Labeling network flows according to source applications
An enterprise security system is improved by instrumenting endpoints to explicitly label network flows according to sources of network traffic. When a network message from an endpoint is received at a gateway, firewall, or other network device/service, the network message may be examined to determine the application on the endpoint that originated the request, and this source information may be used to control routing or other handling of the network message.
1. A non-transitory computer program product for managing network flows at a network device, the computer program product comprising a memory of the network device, the memory bearing computer executable code that, when executing on the network device, performs the steps of:
receiving a network message from an endpoint at the network device, the network device positioned in a network between the endpoint and an intended recipient, and the network message including a source address for the endpoint, a destination address for the intended recipient of the network message, a label created by the endpoint that identifies each of (i) an application on the endpoint that generated the network message and (ii) a user identifier for a user of a process associated with the application that generated the network message, wherein the user identifier distinguishes between automated machine activity and human activity on the endpoint, and a payload of data from the application on the endpoint;
processing the network message on the network device to extract the label that identifies the application and the user identifier;
based on a reputation of the application in a reputation database at the network device and the user identifier extracted from the label, determining a threat reputation of the application that generated the network message; and
routing the network message to the destination address conditionally based on the threat reputation of the application that generated the network message.
2. The computer program product of claim 1 further comprising code that performs the step of caching the label and the threat reputation of the application on the network device.
3. The computer program product of claim 1 wherein the label includes a name of the endpoint.
4. The computer program product of claim 1 wherein the label is cryptographically signed by the endpoint.
5. The computer program product of claim 1 wherein the network device includes a gateway.
6. The computer program product of claim 1 wherein the network device includes a router.
7. The computer program product of claim 1 wherein the network device includes a threat management facility for an enterprise network that includes the endpoint.
8. A method for managing network flows with a network device based on sources of data, the method comprising:
receiving a network message from an endpoint at the network device, the network message including a source address for the endpoint, a destination address for an intended recipient of the network message, a label created by the endpoint that identifies each of (i) an application on the endpoint that generated the network message and (ii) a user identifier for a user of a process associated with the application that generated the network message, wherein the user identifier distinguishes between automated machine activity and human activity, and a payload of data from the application on the endpoint, wherein the network device is positioned within a network between the endpoint and the intended recipient;
processing the network message on the network device to extract the label that identifies the application and the user identifier;
based on a reputation of the application in a reputation database at the network device and the user identifier extracted from the label, determining a threat reputation of the application that generated the network message; and
routing the network message to the destination address conditionally based on the threat reputation of the application identified in the label that generated the network message.
9. The method of claim 8 further comprising caching the label and the threat reputation of the application on the network device.
10. The method of claim 8 wherein the label includes a name of the endpoint.
11. The method of claim 8 wherein the label is cryptographically signed by the endpoint.
12. A system comprising:
a network device including a network interface configured to couple the network device in a communicating relationship with a data network that includes an endpoint, wherein the network device is between the endpoint and an intended recipient;
a memory on the network device, wherein the memory has stored thereon a reputation database; and
a processor on the network device, the processor configured to execute instructions stored in the memory to perform the steps of receiving a network message from the endpoint through the network interface, the network message including a source address for the endpoint, a destination address for the intended recipient of the network message, a label created by the endpoint that identifies each of (i) an application on the endpoint that generated the network message and (ii) a user identifier for a user of a process associated with the application that generated the network message, wherein the user identifier distinguishes between automated machine activity and human activity on the endpoint, and a payload of data from the application on the endpoint, processing the network message to extract the label that identifies the application and the user identifier, based on a reputation of the application in the reputation database stored on the memory of the network device and the user identifier extracted from the label, determining a threat reputation of the application that generated the network message, and routing the network message based on the threat reputation of the application that generated the network message.
13. The system of claim 12 wherein the network device includes at least one of a gateway, a router, and a threat management facility.
14. The computer program product of claim 1 wherein the user identifier for the user of the process includes a user presence indicator.
15. The method of claim 8 wherein the user identifier for the user of the process includes an explicit user input.
16. The system of claim 12 wherein the user identifier for the user of the process includes an indication of whether a display of the endpoint is locked, a record of keyboard activity, or a record of mouse activity.
17. The computer program product of claim 1 , wherein determining the threat reputation of the application includes determining the threat reputation based on the destination address.
18. The computer program product of claim 1 , further comprising evaluation a second reputation of the destination address and routing the network message to the destination address conditionally based in part of the second reputation of the destination address.