Identity-based application-level filtering of network traffic
A processing device in one embodiment comprises a processor coupled to a memory and is configured to derive one or more items of context information arising from a given application session within a network, and determine a level of sensitivity to be attributed to the given application session by analyzing one or more factors against the one or more items of context information. The processing device is further configured to generate a filtering score for the given application session based on the determined level of sensitivity, wherein the filtering score indicates a level of relevance attributed to the given application session with respect to a task of monitoring traffic within the network, and output the filtering score to one or more components associated with the network.
1. A method for application-level filtering of network traffic, the method comprising steps of:
deriving one or more items of context information arising from a given application session within a network;
determining a level of sensitivity to be attributed to the given application session by analyzing one or more factors against the one or more items of context information, wherein the one or more factors comprise at least a risk associated with strength of a user authentication associated with the given application session;
generating a filtering score for the given application session based on the determined level of sensitivity, wherein the filtering score indicates a level of relevance attributed to the given application session with respect to a task of monitoring traffic within the network; and
outputting the filtering score, for use in capturing application-related traffic, to one or more components associated with the network, wherein the one or more components comprise a network security tool, and wherein said outputting comprises outputting the filtering score to the network security tool as a signed assertion through an application programming interface call;
wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the one or more factors comprise a risk associated with the user of the given application session.
3. The method of claim 2 , wherein the risk associated with the user is based on the user profile attributed to the user.
4. The method of claim 2 , wherein the risk associated with the user is based on behavior of the user during the given application session.
5. The method of claim 1 , wherein the one or more factors comprise a risk associated with a geographic location of an original client of the given application session.
6. The method of claim 1 , wherein the one or more factors comprise a risk associated with one or more environmental factors.
7. The method of claim 1 , wherein the one or more factors comprise a level of sensitivity attributed to the application accessed in the given application session.
8. The method of claim 1 , wherein the network security tool is configured to take a pre-determined action in response to receiving the filtering score.
9. The method of claim 8 , wherein the pre-determined action comprises applying one or more filters to preclude monitoring data and/or capturing data arising from the given application session.
10. The method of claim 1 , wherein said outputting the filtering score to one or more components associated with the network comprises outputting the filtering score to the application accessed in the given application session.
11. The method of claim 10 , wherein said outputting the filtering score to the application comprises outputting the filtering score to the application as an attribute within an existing signed assertion.
12. The method of claim 1 , wherein the at least one processing device comprises an identity provider (IDP) connected to the network.
13. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device to:
derive one or more items of context information arising from a given application session within a network;
determine a level of sensitivity to be attributed to the given application session by analyzing one or more factors against the one or more items of context information, wherein the one or more factors comprise at least a risk associated with strength of a user authentication associated with the given application session;
generate a filtering score for the given application session based on the determined level of sensitivity, wherein the filtering score indicates a level of relevance attributed to the given application session with respect to a task of monitoring traffic within the network; and
output the filtering score, for use in capturing application-related traffic, to one or more components associated with the network, wherein the one or more components comprise a network security tool, and wherein said outputting comprises outputting the filtering score to the network security tool as a signed assertion through an application programming interface call.
14. The processor-readable storage medium of claim 13 , wherein the one or more factors comprise a risk associated with the user of the given application session.
15. The processor-readable storage medium of claim 13 , wherein the one or more factors comprise a risk associated with a geographic location of an original client of the given application session.
16. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
said at least one processing device being configured to:
derive one or more items of context information arising from a given application session within a network;
determine a level of sensitivity to be attributed to the given application session by analyzing one or more factors against the one or more items of context information, wherein the one or more factors comprise at least a risk associated with strength of a user authentication associated with the given application session;
generate a filtering score for the given application session based on the determined level of sensitivity, wherein the filtering score indicates a level of relevance attributed to the given application session with respect to a task of monitoring traffic within the network; and
output the filtering score, for use in capturing application-related traffic, to one or more components associated with the network, wherein the one or more components comprise a software network security tool, and wherein said outputting comprises outputting the filtering score to the software network security tool as a signed assertion through an application programming interface call.
17. The apparatus of claim 16 , wherein the one or more factors comprise at least one of a risk associated with the user of the given application session, and a risk associated with a geographic location of an original client of the given application session.
18. The method of claim 6 , wherein the one or more environmental factors comprises at least one of a type and a version of software used by the user during the given application session, a time of day during the given application session, and a version of an operating system which is running in connection with the given application session.
19. The method of claim 6 , wherein the one or more environmental factors comprises a determination of whether a secure transport layer security session is used during the given application session.