Riverbed Technology, Inc.

Andrew Ratin

Massimiliano Antonio Poletto

Edward W Kohler, Jr

Andrew Gorelik

Prem K Gopalan

Christopher James White

Anne Elizabeth Dudfield

Bryan Thomas Elverson

Andrew Kondrashov

Xiangjing Chen

Desislav I Tsankov

A first facility may include a data source and an edge service. A second facility may include a first cloud service and a second cloud service. A request may be received at the first cloud service to onboard the data source. A command may be sent from the first cloud service to an edge service to onboard the data source. The edge service may configure the data source to provide monitoring data to the second cloud service through the edge service. A data query may be received at the second cloud service from a client. A set of data queries may be determined based on the data query. A response may be generated based on executing the set of data queries. The response may be provided to the client.

Service for querying monitoring data

A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.

Connection based anomaly detection

Aggregator for connection based anomaly detection

Some embodiments of the present invention provide systems and methods for detecting anomalies in network traffic. Some embodiments detect anomalies based on time-series activity in network traffic. Upon detection of an anomaly, significant changes can be analyzed to identify abnormal changes in network traffic across different network entities. The identified changes can then be used to determine the cause and the impact of the detected anomaly on the network traffic.

Impact scoring and reducing false positives

A plurality of flow collector devices is disposed to collect flow information on a network. Duplicate flow records received from the flow collectors are eliminated by determining whether a pair of flow records has the same, source and destination flow identifiers and were received within a predefined time-period. Non-duplicated flow records received from the plurality of flow collector devices are stored and used to produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node from non-duplicated flow records. The connection table stores statistical information of packets on the network based on a time-slice basis.

Flow logging for connection-based anomaly detection

Connection table for intrusion detection

A system architecture for thwarting denial of service attacks on a victim data center is described. The system includes a first plurality of data monitors that monitor network traffic flow through the network. The first plurality of monitors is disposed at a second plurality of points in the network. The system includes a central controller that receives data from the plurality of monitors, over a hardened, redundant network. The central controller analyzes network traffic statistics to identify malicious network traffic. In one embodiment, a gateway device is disposed to pass network packets between the network and the victim site. The gateway includes a computing device executing a process to build a histogram for any attribute or function of an attribute of network packets and a process to determine if the values of the attribute exceed normal, threshold values expected for the attribute to indicate an attack on the site.

Denial of service attacks characterization

Data collectors in connection-based intrusion detection

Growing community of inventors

Newton, MA, United States of America

Andrew Ratin