Citrix Systems, Inc.

Nutanix, Inc.

Anoop Reddy

Craig Anderson

Rajiv Mirani

Kenneth Bell

Abhishek Chauhan

Prakash Khemani

Georgios Oikonomou

Ratnesh Singh Thakur

Kurt Roemer

Nastaran Baradaran

Puneet Agarwal

Namit Sikka

Srinivasan Thirunarayanan

Yariv Keinan

Karan Gupta

Ajaykrishna Raghavan

Sanjay Kumar Gupta

Rama Rao Katta

Mayur Vijay Sadavarte

Raghu Goyal

Gowtham Alluri

Vamsi Korrapati

Rajkumar Arunkumar Joshi

Chinmay Dinesh Kamat

Vamsi Korrapatti

Stanley Wong

Ravishankar Chandhiramoorthi

Bhanu Prakash Valluri

Vishal Bandekar

George Oikonomou

Akshat Choudhary

Saibal Kumar Adhya

Vamsimohan Korrapati

An illustrative embodiment disclosed herein is an apparatus including a processor having programmed instructions to detect an operation associated with a first object instance in a first cluster, determine that the first object instance is configured for replication to a second cluster, create an object information (info) metadata entry for the first object instance, create an object replication metadata entry for the first object instance, and simultaneously write the object info metadata entry and the object replication metadata entry to a first data structure and a second data structure, respectively.

System and method for near-synchronous replication for object store

The disclosure is directed to a system for improving security of SSL communications. The system can include an device intermediary between one or more servers, one or more clients, a plurality of agents, and a web service. The servers can be configured to receive SSL connections and issue SSL certificates. The device can include a virtual server associated with a respective one of the servers, such that the SSL certificate of the respective server is transmitted through the device. The device can generate service fingerprints for the one or more servers. Each service fingerprint can include information corresponding to an SSL certificate of the virtual server, one or more DNS aliases for a virtual IP address of the respective virtual server, one or more port numbers serving the SSL certificate, and an IP address serviced by the device. The device also can transmit the service fingerprints to a web service.

Systems and methods for improving security of secure socket layer (SSL) communications

The present disclosure is directed towards systems and methods for evaluating or mitigating a network attack. A device determines one or more client internet protocol addresses associated with the attack on the service. The device assigns a severity score to the attack based on a type of the attack. The device identifies a probability of a user account accessing the service during an attack window based on the type of attack. The device generates an impact score for the user account based on the severity score and the probability of the user account accessing the service during the attack window. The device selects a mitigation policy for the user account based on the impact score.

Combining internet routing information with access logs to assess risk of user exposure

The present disclosure is directed towards systems and methods for scanning of a target range of IP addresses to verify security certificates associated with the target range of IP addresses. Network traffic may be monitored between a plurality of clients and a plurality of servers over an IP address space. Traffic monitors positioned intermediary to the plurality of client and the plurality of servers can identify a target range of IP addresses in the address space for targeted scanning. The target range of IP address may be grouped into a priority queue and a scan can be performed of the target range of IP addresses to verify a security certificate associated with each IP address in the target range of IP addresses. In some embodiments, a rogue security certificate is detected that is associated with at least one IP address in the target range of IP addresses.

Systems and methods for performing targeted scanning of a target range of IP addresses to verify security certificates

The present disclosure is directed towards systems and methods for detecting anomalous network traffic. Network traffic corresponding to an application executed by a server can be received. Application characteristics of the application can be identified to select an anomaly detection profile. The anomaly detection profile can be selected based on the identified application characteristics. The anomaly detection profile can include a set of detection features for the anomaly and one or more predetermined threshold values of the detection features. One or more feature values of the set of one or more detection features can be determined. An anomaly in the network traffic can be detected responsive to comparing the feature values and the predetermined threshold values of the detection features.

Feature engineering for web-based anomaly detection

Systems and methods for protection against session stealing is described. In embodiments of the present solution, a device intermediary to the client and the server may identify first properties of the client and associate the first properties with the session key. When the device receives subsequent request comprising the session key, the device matches the associated first properties with second properties of the second device that is sending the subsequent request. If there is a match, the subsequent request transmitted to the server. Otherwise, the subsequent request is rejected.

