Juniper Networks, Inc.

Holonet Security, Inc.

Hefei Holonet Security Technology Co.. Ltd.

Chunqing Cheng

Sheng Shuang Li

Feng Zou

Peter H Wong

De Xiong Li

Ying Xiong

The disclosed teachings include a computer-implemented method a computer-implemented method for identifying a data breach. The method includes monitoring movement of data over a computer network in real-time or near real-time relative to at least one of a user, a device, or a software application, comparing the monitored movement of the data to a baseline movement of the data over the computer network in real-time or near real-time relative to at least one of the user, the device, or the software application, and identifying an ongoing data breach in real-time or near real-time based on the comparison. The identified ongoing data breach indicates a relationship between the data and at least one of the user, the device, and the software application.

Detection of an ongoing data breach based on relationships among multiple network elements

At least one embodiment relates to a method and a system for cloud application visibility of network traffic. The method includes: receiving, from a network gateway, hardware identity extracted from network session traffic for accessing cloud-based application services, wherein the hardware identities correspond to user devices that initiate the network session traffic; receiving, from an application processing engine, user credentials decoded from the network session traffic, wherein the user credentials authorize the network session traffic to access the cloud-based application services; and matching the hardware identities with the user credential to identify a user who uses multiple user devices or multiple user credentials to access the cloud-based application services.

Stateful user device identification and binding for cloud application security

A device receives a data transaction associated with packet, determines a risk level associated with the data transaction, and performs a content type check for the data transaction. The device also performs an infected content check for the data transaction, and classifies, based on the determined risk and the performed checks, the data transaction for one of a slow path virus scanning process or a fast path virus scanning process. The device further performs, based on the classification, one of the slow path virus scanning process or the fast path virus scanning process on the data transaction.

Antivirus intelligent flow framework

Requests from a client to a network device are authenticated based on a session ID obtained by the network device. Requests may be authenticated by obtaining a session ID value when a session is initiated and transmitting a document to the client that embeds the session ID in such a manner that additional requests to the network device based on the document include the session ID in the request. The additional requests are authenticated based on a determination of whether the session ID is included in the additional requests.

Growing community of inventors

San Jose, CA, United States of America

Chunqing Cheng