Cisco Technology, Inc.

Andrew Chi

David A McGrew

Blake Harrell Anderson

Scott William Dunlop

Saran Singh Ahluwalia

Adam Burke Weller

Joseph Dave Rosen

David Arthur Mcgrew

Techniques for detecting malware process injection on a host device. The techniques may include receiving endpoint metadata associated with an event, the endpoint metadata including information associated with a process that made a network connection from a host device. The techniques may also include receiving network metadata associated with the event, the network metadata including a network protocol fingerprint used to make the network connection. The techniques may further include determining that the network protocol fingerprint is indicative of a presence of malware process injection via the process running on the host device. Based on detecting the process of the malware process injection, an indication may be reported to a monitoring system and one or more remedial actions may be taken.

Malware process injection detection

Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Identifying unmanaged cloud resources with endpoint and network logs

In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.

Passive decryption of encrypted traffic to generate more accurate machine learning training data

Passive decryption on encrypted traffic to generate more accurate machine learning training data

Growing community of inventors

Chapel Hill, NC, United States of America

Andrew Chi