Determining a reputation of a network entity

1. A computer-implemented method, comprising:

monitoring, by a network traffic monitoring system, network traffic data for a plurality of nodes of a network;

analyzing, by the network traffic monitoring system, the network traffic data to classify a type of traffic for each flow of a plurality of flows;

receiving, to the network traffic monitoring system from a requestor, a request for a reputation score associated with one or more nodes of the network;

identifying, by the network traffic monitoring system, the type of traffic for one or more flows associated with the one or more nodes, each identified flow defining an event;

determining, by the network monitoring system, the reputation score associated with the one or more nodes based on the type of traffic for the one or more flows associated with the one or more nodes; and

sending, by the network traffic monitoring system, the reputation score to the requestor; and

blocking a node of the one or more nodes from sending traffic in response to the reputation score for that node being below a predetermined threshold;

wherein the reputation score is calculated by:

Reputation Score =Σ i=1 n Value i +(Recovery i *[Time current −Time i ])

where:

n is the number of events identified during the identifying;

Value i is an initial relative impact of the type of traffic of an ith event on the reputation score, where Value i , is different for at least two different values of i;

Recovery i is a constant for the type of traffic of the ith event, wherein the Recovery for at least one event is non-zero, and the recovery for at least one other event is zero;

Time current is a time value based on a current time;

Time i is a time value based on a time of the ith event.

2. The computer-implemented method of claim 1 , wherein analyzing the network traffic data to classify a type of traffic for each flow includes:

matching the flow to a known pattern of traffic.

3. The computer-implemented method of claim 2 , wherein the known pattern of traffic corresponds to at least one of a DDOS attack, a FIN scan, or a port knock.

4. The computer-implemented method of claim 1 , wherein analyzing the network traffic data to classify a type of traffic for each flow includes:

identifying one or more network policies associated with the flow; and

determining whether the flow complies with the one or more network policies.

5. The computer-implemented method of claim 1 , wherein the requestor is a requesting node on the network and the method further includes receiving a request to transmit data to one of the one or more nodes.

6. The computer-implemented method of claim 1 , wherein the reputation score is associated with at least one of an endpoint, an endpoint group, a pair of endpoints, a pair of endpoint groups, an endpoint and an endpoint group, a user name for a process, a process, or a path for a process of the network.

7. The computer-implemented method of claim 1 , wherein determining the reputation score includes:

determining at least one of the one or more flows is tagged as malicious or misconfigured; and

decreasing the reputation score.

8. The computer-implemented method of claim 1 , wherein the requestor is a presentation module of the network monitoring system and the method further comprises:

generating a network status report containing the reputation score.

9. A non-transitory computer-readable medium having computer readable instructions that, when executed by a processor of a computer, cause the computer to:

monitor, by a network traffic monitoring system, network traffic data for a plurality of nodes of a network;

analyze, by the network traffic monitoring system, the network traffic data to classify a type of traffic for each flow of a plurality of flows;

receive, to the network traffic monitoring system from a requestor, a request for a reputation score associated with one or more nodes of the network;

identify, by the network traffic monitoring system, the type of traffic for one or more flows associated with the one or more nodes, each identified flow defining an event;

determine, by the network monitoring system, the reputation score associated with the one or more nodes based on the type of traffic for the one or more flows associated with the one or more nodes;

send, by the network traffic monitoring system, the reputation score to the requestor; and

block a node of the one or more nodes from sending traffic in response to the reputation score for that node being below a predetermined threshold;

wherein the reputation score is calculated by:

Reputation Score =Σ i=1 n Value i +(Recovery i *[Time current −Time i ])

where:

n is the number of events identified during the identifying;

Value i is an initial relative impact of the type of traffic of an ith event on the reputation score, where Value i , is different for at least two different values of i;

Recovery i is a constant for the type of traffic of the ith event, wherein the Recovery for at least one event is non-zero, and the recovery for at least one other event is zero;

Time current is a time value based on a current time;

Time i is a time value based on a time of the ith event.

10. The non-transitory computer-readable medium of claim 9 , wherein the instructions that cause the computer to analyze the network traffic data to classify a type of traffic for each flow further cause the computer to:

match the flow to a known pattern of traffic.

11. The non-transitory computer-readable medium of claim 10 , wherein the known pattern of traffic corresponds to at least one of a DDOS attack, a FIN scan, or port knock.

12. The non-transitory computer-readable medium of claim 9 , wherein the instructions that cause the computer to analyze the network traffic data to classify a type of traffic for each flow further cause the computer to:

identify one or more network policies associated with the flow; and

determine whether the flow complies with the one or more network policies.

13. The non-transitory computer-readable medium of claim 9 , wherein the reputation score is associated with at least one of an endpoint, an endpoint group, a pair of endpoints, a pair of endpoint groups, an endpoint and an endpoint group, a user name for a process, a process, or a path for a process of the network.

14. A system comprising:

a processor;

memory including instructions that when executed by the processor, cause the system to:

monitor, by a network traffic monitoring system, network traffic data for a plurality of nodes of a network;

analyze, by the network traffic monitoring system, the network traffic data to classify a type of traffic for each flow of a plurality of flows;

receive, to the network traffic monitoring system from a requestor, a request for a reputation score associated with one or more nodes of the network;

identify, by the network traffic monitoring system, the type of traffic for one or more flows associated with the one or more nodes, each identified flow defining an event;

determine, by the network monitoring system, the reputation score associated with the one or more nodes based on the type of traffic for the one or more flows associated with the one or more nodes;

send, by the network traffic monitoring system, the reputation score to the requestor; and

block a node of the one or more nodes from sending traffic in response to the reputation score for that node being below a predetermined threshold;

wherein the reputation score is calculated by:

Reputation Score =Σ i=1 n Value i +(Recovery i *[Time current −Time i ])

where:

n is the number of events identified during the identifying;

Value i is an initial relative impact of the type of traffic of an ith event on the reputation score, where Value i , is different for at least two different values of i;

Recovery i is a constant for the type of traffic of the ith event, wherein the Recovery for at least one event is non-zero, and the recovery for at least one other event is zero;

Time current is a time value based on a current time;

Time i is a time value based on a time of the ith event.

15. The system of claim 14 , wherein the instructions that cause the system to analyze the network traffic data to classify a type of traffic for each flow further cause the system to:

match the flow to a known pattern of traffic.

16. The system of claim 14 , wherein the instructions that cause the system to analyze the network traffic data to classify a type of traffic for each flow further cause the system to:

identify one or more network policies associated with the flow; and

determine whether the flow complies with the one or more network policies.

17. The system of claim 14 , wherein the requestor includes at least one of a presentation module, an analytics module, or a policy engine of the network traffic monitoring system.

18. The system of claim 14 , wherein the reputation score is associated with at least one of an endpoint, an endpoint group, a pair of endpoints, a pair of endpoint groups, an endpoint and an endpoint group, a user name for a process, a process, or a path for a process of the network.