Dashboard for managing enterprise network traffic

• US 10,878,110 B2
• Filed: 10/27/2017
• Issued: 12/29/2020
• Est. Priority Date: 09/12/2017
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Kraft, Chris Douglas
• Primary Examiner(s): Nguyen, Angela
• Application Number:
  US15/795,791
• Publication Number:
  US 20190081873A1
• Time in Patent Office: 1,159 Days
• Field of Search: None
• CPC Class Codes: G06F 12/0813 with a network or matrix configuration
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2212/60 Details of cache memory
• CPC Class Codes: G06F 2212/62 Details of cache specific to multiprocessor cache arrangements
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 47/2475 for supporting traffic characterised by the type of applications
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 : Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 : Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 : Rule management
• CPC Class Codes: H04L 63/14 : for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 : Vulnerability analysis
• CPC Class Codes: H04L 63/1441 : Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 : the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 : involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 9/0891 : Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3268 : using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

An enterprise security system is improved by managing network flows based on an application type. When a network message having an unknown application type is received at a gateway, firewall, or other network device/service from an endpoint, the endpoint that originated the network message may be queried for identifying information for the source of the network message and the application type may be determined, or the endpoint may periodically communicate application type information to the network device in a heartbeat or other periodic communication or the like. The network message may be managed along with other network traffic according to the application type.

Claims

1. A method for visualizing network usage comprising:

providing a number of application types that characterize one or more applications sourcing network traffic within an enterprise network;

labeling each of a number of network traffic flows in the enterprise network with one of the application types by querying endpoints for application type information when each new one of the number of network traffic flows is initiated, wherein querying the endpoints includes querying an endpoint defense driver in a kernel space of one of the endpoints to retrieve information from a process cache in the kernel space that stores at least a process identifier and an associated one of the application types for one or more processes executing on the one of the endpoint and wherein the kernel space is protected against manipulation by processes executing in a user space;

aggregating a number of endpoints using each one of the application types on the enterprise network at a cloud-based enterprise management facility; and

configuring the cloud-based enterprise management facility to present the number of endpoints using each one of the application types to a user in a web-based dashboard.

2. The method of claim 1 wherein each of the number of application types includes an application name.

3. The method of claim 1 wherein the number of application types include electronic mail, word processing, spread sheet, and web browser.

4. The method of claim 1 wherein labeling includes labeling at one or more network devices within the enterprise network.

5. The method of claim 1 wherein labeling includes extracting an explicit application type label from a network message within one of the network traffic flows.

6. The method of claim 5 wherein the explicit application type label is cryptographically signed.

7. The method of claim 1 wherein labeling includes extracting an explicit application type label from information transmitted in a heartbeat from an endpoint that originated a network message within one of the network traffic flows.

8. The method of claim 7 wherein the heartbeat is a secure heartbeat.

9. The method of claim 7 wherein the heartbeat is a digitally signed heartbeat.

10. The method of claim 1 wherein aggregating the number of endpoints using each one of the application types includes aggregating only the application types used by one or more of the endpoints.

11. The method of claim 1 wherein the web-based dashboard provides interactive access to underlying data for one or more of network usage by each application type, number of endpoints using each application type, duration of usage, and bandwidth usage.

12. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:

providing a number of application types;

labeling each of a number of network traffic flows in an enterprise network with one of the application types by querying endpoints for application type information when each new one of the number of network traffic flows is initiated, wherein querying the endpoints includes querying an endpoint defense driver in a kernel space of one of the endpoints to retrieve information from a process cache in the kernel space that stores at least a process identifier and an associated one of the application types for one or more processes executing on the one of the endpoint and wherein the kernel space is protected against manipulation by processes executing in a user space;

aggregating a number of endpoints using each one of the application types on the enterprise network; and

configuring a server to present the number of endpoints using each one of the application types to a user in a web-based dashboard.

13. The computer program product of claim 12 wherein each of the number of application types includes an application name.

14. The computer program product of claim 12 wherein the number of application types include electronic mail, word processing, spread sheet, and web browser.

15. The computer program product of claim 12 wherein labeling includes extracting an explicit application type label from a network message within one of the network traffic flows.

16. The computer program product of claim 12 wherein labeling includes extracting an explicit application type label from information transmitted in a heartbeat from an endpoint that originated a network message within one of the network traffic flows.

17. The computer program product of claim 12 wherein the web-based dashboard provides interactive access to underlying data for one or more of network usage by each application type, number of endpoints using each application type, duration of usage, and bandwidth usage.

18. A system comprising:

a plurality of security agents executing on a plurality of endpoints in an enterprise network;

one or more network device in the enterprise network, each one of the network devices configured to label each of a number of network traffic flows in the enterprise network with one of an application type by querying endpoints for application type information when each new one of the number of network traffic flows is initiated, wherein querying the endpoints includes querying an endpoint defense driver in a kernel space of one of the endpoints to retrieve information from a process cache in the kernel space that stores at least a process identifier and an associated one of the application types for one or more processes executing on the one of the endpoint and wherein the kernel space is protected against manipulation by processes executing in a user space, the application type selected from a predetermined group of application types; and

a server configured to aggregate usage data from each one of the network devices to determine a number of instances of each one of the predetermined group of application types associated with a network traffic flow within the enterprise network, and to present the usage data in a web-based interface.