Cisco Technology, Inc.

David A McGrew

Blake Harrell Anderson

Brian Eliot Weis

Daniel George Wing

K Tirumaleswar Reddy

Martin Grill

Subharthi Paul

Tomas Pevny

Martin Rehak

Saravanan Radhakrishnan

Scott Roy Fluhrer

Ivan Nikolaev

Sunil Amin

Michael Joseph Stepanek

Scott William Dunlop

Costas Kleopa

Alison Kendler

Flemming Andreasen

Vincent E Parla

Jan Vilhuber

Chirag Shroff

Martin Kopp

Jan Kohout

Mark John Baugher

Chris A Shenefiel

Andrew Chi

Robert M Waitman

Fabio Rodolfo Maino

Joseph Salowey

Andrew Zawadowskiy

Philip John Steuart Gladstone

W Scott Wainner

Kavitha Kamarthy

Martin Vejman

Donovan O'Hara

James Neil Guichard

Nancy Cam-Winget

Puneet Gupta

Warren Scott Wainner

Pere Monclus

Max Pritikin

Timothy David Keanini

Kenneth S Beck

Christopher Blayne Dreier

Jan Jusko

Hao Zhou

Keith Richard Schomburg

Sheela Dixit Rowles

Yixin Sun

Andrzej Kielbasinski

John Foley

William Michael Hudson, Jr

Andrew Persaud

Melinda L Shore

Rashmikant B Shah

Matthew Scott Robertson

James Anil Pramod Kotwal

Padmanabha C Jakkahalli

Kunal Patel

Vinod Arjun

Saran Singh Ahluwalia

David Aaron Wyde

Kellen Mac Arb

Ellie Marie Daw

Philip Ryan Perricone

Titouan Rigoudy

Sandeep Rao

Santosh Ramrao Patil

Cullen F Jennings

Prashanth Patil

Michal Sofka

Robert T Bell

Shree N Murthy

Gangadharan Byju Pularikkal

Malcolm M Smith

Johannes Petrus Kruys

Lionel Florit

Eric G Vyncke

Karel Bartos

Lukas Machlica

Petr Somol

Madhusudan Nanjanagud

Steven Joseph Rich

Richard Lee Barnes, Ii

Todd Short

Scott Thomas Fanning

Amjad Sayedrasul Inamdar

Panagiotis Theodorou Kampanakis

Jyoti Verma

Saul Adler

Constantinos Kleopa

Thirunavukkarasu Suresh

William C Melohn

Brian E Weiss

Michael Herne

Flemming Stig Andreason

Julien Thomas Piet

Michael Scott Dorsey

Jason R Brvenik

In one embodiment, a service receives administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device. The service analyzes the administration traffic data to determine whether any portion of the administration traffic data is resulting from an administration session involving a trusted administrator. The service flags a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from an administration session involving a trusted administrator, and a second portion of the administration traffic data is non-flagged. The service assesses the second portion of the administration traffic data using a machine learning-based traffic classifier to determine whether the second portion of the administration traffic data is malicious.

Automatically detecting authorized remote administration sessions in a network monitoring system

This disclosure describes techniques and mechanisms for improving blocking and alerting with domain fronting intelligence. The techniques may identify Internet infrastructure that supports domain fronting through passive data collection and active scanning of the data. The results of the active scanning are then used to generate enhanced threat intelligence feeds that associate indicators of compromise with their support of domain fronting. The new feeds are then used to perform more aggressive blocking, raise weak alerts that can be correlated to other alerts, and to create a more secure DNS system by de-prioritizing infrastructure that supports domain fronting for DNS responses.

Blocking and alerting with domain fronting intelligence

In one embodiment, a device in a network receives a set of known user identifiers used in the network. The device receives web traffic log data regarding web traffic in the network. The web traffic log data includes header information captured from the web traffic and a plurality of client addresses associated with the web traffic. The device detects a particular one of the set of known user identifiers in the header information captured from the web traffic associated with a particular one of the plurality of client addresses. The device makes an association between the particular detected user identifier and the particular client address.

Associating a user identifier detected from web traffic with a client address

According to certain embodiments, a method comprises performing a posture assessment at a trust anchor in order to determine whether a hardware component is authorized to run on a product. Performing the posture assessment comprises determining a random value (K), encrypting the random value (K) using a long-term key associated with the hardware component in order to yield an encrypted value, communicating the encrypted value to the hardware component, and receiving, from the hardware component, a message encrypted using the random value (K). The message comprises an identifier associated with the hardware component. Performing the posture assessment further comprises determining whether the hardware component is authorized to run on the product based at least in part on the identifier associated with the hardware component. The method further comprises performing an action that depends on whether the hardware component is authorized to run on the product.

