Zscaler, Inc.

Chakkaravarthy Periyasamy Balaiah

Srikanth Devarajan

Sandeep Kamath

Sushil Pangeni

Amit Sinha

Pankaj Chhabra

Kumar Gaurav

Abhishek Bathla

Kailash Kailash

Chenglong Zheng

Sreedhar Pampati

Dhawal Kumar Sharma

Shweta Gupta

Raman Madaan

Vikas Mahajan

Vladimir Stepanenko

Kd Mazboudi

Satish Kalipatnapu

Khaireddine Mazboudi

Manoj Apte

Ajit Singh

Sridhar Narasimhan

Samuel John Crank

Sandeep Kamath Voderbet

Javier Rodriguez Gonzalez

Prasannakumar Jobigenahally Malleshaiah

John A Chanak

Deepen Desai

Pratap Ramachandra

Rishabh Gupta

Lakshmaiah Regoti

Rubin Azad

Sanjit Ganguli

Alexander Frazier

Ashok Kolachina

K D Mazboudi

Vaibhav Aher

Gregory Rybinski

Barrett Hostetter-Lewis

Amber Wu

Jithin Prajeev Nair

Shanghao Chen

Tejveer Singh

Jay Makwana

Systems and methods are provided for evaluating the effectiveness of network security tools for mitigating network security risks. According to one implementation, a method includes the step of analyzing a network to measure security parameters associated with the use of one or more network security tools that are configured for mitigating risk with respect to network compromise, data loss, lateral movement, and asset exposure. Based on the measured security parameters, the method further includes the step of quantifying the one or more network security tools to determine an effectiveness score defining an ability of the one or more network security tools, in combination, to counteract the network compromise, data loss, lateral movement, and asset exposure.

Risk mitigation effectiveness score of network security services

The present systems and methods provide a user performance monitoring solution that enables the monitoring of application and device performance from the end user's point of view. The present systems and methods help Information Technology (IT) personnel to ensure the quality of digital experience across the enterprise. The present system is adapted to collect telemetry data from devices relative to the performance of all tiers of Internet Service Providers (ISPs), create a baseline of the performance of the ISPs based on a plurality of metrics and the collected telemetry data, train a Machine Learning (ML) model to assess blackout and brownout prediction accuracy at different performance values for the metrics, and identify a blackout or brownout, wherein a blackout or brownout is identified when real time performance is worse than the performance values identified by the model.

Advanced machine learning techniques for internet outage detection

A method performed by a cloud system includes, subsequent to the cloud system connecting to one of a cloud provider and a Software-as-a-Service (SaaS) application, scanning data stored therein for one or more users associated with a tenant of a plurality of tenants of the cloud system; detecting an incident in the data during the scanning; maintaining details of the incident in an in-memory data store; and providing a notification to the tenant of the incident.

Cloud system providing data protection of data in a SaaS or cloud provider

A cloud service is executed on a plurality of nodes, each including at least one processor, and the cloud service is configured to communicate with a plurality of user devices, each user device associated with a user from an organization of a plurality of organizations, and each user device includes a plugin or browser extension installed thereon, provide configuration information to any of the plurality of user devices where the configuration information includes a plurality of domains to be monitored by the plugin or browser extension, wherein the plugin or browser extension is configured to monitor and/or determine real user monitoring (RUM) statistics when a given user device accesses one of the plurality of domains; and receive the RUM statistics from any of the plurality of user devices.

Real user monitoring statistics from end users via plugin or browser extension

Systems and methods include monitoring user experience of one or more users accessing any of the Internet, cloud applications, and private applications; determining a user experience score for the one or more users; responsive to detecting a low user experience score for a user, performing one or more analyses on the user experience of the user; and determining a root cause of the low user experience score based on the one or more analyses. The systems and methods can include determining a remedial action for the user based on the root cause.

Automatic analysis of user experience issues to reduce resolution time

Techniques for processing web probes for monitoring user experience including use of caching to prevent a surge of web probes on destination servers and for detecting web probe traffic. A method implemented by a connector includes intercepting a Hypertext Transfer Protocol Secure (HTTPS) web probe request to a server, identifying a cache hit associated with the request in a cache, generating a synthetic Hypertext Transfer Protocol (HTTP) response based on information from the identified cache hit, wherein the generated synthetic HTTP response includes an extension header containing collected statistics, and sending the synthetic HTTP response. The method can further include simulating a Secure Socket Layer (SSL) handshake to estimate SSL cost.

