Abstract: Embodiments provide methods of protecting computing devices from malicious activity. A processor of a network device may receive a first network traffic flow of a monitoring computing device and a malicious activity tag identifying a malicious behavior of the first network traffic flow. The processor may determine a characteristic of the first network traffic flow based at least in part on information in the first network traffic flow and the malicious activity tag. The processor may receive a second network traffic flow from a non-monitoring computing device, and may associate the malicious activity tag and the second network traffic flow based on a characteristic of the second network traffic flow based at least in part on information in the second network traffic flow and the characteristic of the first network traffic flow.

Abstract: Embodiments provide methods of managing network traffic flows. A processor of a network device may receive a first network traffic flow of a monitoring computing device and information identifying a source application of the first network traffic flow. The processor may determine a characteristic of the first network traffic flow associated with the application based at least in part on information in the first network traffic flow and the identified source application. The processor may receive a second network traffic flow from a non-monitoring computing device, and may associate the source application and the second network traffic flow if one or more characteristics of the second network traffic flow match or correlating to one or more characteristics of network traffic resulting from the source application.

Abstract: Embodiments provide methods of protecting computing devices from malicious activity. A processor of a networking device may monitor network traffic flows of network computing devices and identify applications that are a source of the first network traffic flow. The processor may observe network traffic flows of identified source applications over time to determine normal network traffic flows of the source applications. The processor may then observe network traffic flows to detect when a source application is behaving anomalously based on associated network traffic flow characteristics deviating from normal network traffic flows of the source applications.