Using a trust anchor to verify an identity of an ASIC

In one embodiment, a device in a network receives an attack mitigation request regarding traffic in the network. The device causes an assessment of the traffic, in response to the attack mitigation request. The device determines that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic. The device causes an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.

Automatic retraining of machine learning models to detect DDoS attacks

Techniques and mechanisms for identifying unmanaged cloud resources with endpoint and network logs and attributing the identified cloud resources to an entity of an enterprise that owns the cloud resources. The process collects data from sources, e.g., endpoint and network logs, with respect to traffic in a computer network and based at least in part on the data, extracts relationships related to the traffic. The process applies rules to the relationships to extract destinations in the computer network that provide cloud resources in a cloud environment, wherein the cloud resources are owned by an enterprise. One or more users or business entities of the enterprise are identified as accessing the cloud resources.

Identifying unmanaged cloud resources with endpoint and network logs

In one embodiment, a device obtains one or more packets of a traffic session in a network. The device determines, for a particular packet of the one or more packets that match a filter, a fingerprint for the particular packet. The device identifies a plurality of traffic sessions whose packets match the fingerprint, wherein each of the plurality of traffic sessions is associated with at least one process. The device updates a process with the traffic session by applying a classifier to the plurality of traffic sessions.

Multi-protocol / multi-session process identification

In one embodiment, a service that monitors a network obtains file characteristic data of a file stored on a first endpoint in the network. The service infers characteristics of encrypted content within encrypted traffic in the network between the first endpoint and a second endpoint, by applying a machine learning-based classifier to traffic data regarding the encrypted traffic session. The service compares the file characteristic data of the file to the inferred content characteristics of the encrypted content within the encrypted traffic, to detect the file within the encrypted traffic. The service enforces a network policy in the network, based on the detection of the file within the encrypted traffic.

Detecting targeted data exfiltration in encrypted traffic

In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session.

Endpoint-assisted inspection of encrypted network traffic

According to certain embodiments, a method performed by a trust anchor comprises determining a random value (K), encrypting the random value (K) using a long-term key associated with a hardware component in order to yield an encrypted value, communicating the encrypted value to the hardware component, and receiving a response encrypted using the random value (K). The response is received from the hardware component. The method further comprise encrypting a schema using the random value (K) and sending the encrypted schema to the hardware component. The schema indicates functionality that the hardware component is authorized to enable.

Using a trust anchor to control functionality of an ASIC

In one embodiment, a telemetry exporter in a network establishes a tunnel between the telemetry exporter and a traffic analysis service. The telemetry exporter obtains packet copies of a plurality of packets sent between devices via the network. The telemetry exporter forms a set of traffic telemetry data by discarding at least a portion of one or more of the packet copies, based on a filter policy. The telemetry exporter applies compression to the formed set of traffic telemetry data. The telemetry exporter sends, via the tunnel, the compressed set of traffic telemetry data to the traffic analysis service for analysis.

Network telemetry collection with packet metadata filtering

In one embodiment, a device in a network detects an encrypted traffic flow associated with a client in the network. The device captures contextual traffic data regarding the encrypted traffic flow from one or more unencrypted packets associated with the client. The device performs a classification of the encrypted traffic flow by using the contextual traffic data as input to a machine learning-based classifier. The device generates an alert based on the classification of the encrypted traffic flow.

Analyzing encrypted traffic behavior using contextual traffic data

Techniques and mechanisms for using passively collected network data to automatically generate a fingerprint prevalence database without the need for endpoint ground truth. The process first clusters all observations with the same fingerprint string and similar source and destination context. The process then annotates each cluster with descriptive information and uses a rule-based system to derive an informative name from that descriptive information, e.g., 'winnt amp client' or “cross-platform browser”. Optionally, the learned database may be augmented by a user to clarify custom process labels. Additionally, the generated database may be used to report the inferred processes in the same way as databases generated with endpoint ground truth.

Automatically generating a fingerprint prevalence database without ground truth

According to an embodiment, a method receives one or more messages associated with connecting a client and a first host. At least one of the messages comprises an encrypted portion indicating the first host and at least one of the messages comprises a cleartext portion indicating a second host. The method determines first and second sets of links associated with the first and second host, respectively. The first set is determined based on monitoring a result of connecting the client and the first host. The second set is determined based on observing behavior associated with connecting to the second host. The method detects domain fronting in response to determining, based on comparing the first set of links and the second set of links, that the first host differs from the second host.

Detecting domain fronting through correlated connections

Growing community of inventors

Los Gatos, CA, United States of America

David A McGrew