Dashboard for managing enterprise network traffic
An enterprise security system is improved by managing network flows based on an application type. When a network message having an unknown application type is received at a gateway, firewall, or other network device/service from an endpoint, the endpoint that originated the network message may be queried for identifying information for the source of the network message and the application type may be determined, or the endpoint may periodically communicate application type information to the network device in a heartbeat or other periodic communication or the like. The network message may be managed along with other network traffic according to the application type.
1. A method for visualizing network usage comprising:
providing a number of application types that characterize one or more applications sourcing network traffic within an enterprise network;
labeling each of a number of network traffic flows in the enterprise network with one of the application types by querying endpoints for application type information when each new one of the number of network traffic flows is initiated, wherein querying the endpoints includes querying an endpoint defense driver in a kernel space of one of the endpoints to retrieve information from a process cache in the kernel space that stores at least a process identifier and an associated one of the application types for one or more processes executing on the one of the endpoint and wherein the kernel space is protected against manipulation by processes executing in a user space;
aggregating a number of endpoints using each one of the application types on the enterprise network at a cloud-based enterprise management facility; and
configuring the cloud-based enterprise management facility to present the number of endpoints using each one of the application types to a user in a web-based dashboard.
2. The method of claim 1 wherein each of the number of application types includes an application name.
3. The method of claim 1 wherein the number of application types include electronic mail, word processing, spread sheet, and web browser.
4. The method of claim 1 wherein labeling includes labeling at one or more network devices within the enterprise network.
5. The method of claim 1 wherein labeling includes extracting an explicit application type label from a network message within one of the network traffic flows.
6. The method of claim 5 wherein the explicit application type label is cryptographically signed.
7. The method of claim 1 wherein labeling includes extracting an explicit application type label from information transmitted in a heartbeat from an endpoint that originated a network message within one of the network traffic flows.
8. The method of claim 7 wherein the heartbeat is a secure heartbeat.
9. The method of claim 7 wherein the heartbeat is a digitally signed heartbeat.
10. The method of claim 1 wherein aggregating the number of endpoints using each one of the application types includes aggregating only the application types used by one or more of the endpoints.
11. The method of claim 1 wherein the web-based dashboard provides interactive access to underlying data for one or more of network usage by each application type, number of endpoints using each application type, duration of usage, and bandwidth usage.
12. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
providing a number of application types;
labeling each of a number of network traffic flows in an enterprise network with one of the application types by querying endpoints for application type information when each new one of the number of network traffic flows is initiated, wherein querying the endpoints includes querying an endpoint defense driver in a kernel space of one of the endpoints to retrieve information from a process cache in the kernel space that stores at least a process identifier and an associated one of the application types for one or more processes executing on the one of the endpoint and wherein the kernel space is protected against manipulation by processes executing in a user space;
aggregating a number of endpoints using each one of the application types on the enterprise network; and
configuring a server to present the number of endpoints using each one of the application types to a user in a web-based dashboard.
13. The computer program product of claim 12 wherein each of the number of application types includes an application name.
14. The computer program product of claim 12 wherein the number of application types include electronic mail, word processing, spread sheet, and web browser.
15. The computer program product of claim 12 wherein labeling includes extracting an explicit application type label from a network message within one of the network traffic flows.
16. The computer program product of claim 12 wherein labeling includes extracting an explicit application type label from information transmitted in a heartbeat from an endpoint that originated a network message within one of the network traffic flows.
17. The computer program product of claim 12 wherein the web-based dashboard provides interactive access to underlying data for one or more of network usage by each application type, number of endpoints using each application type, duration of usage, and bandwidth usage.
18. A system comprising:
a plurality of security agents executing on a plurality of endpoints in an enterprise network;
one or more network device in the enterprise network, each one of the network devices configured to label each of a number of network traffic flows in the enterprise network with one of an application type by querying endpoints for application type information when each new one of the number of network traffic flows is initiated, wherein querying the endpoints includes querying an endpoint defense driver in a kernel space of one of the endpoints to retrieve information from a process cache in the kernel space that stores at least a process identifier and an associated one of the application types for one or more processes executing on the one of the endpoint and wherein the kernel space is protected against manipulation by processes executing in a user space, the application type selected from a predetermined group of application types; and
a server configured to aggregate usage data from each one of the network devices to determine a number of instances of each one of the predetermined group of application types associated with a network traffic flow within the enterprise network, and to present the usage data in a web-based interface.