Network Traffic Correlation Engine

A computing device, comprising:

• a processor;
• and
• memory storing instructions that, when executed by the processor, cause the computing device to:
• monitor, by a network traffic correlation engine, network communications information aggregated from a plurality of hosts on an enterprise network;
• identify, by the network traffic correlation engine, whether a correlation exists between a first communication sent from a first host device and a second communication received by a second host device;
• determine, based on whether a correlation exists between the first communication and the second communication, whether an anomalous communication condition exists;
• and
• trigger, based on the correlation, an alert identifying that an anomalous communication condition is present between the first host device and the second host device.

One or more non-transitory computer-readable media storing instructions that, when executed by a host computing device comprising a processor, memory, and a communication interface, cause the host computing device to:

• monitor, by a network traffic correlation engine, network communications information aggregated from a plurality of hosts on an enterprise network;
• identify, by the network traffic correlation engine, whether a correlation exists between a first communication sent from a first host device and a second communication received by a second host device;
• determine, based on whether a correlation exists between the first communication and the second communication, whether an anomalous communication condition exists;
• and
• trigger, based on the correlation, an alert identifying that an anomalous communication condition is present between the first host device and the second host device.