1. A method comprising: receiving, at a computing device separate from a first computing device, event information related to a network access attempt initiated by a process executing on the first computing device, wherein the network access attempt is intercepted and held on the first computing device, wherein a process traffic mapping element of the first computing device is queried to determine two or more software program files of a plurality of software program files mapped to the process in the process traffic mapping element of the first computing device, wherein the event information includes information identifying each of the two or more software program files, and wherein at least one software program file of the two or more software program files is an executable file and at least one other software program file of the two or more software program files is a library module loaded by the process; determining respective trust statuses for each of the two or more software program files; determining, based on the respective trust statuses of the two or more software program files, whether network traffic associated with the process is to be permitted; creating a restriction rule to block the network traffic on a network protection device if the network traffic is not to be permitted; and pushing the restriction rule to the network protection device, wherein the network traffic is not to be permitted if any one or more of the trust statuses is untrusted, wherein the network access attempt is to be released by the first computing device after the restriction rule is pushed to the network protection device.