Firewall Policy Enforcement via Session APP ID and Process ID Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing advanced firewalls lack the capability for fine-grained security policy enforcement using session application identification (APP ID) and endpoint process identification (EP process ID) correlation, which limits their ability to restrict network traffic based on authorized processes and resources, and fails to effectively detect advanced stealth malware and evasion techniques.
Innovation Solution
Implementing techniques for correlating network sessions with endpoint process information, using trusted agents to identify and notify firewalls of process IDs, and applying fine-grained security policies based on APP ID and process ID information, including hierarchical process groupings and secure communication methods to enhance security policy enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional firewall policies are used, then basic network access control is provided, but fine-grained security policy enforcement based on process identification is not achieved
Solution Approach 1:
A process identification module is introduced as an intermediary component within the firewall system. This module captures process identification information from network packets and correlates it with session information, enabling fine-grained security policies without requiring complete redesign of the firewall architecture. The intermediary module bridges the gap between traditional packet filtering and process-level security control.
Solution Approach 2:
The firewall system is segmented into distinct functional modules: a process identification module that extracts process IDs from packets, a session information storage module that maintains session-state mappings, and a policy enforcement module that applies security rules. This segmentation allows each component to specialize in specific tasks, improving overall precision while managing complexity through modular design.
2Adaptability or versatility
If session APP ID and endpoint process ID correlation is implemented, then fine-grained control over security policies is achieved, but the complexity of firewall rules and processing increases
Solution Approach 1:
Session information including process ID correlations is pre-established and stored in a session information storage module before policy enforcement occurs. When packets arrive, the firewall performs quick lookups in this pre-built session table rather than performing complex real-time analysis, thereby achieving flexible policy adaptation without proportional increases in processing complexity.
Solution Approach 2:
The firewall transitions from traditional two-dimensional policy enforcement (source IP and destination IP) to a four-dimensional model by incorporating application identification (APP ID) and endpoint process ID as additional dimensions. This dimensional expansion enables fine-grained control across multiple parameters simultaneously, allowing security policies to adapt to complex traffic patterns while maintaining manageable rule structures through the session correlation mechanism.
3Reliability
If basic packet filtering is used, then network traffic control is provided, but detection of advanced stealth malware and evasion techniques is not effective
Solution Approach 1:
The firewall replaces traditional mechanical packet filtering mechanisms with a process-correlation-based detection system. Instead of relying solely on static packet header analysis, the system uses process identification information extracted from packets and correlates it with session-state data to dynamically detect anomalies. This substitution enables detection of stealth malware that attempts to evade traditional filtering by matching process IDs against known malicious patterns and behavioral baselines.
Solution Approach 2:
The session information storage module maintains continuous feedback loops by storing and updating process ID correlations with session states. When packets are analyzed, the system references this stored feedback information to determine whether the observed process-traffic patterns match authorized behaviors. This feedback mechanism enables reliable detection of malware that attempts to hide by mimicking legitimate process signatures, as the system can identify discrepancies between claimed process identity and actual behavioral patterns.
Data Source
AI summary
Techniques for fine-grained firewall policy enforcement using session APP ID and endpoint process ID correlation are disclosed. In some embodiments, a system/process/computer program product for fine-grained firewall policy enforcement using session APP ID and endpoint process ID correlation includes receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, in which the process identification information identifies a process that is initiating a network session from the EP device on the enterprise network; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID.