Cisco Technology, Inc.

Google Inc.

Ashutosh Kulshreshtha

Navindra Yadav

Khawar Deen

Ali Parandehgheibi

Michael Standish Watts

Shashidhar R Gandham

Sunil Gupta

Omid Madani

Hai Trong Vu

Jackson Ngoc Ki Pang

Shih-Chun Chang

Supreeth Hosur Nagesh Rao

Luca De Alfaro

Andy Sloane

Vimal Jeyakumar

Nicu Daniel Cornea

Anubhav Gupta

Rohit Chandra Prasad

Ellen Christine Scheib

Bharathwaj Sankara Viswanathan

Varun Sagar Malhotra

Roberto Fernando Spadaro

Mitchell Slep

Abhishek Ranjan Singh

Hoang Viet Nguyen

Vimalkumar Jeyakumar

Sowmya Subramanian

Ethan G Russell

Fnu Rachita Agasthy

Duane Thomas Barlow

Walter Theodore Hulick, Jr

Kai Chang

Oliver Kempe

Uday Krishnaswamy Chettiar

Supreeth Rao

Jackson Pang

Hiral Shashikant Patel

Gökhan Hasan Bakir

Krishnendu Chaudhury

Baris Yuksel

Weifei Zeng

Radu Jurca

Alok Lalit Wadhwa

Aria Rahadian

James Gabriel Fontenot

Preethi Narayan

Vishal Jaswant Thakkar

Zhiwen Zhang

Chandra Mohan Babu Nadiminti

Girish Sivasubramanian

Dhruv Raithatha

Varun Sagar Malhorta

Sunil Kumar Gupta

A system of one embodiment that provides proactive security policy suggestions for applications based on the applications' software composition and runtime behavior. The system includes a memory and a processor. The system is operable to access data that represents one or more features of an application. The application is running on one or more nodes in a computer network, and a feature indicates an application library of the node. The system is operable to apply a clustering algorithm to the data to generate a plurality of cluster sets. The system is operable to determine a security policy to apply to a cluster set of the plurality of cluster sets and apply the security policy to an application whose features are represented by the data in the cluster set.

Systems and methods for application clustering based on included libraries and observed events

A system and method for evaluating penetration testing tools. In one embodiment, a method includes generating a plurality of instructions, wherein the instructions comprise one or more security vulnerabilities for testing a web server, generating the web server, wherein the web server comprises the plurality of instructions with the one or more security vulnerabilities, receiving a penetration test result from a penetration testing tool executing on the web server, and computing a precision of the penetration testing tool for detecting the one or more security vulnerabilities.

System and method for evaluating penetration testing tools

A system and method for updating and correcting facts that receives proposed values for facts from users and determines a correctness score which is used to automatically accept or reject the proposed values.

Moderation of user-generated content

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

In one embodiment, a method includes receiving, by a network component, application performance data. The application performance data is associated with one or more applications. The method also includes determining to transform, by the network component, the application performance data into application security data, generating, by the network component, a baseline for the application security data, and detecting, by the network component, an anomaly in the baseline. The method further includes determining, by the network component, a potential security threat based on the anomaly.

Systems and methods for deriving application security signals from application performance data

The present disclosure provides systems, methods, and computer-readable media for implementing security polices at software call stack level. In one example, a method includes generating a call stack classification scheme for an application, detecting a call stack during deployment of the application; using the call stack classification scheme during runtime of the application, classifying the detected call stack as one of an authorized call stack or an unauthorized call stack to yield a classification; and applying a security policy based on the classification.

Security policies for software call stacks

This disclosure generally relate to a method and system for network policy simulation in a distributed computing system. The present technology relates techniques that enable simulation of a new network policy with regard to its effects on the network data flow. By enabling a simulation data flow that is parallel and independent from the regular data flow, the present technology can provide optimized network security management with improved efficiency.

System and method for network policy simulation

According to some embodiments, a method includes detecting a start of an OpenTelemetry span by an application and determining security information related to the start of the OpenTelemetry span. The method further includes monitoring the application for one or more application behaviors during execution of the OpenTelemetry span. The method further includes detecting an end of the OpenTelemetry span by the application, and in response, calculate a security score for the OpenTelemetry span using the security information related to the start of the OpenTelemetry span and the one or more application behaviors detected during execution of the OpenTelemetry span. The method further includes updating a status of the OpenTelemetry span to include the security score and a text string related to the calculation of the security score.

Opentelemetry security systems and methods

A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

System and method of assigning reputation scores to hosts

An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

Policy utilization analysis

Growing community of inventors

Cupertino, CA, United States of America

Ashutosh Kulshreshtha