Cisco Technology, Inc.

David Mcgrew

Daniel George Wing

Brian Eliot Weis

Blake Harrell Anderson

Flemming Andreasen

Vincent E Parla

Tomas Pevny

Martin Grill

Martin Kopp

Martin Rehak

Jan Kohout

Subharthi Paul

Jan Jusko

Ivan Nikolaev

Keith Richard Schomburg

Martin Vejman

Sunil Amin

Todd Short

Andrzej Kielbasinski

William Michael Hudson, Jr

Scott William Dunlop

Robert M Waitman

Philip Ryan Perricone

Chris Allen Shenefiel

Anderson Blake

Paul Subharthi

In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application.

Malware classification and attribution through server fingerprinting using server certificate data

In one embodiment, a service receives traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network. The service analyzes the traffic telemetry data to infer characteristics of an application on the endpoint device that generated the encrypted traffic. The service receives, from a monitoring agent on the endpoint device, application telemetry data regarding the application. The service determines that the application is evasive malware based on the characteristics of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device. The service initiates performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.

Correlating endpoint and network views to identify evasive applications

In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session.

Endpoint-assisted inspection of encrypted network traffic

Growing community of inventors

Poolesville, MD, United States of America

David Mcgrew