Intrusion detection using a heartbeat

A computer program product comprising a non-transitory computer readable medium having stored thereon computer executable code that, when executing on one or more computing devices, cause the one or more computing devices to perform the steps of:

• receiving, at a gateway interposed between a second network and an endpoint in an enterprise network, a heartbeat addressed to the gateway, the heartbeat including an identifier for the endpoint and a status of the endpoint, the status indicating an evaluation of whether the endpoint is compromised based on monitoring, by a health monitor on the endpoint, a behavior of software executing on the endpoint, the status indicating an uncompromised status when the endpoint is uncompromised, and the status indicating a compromised status when the behavior of the software executing on the endpoint indicates that the endpoint is compromised;
• detecting, at the gateway, a change to the compromised status in the status included in the heartbeat;
• following detecting the change of the status included in the heartbeat at the gateway, receiving, by the gateway, network traffic other than the heartbeat from the endpoint, the network traffic addressed for forwarding by the gateway via the second network to a second destination address outside the gateway from the enterprise network;
• and
• responding to the change of the status included in the heartbeat in combination with the network traffic received following the change, the response including blocking, by the gateway, the network traffic other than the heartbeat from the endpoint.

A system comprising:

• an endpoint in a first network, the endpoint including a first memory, the endpoint configured to monitor software executing on the endpoint and to create a heartbeat including an identifier for the endpoint and a status of the endpoint, the status indicating an evaluation of whether the endpoint is compromised based on a behavior of software executing on the endpoint, the status indicating an uncompromised status when the behavior of the software executing on the endpoint indicates that the endpoint is uncompromised, and the status indicating a compromised status when the behavior of the software executing on the endpoint indicates that the endpoint is compromised;
• and
• a gateway interposed between the endpoint in the first network and a second network, the gateway in communication with the endpoint over the first network, the endpoint in communication with the second network via the gateway, the gateway including a second memory configured to receive the heartbeat from the endpoint and to receive and forward network traffic, other than the heartbeat, from the endpoint to a destination address in the second network, and to detect a change to the compromised status in the status included in the heartbeat, the gateway further configured to initiate remedial action directed to the endpoint based on a combination of the detected change of the status included in the heartbeat and detection of network traffic, other than the heartbeat, following detection of the change of the status, the remedial action including blocking network traffic from the endpoint.