User space firewall manager

One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to provide a security application, the security application to:

• within a non-kernel space, asynchronously monitor network activity of a network-enabled application;
• based on the asynchronous monitoring, create one or more firewall rules for a kernel-mode firewall;
• and
• cause the kernel-mode firewall to enforce the one more firewall rules.

A computer-implemented software method, the method to execute within a non-kernel space of a host computer, the method comprising:

• asynchronously monitoring network activity of network-enabled applications of the host computer;
• responsive to the monitoring, and based on network behavior of a userspace application, create one or more firewall rules for a kernel-mode firewall;
• and
• cause the kernel-mode firewall to enforce the one more firewall rules.

A computing device, comprising:

• a processor circuit and a memory;
• an operating system comprising a kernel space and a non-kernel space;
• and
• instructions encoded within the memory to instruct the processor circuit to provide a security application, the security application to:
• within the non-kernel space, asynchronously monitor network activity of a network-enabled application;
• based on the asynchronous monitoring, create one or more firewall rules for a kernel-mode firewall;
• and
• cause the kernel-mode firewall to enforce the one more firewall rules.