Systems and methods for reducing server load with HTTPS cache

A method performed by a Cloud Access Security Broker (CASB) service includes scanning data stored in one of a cloud provider and a Software-as-a-Service (SaaS) application, wherein the data is for a user associated with a company of a plurality of companies; detecting an incident in a file or email in the data during the scanning; maintaining details of the incident in an in-memory data store, including a current snapshot of the file or email; and providing a notification to the tenant of the incident. The method can further include, subsequent to the incident and while the file or email is being updated, updating the details of the incident in the in-memory data store.

Cloud access security broker systems and methods with an in-memory data store

Techniques for determining the path of User Datagram Protocol (UDP) traceroute probes using Transmission Control Protocol (TCP) and Internet Control Message Protocol (ICMP). Various embodiments include sending a plurality of probes to one or more legs in a network path; obtaining measurements from each of the plurality of probes for each of the one or more legs in the network path; and performing one or more actions based on the measurements from each of the plurality of probes. The steps further include overlapping the measurements to determine latency to a destination and identifying throttling of UDP traffic based on the overlapping of measurements from the plurality of probes.

Determining the path of user datagram protocol (UDP) traceroute probes

Techniques for using trace with tunnels and cloud-based systems for determining measures of network performance are presented. In an embodiment, a method includes determining a client application is being executed; determining an endpoint associated with the client application, based on any of monitoring application logs associated with the client application and network flows associated with the client application; and causing one or more probes to the determined endpoint and deriving metrics based on the one or more probes for determining performance of the client application.

Determining endpoint and application behavior for monitoring user experience

Systems and methods for alerting administrators of a monitored digital user experience include performing inline monitoring of network access between one or more users each with an associated user device executing an agent application, the Internet, and one or more cloud applications and private applications. The systems and methods also include obtaining device, application, and network metrics related to the inline monitoring from a cloud system and a logging and analytics system. The systems and methods further include comparing the metrics to one or more alerts comprising alert rules. The systems and methods yet further include sending a notification to one or more administrators when the metrics include data that satisfies the alert rules of the one or more alerts.

Systems and methods for alerting administrators of a monitored digital user experience

Techniques for deep tracing of one or more users via a cloud-based system include receiving a request from an administrator to actively troubleshoot a user; causing a user device associated with the user to create a deep tracing session based on the request; assisting the user device in performing one or more traces of a plurality of traces to a destination; receiving results from any of the plurality of traces and results from metrics collected at the user device; and displaying a network map between the user device and the destination.

Deep tracing of user experience

Systems and methods include obtaining statistics based on monitoring in a cloud-based system for a given time period; and, responsive to determining an arrangement of counters for N counters, storing each of M counters for the given time period as a plurality of records with each record including a record type, a possible offset to a next record in terms of a counter identifier (ID), and a counter value, wherein N and M are integers and M&#x3c;&#x3c;N, and wherein the arrangement is determined such that most frequently used counters occupy lower counter IDs. The systems and methods can further include updating the arrangement of the counters for the N counters, to perform an optimization such that the most frequently used counters occupy lower counter IDs.

Systems and methods for efficiently maintaining records in a cloud-based system

Systems and methods include receiving a record associated with an incident that was detected by the CASB system in a Software-as-a-Service (SaaS) application; determining a hash based on a plurality of levels for the record; determining if the record exists in a data store based on the hash, and if the record exists, deleting an old record; and inserting the record in the data store based on the hash, wherein the data store is maintained in-memory and includes records at leaf nodes in a multi-level hash based on the plurality of levels.

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include requesting a trace to a destination with a signature inserted into a trace packet; receiving a response to the trace packet; when the response does not include tunnel info, providing details in the response to a service where the details include parameters associated with a service path between the client and the destination; and, when the response includes tunnel info, segmenting the service path into a plurality of legs, causing a trace for each of the plurality of legs, and aggregating details for each of the plurality of legs based on the causing.

Detection of network hops and latency through an opaque tunnel and detection misconfiguration of tunnels

Techniques for using traceroute with tunnels and cloud-based systems for determining measures of network performance are presented. Systems and methods include periodically performing a full trace, at a first interval, to a destination; periodically performing a short trace, at a second interval that is less than the first interval, to a node in a cloud-based system; responsive to detection of issues based on the short trace, performing a full trace to the destination; and providing results of any of the full trace, the short trace, and any associated issues detected based thereon.

Growing community of inventors

San Jose, CA, United States of America

Chakkaravarthy Periyasamy Balaiah