Cisco Technology, Inc.

Citrix Systems, Inc.

Vmware, Inc.

Daniel George Wing

K Tirumaleswar Reddy

Prashanth Patil

David A McGrew

Tirumaleswar Reddy

Blake Harrell Anderson

Cullen F Jennings

Jonathan David Rosenberg

Flemming Andreasen

William C VerSteeg

Ram Mohan Ravindranath

Manbinder Pal Singh

James Neil Guichard

Hendrikus G P Bosch

Robert T Bell

Kevin Shatzkamer

Alessandro Duminuco

Jeffrey Michael Napper

Surendra M Kumar

Humberto Jose La Roche

William C Ver Steeg

Bruce Stuart Davie

Andrew Zawadowskiy

Tomas Pevny

Saravanan Radhakrishnan

Muthu Arul Mozhi Perumal

Donovan O'Hara

Pål-Erik Martinsen

John Restrick

Carlos M Pignataro

Anand K Oswal

Rajiv Asati

David R Oran

Michael Anthony Ramalho

Herbert Michael Wildfeuer

Parameswaran Kumarasamy

Dexiang Wang

Ali C Begen

Vamsidhar Valluri

Parag Pritam Thakore

Kaushik Pratap Biswas

Dan Touitou

Jayesh Chokshi

Vinay Jayant Pande

Michael David Geller

Ottalingam Satyanarayanan

Shivangi Sharma

Subbiah Kandasamy

Shiva Shankar

Bill Ver Steeg

Christopher A Wild

Nidheesh Dubey

Srinath Gundavelli

Kent Kinchu Leung

Jeroen Mattijs Van Rotterdam

Sandeep Rao

Ralph Droms

Arkesh Kumar

Wojciech Dec

Rajesh Kumar

Jacob Jared Summers

Scott S Firestone

Eric G Vyncke

Ramesh Nethi

Christopher Metz

Goresh Musalay

Jagannathan Shiva Shankar

Mihailo Zilovic

James E Coffman

Feng Cao

Ratnesh Singh Thakur

Geir Sandbakken

Saravanan Agasaveeran

Dan Tan

Greg Harald Hakonsen

Charles U Eckel

Jaideep Padhye

Mohamed Kamel Zanaty

Mohamed S Mostafa

Bill Versteeg

Kanika Nema

Robert Biskner

Jon Michael Snyder

Ram Mohan R

Asterios Stergioudis

Srinivas Chivukula

Michael Zayats

Eitan Ben-Nun

Reinaldo De Azevedo Penno Filho

Jan Wegger

William Drew Gaskill

Raghukrishna Hegde

Tarun Marhwal

Nivedita Jagdale

Ramachandra Kasyap Marmavula

Joseph Hoelbrandt

Kirtesh Patil

Pratik Shah

Girish Chandra Padhi

Manohar B Hungund

In one embodiment, a device in a network receives an attack mitigation request regarding traffic in the network. The device causes an assessment of the traffic, in response to the attack mitigation request. The device determines that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic. The device causes an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.

Automatic retraining of machine learning models to detect DDoS attacks

Described embodiments provide systems and methods for morphing or regenerating validation information. A client can receive, via a device, an authentication cookie for access to a server. The device may maintain a sequence number and a cryptographic secret. The client may use the cryptographic secret and a cookie engine to generate validation cookie information with an updated sequence number. The client may send the authentication cookie to the device via a hypertext transfer protocol (HTTP) message to validate the authentication cookie. The client may send the validation cookie information with the updated sequence number to the device via a HTTP message to validate the authentication cookie.

Preventing HTTP cookie stealing using cookie morphing

A method may include receiving, by a computing system and from a first device, first data. The first data may be based at least in part on a first output from a first instance of a model processed by the first device. The method may further include receiving, by the computing system and from the first device, second data that was processed by the first instance of the model to produce the first output. The method may also include processing, by the computing system, the second data with at least a portion of a second instance of the model to produce a second output. The method may additionally include determining, by the computing system, third data based at least in part on the second output. Further, the method may include determining, by the computing system, that the third data is consistent with the first data.

Local model processing and remote verification

A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to protect against theft of user credentials. The at least one processor is further configured to recognize a uniform resource locator (URL) to which a web browser is navigating, as a URL for which protection is to be provided. The recognition is based on an absence of the URL from a history of visited URLs for which a password has been entered. The at least one processor is further configured to extract a character sequence of selected length that is entered into a field of a website associated with the recognized URL; compare an encryption of the character sequence to entries in a list of encrypted partial passwords of the same selected length; and perform a security action in response to a match resulting from the comparison.

Systems and methods for protection against theft of user credentials

The method for a virtual machine to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels is presented. In an embodiment, the method comprises detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application executing on the first machine toward a server application executing on a second machine; and determining, by the redirect agent, whether a first redirect rule matches the packet. In response to determining that the first redirect rule matches the packet, the redirect agent applies the first redirect rule to the packet to translate the packet into a translated packet, and provides the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.

Port and loopback IP addresses allocation scheme for full-mesh communications with transparent TLS tunnels

A computing device includes a memory and a processor configured to receive credentials stored on a client device for a website responsive to the client device initiating a launch of the website through a first browser at the client device. The processor runs a second browser to launch the website for display at the client device using the received credentials and some state information is synchronized between them for the duration of the session. The second browser isolates the website from access to other data of the client device.

Passing local credentials to a secure browser session

In one embodiment, a device in a network captures domain name system (DNS) response data from a DNS response sent by a DNS service to a client in the network. The device captures session data for an encrypted session of the client. The device makes a determination that the encrypted session is malicious by using the captured DNS response data and the captured session data as input to a machine learning-based or rule-based classifier. The device performs a mediation action in response to the determination that the encrypted session is malicious.

Identifying and using DNS contextual flows

A computer system is provided. The computer system includes a memory and at least one processor coupled to the memory and configured to receive a sequence of characters within a field of a web browser, the field being associated with a password entry field served to the web browser from a website. The processor is further configured to store the received sequence of characters and send an alternate sequence of characters to the website. The processor is further configured to encrypt the received sequence of characters to generate a received encrypted partial password and compare the received encrypted partial password to one or more entries in a list of encrypted partial passwords. The processor is further configured to, in response to the comparison resulting in a difference, delete the previously sent alternate sequence of characters, and send the stored sequence of characters to the website.

In one embodiment, a device in a network receives domain name system (DNS) information for a domain. The DNS information includes one or more service tags indicative of one or more services offered by the domain. The device detects an encrypted traffic flow associated with the domain. The device identifies a service associated with the encrypted traffic flow based on the one or more service tags. The device prioritizes the encrypted traffic flow based on the identified service associated with the encrypted traffic flow.

Utilizing service tagging for encrypted flow classification

A method comprises receiving, at a network infrastructure device, a flow of packets, determining, using the network infrastructure device and for a first subset of the packets, that the first subset corresponds to a first datagram and determining a first length of the first datagram, determining, using the network infrastructure device and for a second subset of the packets, that the second subset corresponds to a second datagram that was received after the first datagram, and determining a second length of the second datagram, determining, using the network infrastructure device, a duration value between a first arrival time of the first datagram and a second arrival time of the second datagram, sending, to a collector device that is separate from the network infrastructure device, the first length, the second length, and the duration value for analysis.

Detection of malware and malicious applications

A domain-name-based network-connection attestation system provides for more user friendly and less error prone (compared to IP-address-based attestation systems) updating of a whitelist used to determine whether or not to allow a requested network connection. A guest agent extracts from a DNS reply a domain name, and an IP address mapped to a domain name. The agent enters these values in an agent DNS cache. When a process requests a connection to an IP address, the agent uses the IP address to determine the domain name from the agent DNS cache. The agent then determines whether the IP address is mapped to the process identity in a domain-name-based whitelist. If it is, the connection is attested to and allowed; if it is not, a secondary IP address whitelist can be checked.

Domain-name-based network-connection attestation

Modern day user applications leverages new communication technologies such as WebRTC, WebEx, and Jabber allow devices to connect and exchange media content including audio streams, video streams, and data stream/channels. The present disclosure describes mechanisms for a Port Control Protocol (PCP) server to provide feedback to PCP clients to enforce certain policies on the transport of such media content for a network. A policy may include a traffic handling policy for enforcing differentiated quality of service characteristics for different types of media streams. Another policy may include a security policy ensuring a data files being transmitted over a data channel from one endpoint travels to a security application via a relay element before the packets reaches another endpoint. The mechanisms are transparent to the endpoints, and advantageously preserve the user experience for these user applications.

Smarter policy decisions based on metadata in data flows

Growing community of inventors

San Jose, CA, United States of America

Daniel George Wing