores than security status scores assigned to endpoints that have a second level of match, wherein the first level of match is greater than the second level of match;
• and
• generating an indication of threat status for the at least one endpoint of the plurality of endpoints based on the security status score.