Network security with vpn detection

An apparatus in a computer network system comprising:

• one or more processor devices, the one or more processor devices configured to:
• maintain a database related to a plurality of virtual private network (VPN) protocols and respective VPN providers thereof;
• perform a VPN protocol detection process for determining a VPN protocol used by a computing device of a computer network based on analyzing network traffic data related to the computing device and the database;
• in response to an occurrence of one of two events, perform an endpoint detection process for determining VPN usage of the computing device, wherein the two events comprise a detection of the VPN protocol detection process failing and a detection of a need to identify a respective VPN provider in response to a successfully performed VPN protocol detection process;
• in response to an occurrence of one or two further events, perform a traffic pattern search process for determining the VPN usage of the computing device, wherein the two further events comprise a detection of the endpoint detection process failing and a detection of a need to identify VPN usage time information in response to a successfully performed endpoint detection process;
• and
• take further action to protect the computing device and/or the computer network in response to detecting the VPN usage on the basis of at least one of:
• the VPN protocol detection process, the endpoint detection process, and the traffic pattern search process.

A non-transitory computer-readable medium comprising stored program code, the program code comprised of computer-executable instructions that, when executed by a processor device, causes the processor device to:

• maintain a database related to a plurality of virtual private network (VPN) protocols and respective VPN providers thereof;
• perform a VPN protocol detection process for determining a VPN protocol used by a computing device of a computer network based on analyzing network traffic data related to the computing device and the database;
• in response to an occurrence of one of two events, perform an endpoint detection process for determining VPN usage of the computing device, wherein the two events comprise a detection of the VPN protocol detection process failing and a detection of a need to identify a respective VPN provider in response to a successfully performed VPN protocol detection process;
• in response to an occurrence of one or two further events, perform a traffic pattern search process for determining the VPN usage of the computing device, wherein the two further events comprise a detection of the endpoint detection process failing and a detection of a need to identify VPN usage time information in response to a successfully performed endpoint detection process;
• and
• take further action to protect the computing device and/or the computer network in response to detecting the VPN usage on the basis of at least one of:
• the VPN protocol detection process, the endpoint detection process, and the traffic pattern search process.