Cisco Technology, Inc.

Lookingglass Cyber Solutions, Inc.

Avast Software S.r.o.

Trapeze Networks, Inc.

Aura Network Systems, Inc.

Allan Thomson

David Sheldon Stephenson

Christopher D Coleman

Brian Donald Hart

Bryan Wesley Brown

John Joseph Helmsen

Christopher Paul Pinney Wood

Bhautik Doshi

Nancy Cam-Winget

Pok Wong

Esteban Raul Torres

Paolo Fabio Zaino

Vanaja Ravi

Paul Jeffrey Stager

Patrice R Calhoun

Rohit Kumar Suri

James Martin Polk

Jason Lewis

Pramod S Badjate

Emilio Maldonado

Hang Jin

Santosh Ghanshyam Pandey

Shree N Murthy

Bretton Lee Douglas

Timothy S Olson

Robert B O'Hara, Jr

Subhasri Dhesikan

Joseph Salowey

Robert Bowser

Nancy Cam Winget

Tak Ming Pang

Vijayaraghavan Doraiswami

Hari Narayanan Rangarajan

Stan Chesnutt

Jagdish Girimaji

Kasi Nalamalapu

Milind Paranjpe

Tamara Lynne Casey

Michael Robert Gagne

Christopher Sean Johnson

Sean Convery

Dan Harkins

Christine Andiazabal

Steven Weinstein

Madhavi Vulpala

Min Cao

Charles Rodney Starrett

Christopher David Coleman

Jamie Smith

Drummond Reed

Edward S Harriman, Jr

Tim Kolar

Anita Pandey

Matthew Schott Bohmfalk Rodgers

Visshwanth Reddy

Mark Paul Yankowski

Jamison M Day

Aric Shipley

Systems and methods for transacting over a network. A first agent operating on a first computing system is operable to transact on behalf of a first entity. The first agent transacts with a second agent operating on a second computing system for a first cryptographically verifiable credential, transmits the first cryptographically verifiable credential to a third agent, and transacts with the third agent based on the first cryptographically verifiable credential for a second cryptographically verifiable credential to facilitate transacting with a fourth agent for a service. The second agent is operable to receive telemetry data of the first computing system which is configured to monitor the telemetry data, determine an assessment of the first entity based on the telemetry data, generate the first cryptographically verifiable credential based on the assessment of the first entity by the second agent, and transmit the first cryptographically verifiable credential to the first agent.

Systems and methods for reputation-based transactions over a network

A method of managing access to a network destination. The method includes establishing a first network zone for a user, the first network zone including a plurality of network destinations. The first network zone is monitored and one or more changes in the first network zone are determined. A first network destination in the first network zone is analyzed responsive to determining the one or more changes in the first network zone to determine a first threat. An attempt by the user to access the first network destination is detected, and access by the user to the first network destination is restricted based on the determining the first threat.

User and group specific threat protection system and method

Presented herein are systems and methods for operating a flight plan based distributed ledger system implemented on an aviation communications network. According to an aspect, data associated with communication transmissions occurring between communications elements of the aviation communications network may be recorded on the distributed ledger system. The communications elements involved in the distributed ledger system may be determined using a received flight plan. The flight plan information may be used to initialize the ledger information at each communications element involved in the distributed ledger system. The distributed ledger system may be updated to add or remove communications elements if the flight deviates from the original flight plan. After the flight plan is executed, the distributed ledger system may inactivate the ledger and store the ledger information in a centralized repository.

Systems and methods for flight plan specific distributed ledger based aviation data link security

A method includes accessing a first intelligence feed including a plurality of cybersecurity incidents. A second intelligence feed is generated including a plurality of technical indicators defined on one or more virtual private network internet point of presence ('VPN internet PoP') that connects a plurality of VPN tunnels to an internet. The first and second intelligence feeds are compared, a particular incident is determined, and a time frame of the particular incident is determined. Use of a particular VPN internet PoP by a plurality of sources including a plurality of clients is monitored to determine a plurality of time-based behaviors. The plurality of time-based behaviors are compared to the particular incident and to the time frame to determine a match. A particular source is blocked at the particular VPN internet PoP based on the determination of the match.

Privacy preserving malicious network activity detection and mitigation

Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.

