Policy enforcement based on host value classification

1. A network appliance comprising:

a hardware processor; and

a non-transitory machine-readable storage medium encoded with instructions executable by the hardware processor to:

receive a packet stream;

determine that the packet stream is associated with a proxy connection by:

determining an internet protocol (IP) address in a header of a first packet of the packet stream,

comparing the IP address with a list of known proxy servers, and

based upon matching the IP address with a second IP address in the list of known proxy servers, determining that the packet stream is associated with the proxy connection;

determine a host value for a true end device of the packet stream from a message of the packet stream;

determine a classification associated with the host value; and

enforce a policy to the packet stream based on the classification and the determination that the proxy connection is associated with the packet stream.

2. The network appliance of claim 1 , the instructions executable by the hardware processor to:

determine an address based on the host value, wherein the classification includes a reputation associated with the address, and wherein the policy includes blocking a session associated with the packet stream by dropping a plurality of packets of the stream based on the reputation.

3. The network appliance of claim 1 , the instructions executable by the hardware processor to:

determine an address based on the host value; and

determine a geographic location based on the address, wherein the classification includes the geographic location.

4. The network appliance of claim 3 , the instructions executable by the hardware processor to:

compare the geographic location to a list, wherein the policy is based on whether the geographic location is on the list.

5. The network appliance of claim 1 , wherein the message includes a Uniform Resource Identifier (URI).

6. The network appliance of claim 5 , wherein the message is a GET message or a CONNECT message.

7. The network appliance of claim 5 , wherein the packet stream is determined to be associated with the proxy connection because a structure of the URI is absolute.

8. A computer implemented method comprising:

executing inspection instructions to determine a Uniform Resource Identifier (URI) for a packet stream;

determining whether the URI is absolute or relative, wherein the URI is relative when the URI does not include full naming scheme information;

when the URI is relative, determining a host value from the packet stream, wherein the host value is listed outside of a header of a packet in the packet stream;

when the URI is absolute, determining that the packet stream is associated with a proxy connection;

determining a classification associated with the host value; and

based on the classification and the determination that the URI is absolute, enforcing a policy to a plurality of packets of the packet stream.

9. The method of claim 8 , further comprising:

determining that the packet stream is associated with a proxy connection when the URI is determined to be absolute.

10. The method of claim 8 , further comprising:

determining an address based on the host value; and

determining a geographic location based on the address;

wherein the classification includes the geographic location, and wherein the policy is further based on the geographic location.

11. The method of claim 10 , further comprising:

blocking a session associated with the packet stream by dropping the plurality of the packets of the packet stream based on whether the geographic location is on a list.

12. The method of claim 8 , further comprising:

determining an address based on the host value;

determining a reputation for the address, wherein the classification includes the reputation, and blocking a session associated with the packet stream by dropping the plurality of packets of the packet stream based on the reputation.

13. A non-transitory machine-readable storage medium storing instructions that, when executed by a physical processing element of a computing device, cause the computing device to:

determine a host value for a communication between a first device and a second device, wherein the communication includes a plurality of packets, and wherein the host value represents one of the first device and the second device;

determine that the communication is associated with a proxy connection by:

determining an internet protocol (IP) address in a header of a first packet of the plurality of packets,

comparing the IP address with a list of known servers, wherein the list of known servers correspond with known reputation information, and

based upon matching the IP address with a second IP address in the list of known servers, determining that the communication is associated with the proxy connection;

determine a reputation of one of the first device and the second device associated with the known reputation information in the list of known servers; and

based on the determination of the reputation and the communication being associated with the proxy connection, enforce a policy to the plurality of the packets of the communication.

14. The non-transitory machine-readable storage medium of claim 13 , further comprising instructions that, if executed by the physical processing element, cause the computing device to:

determine a geographic location based on the IP address, wherein the reputation is based on the geographic location.

15. The non-transitory machine-readable storage medium of claim 13 , further comprising instructions that, if executed by the physical processing element, cause the computing device to:

receive a message as part of the communication, wherein the message is a GET message, wherein the host value is determined from the GET message; and

determine a Uniform Resource Identifier (URI) from the message, wherein the determination that the communication is associated with the proxy connection is based on a structure of the URI.