Netskope, Inc.

Juniper Networks, Inc.

Armorblox, Inc.

Chetan Anand

Krishna Narayanaswamy

Ravi Ithal

Arjun Sambamoorthy

Lebin Cheng

Abhay Kulkarni

Rajneesh Chopra

Dhananjay Sampath

Anand Raghavan

Steve Malmskog

Prashanth Arun

Shankaran Gnanashanmugam

Anand Deshpande

Balaji Balasubramanian

A cloud security service provides network security. The cloud security service receives, via a computer network, an electronic message sent by a sending user of an enterprise to a receiving user. The cloud security service analyzes the electronic message using a machine-learned user model describing the sending user's electronic messages, the user model generated based at least in part on previous electronic messages sent by the sending user. The cloud security service determines, based on the analysis, that the electronic message violates a security policy of the enterprise. The cloud security service performs a security action based on the determination that the electronic message violates the security policy.

User model-based data loss prevention

A computer-implemented method is described to monitor and control enterprise information stored on a cloud computing service (CCS). The method includes using a cross-application monitor to detect a cloud computing service (CCS) application programming interface (API) in use and a function or an activity being performed via the CCS API. The method also includes determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content being transmitted to the CCS. The method further includes applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control and triggering a security action responsive to finding the strings and interrelated strings subject to content control in the parsed stream.

Systems and methods of monitoring and controlling enterprise information stored on a cloud computing service (CCS)

The technology disclosed relates to a proxy receiving a request to manipulate a data object on an independent object store. The proxy is interposed between a user system from which the request originates and the independent object store. The technology disclosed further relates to the proxy accessing a metadata store that contains object metadata for the data object and retrieving the object metadata. The technology disclosed further relates to the proxy enforcing a policy on the request based on the object metadata. Enforcing the policy further includes enforcing malware detection policies and threat detection policies.

Cloud security based on object metadata

A cloud security service receives an electronic message sent by a purported sending user to a receiving user. The cloud security service retrieves a user model and a user identity associated with the purported sending user, the user identity including a set of feature values describing messages from the purported sending user. The cloud security service applies the user model to the received electronic message to identify a set of feature values describing the electronic message. The cloud security service compares the set of feature values describing the electronic message to the set of feature values describing messages from the purported sending user included in the user identity. The cloud security service determines, based on the comparison, whether the received electronic message was sent by the purported sending user. The cloud security service performs a security action based on the determination.

Message validation using machine-learned user models

The technology disclosed relates to enforcing multi-part policies on data-deficient transactions of independent data stores. In particular, it relates to combining active analysis of access requests for the independent object stores with inspection of objects in the independent object stores, each of the analysis and inspection generating and persisting object metadata in a supplemental data store, actively processing data-deficient transactions that apply to the objects by accessing the supplemental data store to retrieve object metadata not available in transaction streams of the data-deficient transactions, and actively enforcing the multi-part policies using the retrieved object metadata.

Middle ware security layer for cloud computing services

Data loss prevention (DLP) policy enforcement based on object metadata

Systems and methods of enforcing multi-part policies on data-deficient transactions of cloud computing services

Metadata-based cloud security

Metadata-based data loss prevention (DLP) for cloud storage

A system is configured to receive traffic being transported via a network; obtain, as a result of receiving the traffic, content from one or more packets associated with the traffic; analyze the content to identify one or more attributes associated with the content, where the one or more attributes correspond to at least one of: a network address, information associated with an application with which the traffic is associated, information associated with message content, or information associated with software content; determining that at least one attribute, of the one or more attributes, matches an attribute, of a set of attributes that are stored within a memory, where the set of attributes corresponds to a set of categories of traffic; identify a category, of the set of categories, that corresponds to the attribute; associate the category and the traffic; and process the traffic based on the associated category.

Traffic classification and control on a network node

A device is configured to receive a first request sent from a user device to a server. The first request may include a request to receive particular information from the server. The device receives a response to the first request sent from the server to the user device. The response includes the particular information. The device determines a potential request from the user device based on the particular information included in the response. The devices determines a policy associated with the potential request prior to a second request corresponding to the potential request being received. The device receives the second request from the user device. The device processes the second request based on the policy that was determined prior to the second request being received.

Security device for preemptively determining policies

A system may identify one or more attributes associated with traffic. The system may then determine that at least one attribute, of the one or more attributes, matches an attribute of a set of attributes that correspond to a set of categories of traffic. Based on determining that the at least one attribute matches the attribute of the set of attributes, the system may identify a category, of the set of categories, that corresponds to the attribute. The system may associate the category with the traffic, and process the traffic based on the associated category.

Growing community of inventors

San Francisco, CA, United States of America

Chetan Anand