SYSTEMS AND METHODS FOR SPLIT NETWORK TUNNELING BASED ON TRAFFIC INSPECTION

1 . A computer-implemented method for split network tunneling based on traffic inspection, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

directing, by the computing device, network traffic to a network client of the computing device;

performing, by the network client, an inspection of the network traffic;

categorizing the network traffic based on the inspection; and

in response to categorizing the network traffic, performing a security action to protect the computing device from computer malware.

2 . The computer-implemented method of claim 1 , wherein performing the inspection of the network traffic comprises determining that the network traffic is a domain name system (DNS) request.

3 . The computer-implemented method of claim 2 , further comprising:

parsing the network traffic;

extracting a domain name from the network traffic;

determining a reputation of the domain name; and

in response to determining the reputation of the domain name, performing the security action, wherein the security action comprises one of blocking access to a domain of the domain name and allowing access to the domain of the domain name.

4 . The computer-implemented method of claim 1 , wherein performing the inspection of the network traffic comprises determining that the network traffic is a hypertext transfer protocol (HTTP) request.

5 . The computer-implemented method of claim 4 , further comprising:

parsing the network traffic;

determining that the HTTP request is for a protected resource of a remote server; and

performing the security action, wherein the security action comprises transmitting the network traffic over a secure tunnel to the remote server.

6 . The computer-implemented method of claim 1 , wherein the security action comprises at least one of:

blocking transmission of the network traffic;

transmitting the network traffic directly to a destination host; and

transmitting the network traffic through a secure tunnel connection to a remote server.

7 . The computer-implemented method of claim 6 , further comprising:

establishing a secure channel to a designated server; and

transmitting a portion of the network traffic to the designated server using the secure channel.

8 . The computer-implemented method of claim 6 , wherein the secure tunnel connection is at least one of:

a transport layer security (TLS) tunnel;

a datagram TLS (DTLS) tunnel;

an Internet Protocol Security (IPsec) tunnel; and

an OpenVPN tunnel.

9 . The computer-implemented method of claim 6 , wherein transmitting the network traffic directly to the destination host further comprises:

transmitting a payload of a packet of the network traffic directly to the destination host;

receiving a response from the destination host;

embedding the response in a response packet; and

transmitting the response packet to the network client.

10 . The computer-implemented method of claim 1 , further comprising:

logging the network traffic and the security action;

correlating the network traffic and the security action; and

generating a policy for the inspection of the network traffic based at least in part on correlations of the network traffic and the security action.

11 . A system for split network tunneling based on traffic inspection, the system comprising:

a computing device comprising at least one physical processor; and

physical memory comprising computer-executable instructions that, when executed by the at least one physical processor, cause the computing device to:

direct network traffic to a network client of the computing device;

perform, by the network client, an inspection of the network traffic;

categorize the network traffic based on the inspection; and

in response to categorizing the network traffic, perform a security action to protect the computing device from computer malware.

12 . The system of claim 11 , wherein, to perform the inspection of the network traffic, the computer-executable instructions further cause the one or more computing devices to determine that the network traffic is a domain name system (DNS) request.

13 . The system of claim 12 , wherein the computer-executable instructions further cause the computing device to:

parse the network traffic;

extract a domain name from the network traffic;

determine a reputation of the domain name; and

in response to a determination of the reputation of the domain name, perform the security action, wherein the security action comprises one of blocking access to a domain of the domain name and allowing access to the domain of the domain name.

14 . The system of claim 11 , wherein, to perform the inspection of the network traffic, the computer-executable instructions further cause the computing device to determine that the network traffic is a hypertext transfer protocol (HTTP) request.

15 . The system of claim 14 , wherein the computer-executable instructions further cause the one or more computing devices to:

parse the network traffic;

determine that the HTTP request is for a protected resource of a remote server; and

perform the security action, wherein the security action comprises transmitting the network traffic over a secure tunnel to the remote server.

16 . The system of claim 11 , wherein the security action comprises at least one of:

block transmission of the network traffic;

transmit the network traffic directly to a destination host; and

transmit the network traffic through a secure tunnel connection to a remote server.

17 . The system of claim 16 , wherein the secure tunnel connection is at least one of:

a transport layer security (TLS) tunnel;

a datagram TLS (DTLS) tunnel;

an Internet Protocol Security (IPsec) tunnel; and

an OpenVPN tunnel.

18 . The system of claim 16 , wherein, to transmit the network traffic directly to a destination host, the computer-executable instructions further cause the computing device to:

transmit a payload of a packet of the network traffic directly to the destination host;

receive a response from the destination host;

embed the response in a response packet; and

transmit the response packet to the network client.

19 . The system of claim 11 , wherein the computer-executable instructions further cause the one or more computing devices to:

log the network traffic and the security action;

correlate the network traffic and the security action; and

generate a policy for the inspection of the network traffic based at least in part on correlations of the network traffic and the security action.

20 . A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

direct network traffic to a network client of the computing device;

perform, by the network client, an inspection of the network traffic;

categorize the network traffic based on the inspection; and

in response to categorizing the network traffic, perform a security action to protect the computing device from computer malware.