Automatically detecting authorized remote administration sessions in a network monitoring system

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and executing one or more operations;
• and
• a memory storing a process that is executable by the processor, the process when executed causing the apparatus to:
• receive administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
• analyze the administration traffic data to determine whether any portion of the administration traffic data results from an authorized application;
• flag a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the authorized application, wherein a second portion of the administration traffic data is non-flagged;
• assess the administration traffic data to determine whether any portion of the administration traffic data is malicious;
• and
• perform, based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.

A tangible, non-transitory, computer-readable medium that program instructions that cause a device to execute a process comprising:

• receiving administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
• analyzing the administration traffic data to determine whether any portion of the administration traffic data results from an authorized application;
• flagging a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the authorized application, wherein a second portion of the administration traffic data is non-flagged;
• assessing the administration traffic data to determine whether any portion of the administration traffic data is malicious;
• and
• performing, based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.