As we know, network based firewalls will filter based on information such as source IP, source port, etc. But they won't know what program on the source machine is generating that traffic.
Complementing a network based firewall there may be a host-based firewall installed on local machines, responsible for controlling which programs are allowed network access. In some cases, these firewalls are configured to block by default.
Malware/rogue software could disable the firewall rules on the local machine and exfiltrate data. Since the network firewall is running on a remote device, it couldn't disable that. But it wouldn't need to, as the network firewall would not know what binary on the source IP has generated that traffic.
From a high-level view, it would seem the easiest solution to this problem would be to have a remote network based firewall capable of application level filtering (e.g. block all outgoing traffic from test.exe). But on a lower-level view it's not too easy.
I've done a few searches around network-based application firewalls but I can't seem to find much on it.
So I'm wondering if anyone's come across this before and has seen any examples?
The possible solutions I can think of would involve potentially writing a network procotol based driver to add the source application into the packet header (or a hash of the source application for added security), and then writing a sort of advanced iptables to inspect the packets for the source program field. There would be a lot of factors to consider, such as integrity checking of the source path (i.e. to check whether the malware has not simply altered the packet to make it appear to originate from a trusted application).
Any insight would be appreciated, thanks.