Systems and methods for dynamic zone protection of networks

Disclosed are systems and methods for securing a network. A method may include obtaining, by a detection engine, an encapsulated image defining an action for a predetermined data packet of interest; determining, by the detection engine, that the action defined by the encapsulated image should be applied to one or more data packets accessed by the detection engine; generating and deploying, by the detection engine, an action state including one or more attributes associated with the accessed data packet and the encapsulated image; determining, at a first execution engine executing parallel with the detection engine, that the one or more data packets comprises attributes matching the one or more attributes included in the deployed action state; and executing, by the first execution engine, the action included in the deployed action state on a received data packet to generate a processed data packet.

Systems and methods for low latency stateful threat detection and mitigation

In an example embodiment, there is disclosed herein an apparatus comprising a wireless transceiver and a controller coupled to the wireless transceiver and configured to receive data via the wireless transceiver. The controller operates the wireless transceiver at a first power save state where the wireless transceiver can receive a frame but other circuits are de-energized. The controller is responsive to the wireless transceiver receiving a frame while the wireless transceiver is in a first power state to determine whether the frame is a predefined wakeup frame. The controller provides additional power to the wireless transceiver responsive to determining the frame is a predefined wakeup frame.

Automating radio enablement to facilitate power saving

The cyber threat intelligence confidence rating visualization and editing user interface technology (hereinafter 'TIC') provides a user interface that allows a user (e.g., a cyber threat analyst, etc.) to submit ratings for various characteristics associated with a cyber threat indicator. In one embodiment, the TIC may instantiate a user interactive risk evaluation component having a user interface input element for a user to submit calculation weights for one or more characteristics of a cyber threat; generate a graphical representation of a cyber threat confidence score for user interface display via the user interactive risk evaluation component; and dynamically adjust the graphical representation of the threat confidence score using at least one of the one or more characteristics weighted by the user configured weight.

Apparatuses, methods and systems for a cyber threat confidence rating visualization and editing user interface

Apparatus and methods described herein relate to a global workspace management compute device that can generate a workspace hierarchy tree representing a hierarchy of a set of workspaces in a network. A local workspace management compute device operatively coupled to the global workspace management compute device can, when operative, calculate workspace cyber-threat data for a local workspace in the set of workspaces based on data from a global workspace, and can provide the calculated workspace cyber-threat data to a local workspace interface so that the local workspace interface displays a representation of the set of workspaces in the network. After receiving modifications of portions of the local workspace cyber-threat data, the local workspace management compute device can define a child node of the local workspace based on the modifications. The local workspace interface can modify the representation of the set of workspaces in the network based on the child node.

Methods and apparatus for efficient storage and processing of global and local cyber threat data in a distributed factor graph database

The cyber threat monitor and control apparatuses, methods and systems (hereinafter 'CTMC') determines risk across a global Internet network graph model for various virtual or physical network elements. In one embodiment, the CTMC defines a factor mechanism representing interactions among the set of network elements, the factor mechanism including a factor indicative of a correlation between a pair of network elements from the set of network elements, and dynamically calculate the probabilistic network security measure for each network element in the global Internet graph model based at least in part on the factor mechanism and any observed threat indicators related to the global Internet graph model.

Cyber threat monitor and control apparatuses, methods and systems

The real-time cyber threat indicator verification mechanism technology (hereinafter 'TIVM') instantiates one or more virtual client emulators to access a source of a threat, in response to a received threat indicator, so as to evaluate validity and/or severity of the potential threat. In one embodiment, the TIVM may receive a cyber threat indicator having identifying information of a cyber threat source; instantiate, in response to the cyber threat indicator, a virtual client emulator; send a control message to cause the virtual client emulator to interact with the cyber threat source based on the identifying information; obtain a confidence indicator relating to the cyber threat indicator based on interaction between the virtual client emulator and the cyber threat source; and generate a cyber threat indicator confirmation report including the confidence indicator.

Apparatuses, methods and systems for a real-time cyber threat indicator verification mechanism

Presented herein are techniques for adding a secure control layer to a distributed communication fabric that supports publish-subscribe (pub-sub) and direct query (synchronization) communication. The secure control layer is configured to perform policy-based authentication techniques to securely manage the exchange of data/information within the communication fabric and enable registration/discovery of new capabilities.

Policy-based control layer in a communication fabric

Growing community of inventors

Pleasanton, CA, United States of America

Allan Thomson