Extrahop Networks, Inc.

Benjamin Thomas Higgins

Michael Kerber Krause Montague

Jesse Abraham Rothstein

Xue Jun Wu

Jeff James Costlow

Kevin Michael Seguin

Eric James Rongo

Bhushan Prasad Khanal

Brian Hatch

John Gemignani, Jr

Eric Joseph Hammerle

Eric Jacob Ball

Charlotte Ching-Hsing Tan

Songqian Chen

Edmund Hope Driggs

Jonathan Jacob Scott

Po-Shen Lee

Katherine Megan Porterfield

Jade Alexi Tabony

Marc Adam Winners

Kenneth Perrault

Michael Ryan Corder

Brian David Hatch

Embodiments resynchronize encrypted network traffic. A capture flow that includes network traffic captured from encrypted network flows may be monitored and the captured network traffic may be decrypted for analysis. A hole in the capture flow may be determined based on gaps in portions of the captured network traffic disabling the monitoring of the capture flow and the decryption of the captured network traffic. A size of the hole may be determined based on a size of the gap in the portions of the captured network traffic. Other network traffic may be captured from the capture flow subsequent to the hole. Cipher resynchronization parameters may be determined based on the size of the hole, other portions of the captured network traffic, or the encryption protocol. The other portions of the captured network traffic may be decrypted based on the cipher resynchronization parameters to reenable monitoring of the capture flow.

Resynchronizing encrypted network traffic

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Metrics may be determined based on monitoring network traffic associated with a plurality of entities each associated with a profile that includes the metrics for each entity. Beaconing metrics associated with beaconing activity may be determined based on the metrics. The profile of each entity may be compared with the beaconing metrics to determine the entities that may be engaged in beaconing activity. The entities may be characterized based on beaconing activity such that the beaconing activity includes communication with endpoints associated with the third parties, employing communication protocols associated with the third-parties, or exchanging payloads consistent with the beaconing activity. Reports that include information associated with the entities and its beaconing activity may be generated.

Identifying network entities based on beaconing activity

Embodiments are directed monitoring network traffic using network monitoring computers. Metrics may be determined based on monitoring network traffic associated with entities in the network such that the metrics may be included in profiles associated each entity. The profiles may be compared with other profiles in a context database based on the metrics included in each profile and each other profile. In response to the profiles being unmatched by other profiles one or more active probes may be performed to collect other metrics that may be used to update profiles. In response to the one or more profiles being matched by the other profiles in the context database, a timestamp associated with the other profiles may be updated to a current time value. Reports that include information associated with the entities and the profiles or the updated profiles may be generated.

Combining passive network analysis and active probing

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). NMCs may determine requests provided to a server based on a first portion of network traffic. NMCs may determine suspicious requests based on characteristics of the provided requests. NMCs may employ the characteristics of the suspicious requests to provide correlation information that is associated with the suspicious requests. NMCs may determine dependent actions associated with the server based on a second portion of the network traffic and the correlation information. And, in response to determining anomalous activity associated with the evaluation of the dependent actions, NMCs may provide reports associated with the anomalous activity.

Detecting injection attacks using passive network monitoring

Embodiments are directed to monitoring communication between computers using network monitoring computers (NMCs). NMCs identify a secure communication session established between two of the computers based on an exchange of handshake information associated with the secure communication session. Key information that corresponds to the secure communication session may be obtained from a key provider such that the key information may be encrypted by the key provider. NMCs may decrypt the key information. NMCs may derive the session key based on the decrypted key information and the handshake information. NMCs may decrypt network packets included in the secure communication session. NMCs may be employed to inspect the one or more decrypted network packets to execute one or more rule-based policies.

Inline secret sharing

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers.

Monitoring encrypted network traffic

Embodiments are direct to monitoring communication between computers may be using network monitoring computers (NMCs). Network packets that are communicated between the computers may be captured and stored in a data store. If the NMCs identify a secure communication session established between two computers, the NMCs may obtain key information that corresponds to the secure communication session that includes a session key that may be provided by a key provider. Correlation information associated with the secure communication session may be captured by the NMCs. The correlation information may include tuple information associated with the secure communication session. And, the key information and the correlation information may be stored in a key escrow. The key information may be indexed in the key escrow using the correlation information.

Managing session secrets for continuous packet capture systems

Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.

Correlating causes and effects associated with network activity

Embodiments are directed to monitoring network traffic to determine users and assets based on the network traffic. A user role model may assign a user role and provide a role confidence score for the users based on network traffic associated with the users. An asset model may assign an asset type and provide an asset confidence score the assets based on network traffic associated with the assets. The users may be associated with assets based on the network traffic. The role confidence scores provided for the users may be modified based on the asset type assigned to assets associated with the users. The asset confidence score provided for the assets may be modified based on the user role assigned to the users associated with the assets. A report that includes information about the user roles and the asset types may be provided.

Growing community of inventors

Shoreline, WA, United States of America

Benjamin Thomas Higgins