US 12,261,824 B2
Firewall techniques for colored objects on endpoints
Andrew J. Thomas, Oxfordshire (GB); Neil Robert Tyndale Watkiss, Oxford (GB); Daniel Salvatore Schiappa, Bedford, NH (US); and Kenneth D. Ray, Seattle, WA (US)
Assigned to Sophos Limited, Abingdon (GB)
Filed by Sophos Limited, Abingdon (GB)
Filed on Oct. 4, 2021, as Appl. No. 17/492,901.
Application 17/492,901 is a continuation of application No. 16/143,864, filed on Sep. 27, 2018, granted, now 11,140,130.
Application 16/143,864 is a continuation of application No. 14/485,782, filed on Sep. 14, 2014, granted, now 10,122,687, issued on Nov. 6, 2018.
Prior Publication US 2022/0131836 A1, Apr. 28, 2022
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/0263 (2013.01) [H04L 63/10 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
providing a gateway for an endpoint to a network resource;
monitoring use of the gateway by an application executing on the endpoint;
on the endpoint and in response to a first observed action of the application, coloring the application with a descriptor of a context for the first observed action, wherein:
the first observed action corresponds to access to the network resource,
the descriptor includes a target action following the first observed action and a reportable event count of occurrences of the target action,
the descriptor is inheritable by one or more processes associated with the application, and
the descriptor persists through a reboot of the endpoint;
applying a rule dependent on the descriptor at the endpoint in response to a second observed action of the application to detect a reportable event, the second observed action including a pattern of occurrences of the target action following the first observed action with a count of occurrences meeting a threshold based on the reportable event count of the target action that, in combination with the first observed action, indicate a compromised state of the endpoint;
communicating the reportable event including the count of occurrences of the target action through a network from the endpoint to the gateway; and
limiting access by the application through the gateway to the network resource based on the reportable event.