Protect applications from session stealing/hijacking attacks by tracking and blocking anomalies in end point characteristics throughout a user session

The present disclosure is directed towards systems and methods for improving anomaly detection using injected outliers. A normalcy calculator of a device may include a set of outliers into a training dataset of data points. The normalcy calculator, using a K-means clustering algorithm applied on the training dataset, identify at least a first cluster of data points. The normalcy calculator of the device may determine a region with a center and an outer radius that covers at least a spatial extent of the first cluster of data points. The normalcy calculator may determine a first normalcy radius for the first cluster by reducing the region around the center until a point at which all artificial outliers are excluded from a region defined by the first normalcy radius. An outlier detector of the device may use the region defined by the first normalcy radius to determine whether a new data point is normal or abnormal.

Anomaly detection with K-means clustering and artificial outlier injection

The present disclosure provides solutions for an enterprise providing services to a variety of clients to enable the client to use the resources provided by the enterprise by modifying URLs received and the URLs from the responses from the servers to the client's requests before forwarding the requests and the responses to the intended destinations. An intermediary may identify an access profile for a clients' request to access a server via a clientless SSL VPN session. The intermediary may detect one or more URLs in content served by the server in response to the request using one or more regular expressions of the access profile. The intermediary may rewrite or modify, responsive to detecting, the one or more detected URLs in accordance with a URL transformation specified by one or more rewrite policies of the access profile. The response with modified URLs may be forwarded to the client.

Systems and methods for configuration driven rewrite of SSL VPN clientless sessions

The present disclosure is directed towards systems and methods for characterizing anomalous network traffic. The system includes a device intermediary to clients and servers. The device includes a network traffic engine to receive network traffic including an anomaly. The device includes a univariate policy manager to determine whether the network traffic satisfies at least one of the rules of a univariate policy based on a respective single independent network traffic feature. The device includes a multivariate policy manager to determine, responsive to determining that the network traffic does not satisfy the rules of the univariate policy, that the network satisfies a multivariate policy including a plurality of anomaly explanation tests. The device includes an anomaly explanation selector to select, responsive to determining that the network traffic satisfies the multivariate policy, an anomaly explanation. The device includes a message generator to generate an anomaly explanation output including the selected anomaly explanation.

Framework for explaining anomalies in accessing web applications

The present disclosure is directed towards systems and methods for performing multi-level tagging of encrypted items for additional security and efficient encrypted item determination. A device intercepts a message from a server to a client, parses the message and identifies a cookie. The device processes and encrypts the cookie. The device adds a flag to the cookie indicating the device encrypted the cookie. The device re-inserts the modified cookie into the message and transmits the message. The device intercepts a message from a client and determines whether the cookie in the message was encrypted by the device. If the message was not encrypted by the device, the device transmits the message to its destination. If the message was encrypted by the device, the device removes the flag, decrypts the cookie, removes the tag from the cookie, re-inserts the cookie into the message and transmits the message to its final destination.

Systems and methods for multi-level tagging of encrypted items for additional security and efficient encrypted item determination

The present invention is directed towards systems and methods for generating a representation a plurality of learned rules from a learning engine of an application firewall. The representation may be generated based on a history of URL communications with a web server. A learning engine of an application firewall may determine a plurality of learned rules based on a history of URL communications with a web server. Each of the plurality of learned rules mat be assigned a URL string. A visualizer can categorize a subset of the plurality of learned rules under a first check type of a plurality of check types. The visualizer may further generate a tree representation of URL strings of the subset of learned rules. Each node of the tree corresponds to a segment of the URL strings identified based on a delimiter for the URL strings.

Systems and methods for providing a visualizer for rules of an application firewall

Systems and methods for configuring and evaluating policies that direct processing of one or more data streams are described. A configuration interface is described for allowing users to specify object oriented policies. These object oriented policies may allow any data structures to be applied with respect to a payload of a received packet stream, including any portions of HTTP traffic. A configuration interface may also allow the user to control the order in which policies and policy groups are executed, in addition to specifying actions to be taken if one or more policies are undefined. Systems and methods for processing the policies may allow efficient processing of object-oriented policies by applying potentially complex data structures to unstructured data streams. A device may also interpret and process a number of flow control commands and policy group invocation statements to determine an order of execution among a number of policies and policy groups. These policy configurations and processing may allow configuration and processing of complex network behaviors relating to load balancing, VPNs, SSL offloading, content switching, application security, acceleration, and caching.

Growing community of inventors

San Jose, CA, United States of America

Anoop Reddy