1. A method comprising: at a network security device connected between a network and an endpoint device that is configured to host a client application, the client application configured to communicate with the network through the network security device using a request-response protocol: receiving from the client application a request that is destined for the network and that seeks a response from the network, the request having a context header including context information about the client application; determining whether the client application or a file accessed by the client application has a suspicious nature based on the context information; and if it is determined that the client application or the file accessed by the client application has the suspicious nature: blocking the request from the network; and sending to the client application a response indicating the blocking.