Juniper Networks, Inc.

Amazon Technologies, Inc.

Riverbed Technology, Inc.

Juniper Neworks, Inc.

Declan Conlon

Kyle Adams

Daniel J Quinlan

Jacob Asher Langton

Thomas A Volpe

Raymond Scott Whiteside

Euan David Harris

A device may identify a plurality of files for a multi-file malware analysis. The device may execute the plurality of files in a malware testing environment. The device may monitor the malware testing environment for behavior indicative of malware. The device may detect the behavior indicative of malware. The device may perform a first multi-file malware analysis or a second multi-file malware analysis based on detecting the behavior indicative of malware. The first multi-file malware analysis may include a partitioning technique that partitions the plurality of files into two or more segments of files to identify a file, included in the plurality of files, that includes malware. The second multi-file malware analysis may include a scoring technique that modifies a plurality of malware scores, corresponding to the plurality of files, to identify the file, included in the plurality of files, that includes malware.

Multi-file malware analysis

A device may receive a trigger to determine whether a malicious file is operating on a client device. The device may determine a network activity profile associated with the malicious file based on receiving the trigger to determine whether the malicious file is operating on the client device. The network activity profile may include information regarding network activity associated with the malicious file when the malicious file is executed in a testing environment. The device may monitor network activity associated with the client device. The device may determine that the network activity associated with the client device matches the network activity profile associated with the malicious file based on monitoring the network activity associated with the client device. The device may provide information indicating that the network activity associated with the client device matches the network activity profile associated with the malicious file.

Detecting a malicious file infection via sandboxing

A device may receive or generate a message for routing to a destination on a communication channel. The communication channel may have been established between a source and the destination. The device may perform a first determination of policy information related to at least one of the message, the destination, or the source of the message. The policy information may describe an action for a network device to perform. The device may associate a policy token with the message. The policy token may describe or identify the policy information. The device may provide the message with the associated policy token to the network device on the communication channel to cause the network device to perform a second determination of the policy information based on the policy token, to perform the action described by the policy information, and to provide the message on the communication channel.

Providing policy information on an existing communication channel

Provided are systems and methods for sampling packets based on large flow detection, for network visibility monitoring. In some implementations, provided is an integrated circuit. The integrated circuit may include large-flow detection logic and a sampling determination logic. The integrated circuit may be operable to received packet information describing a packet a cycle of a clock input. The packet may be associated with a packet flow being transmitted through a network. The integrated circuit may further be operable to determine, using the large-flow detection logic, whether the packet is associated with a large packet flow or a small packet flow. Upon determining that the packet is associated with a small packet flow, the integrated circuit may update the sampling determination logic.

Sampling based on large flow detection for network visibility monitoring

Provided are systems and methods for network visibility monitoring. In some implementation, provided is an integrated circuit. The integrated circuit may include a large-flow detection logic operable to determine whether a packet is associated with a large packet flow or a small packet flow, a large-flow caching logic operable to store information about packet flows, a sampling logic operable to sample packets, and a unique-flow estimation logic. The integrated circuit may be operable to receive packets from a network during a pre-determined interval, The integrated circuit may further determine an estimate of the number of unique flows represented by the packets, identify large packet flows by identifying packets associated with the large packet flows, store information about the large packet flows, determine packets associated with small packet flows, and sample the packets determined to be associated with the small packet flows to create packet samples.

Network visibility monitoring

Provided are systems and methods for large flow detection for network visibility monitoring. In some implementations, provided is an integrated circuit. The integrated circuit may be operable to receive packet information describing a packet at a cycle of a clock input. The packet may be associated with a packet flow being transmitted across a network. The integrated circuit may further generate a key using information identifying the packet flow provided by the packet information. The integrated circuit may further read a value for a counter from a counter memory using the key. The integrated circuit may determine whether the packet is associated with a large flow or a small flow using the counter and a packet size provided by the packet information. Upon determining that the packet is associated with a large flow, the integrated circuit may update an entry in a flow memory using the packet information.

Large flow detection for network visibility monitoring

A device may receive usage information, associated with a group of client networks, including particular usage information associated with a particular client network. The device may receive threat information, associated with the group of client networks, including particular threat information associated with the particular client network. The device may determine a baseline based on the usage information. The device may determine a normalization function, associated with the particular client network, based on the baseline and the particular usage information. The device may determine normalized threat information, associated with the particular client network, based on the normalization function and the particular threat information. The device may determine overall normalized threat information associated with the group of client networks. The device may compare the normalized threat information and the overall normalized threat information. The device may provide information associated with comparing the normalized threat information and the overall normalized threat information.

Targeted attack discovery

Apparatus for processing requests from a plurality of connected clients for data stored by a plurality of connected servers comprising a processor, memory, storage, a network interface, and a user input device is disclosed. The processor is configured to receive requests from the connected clients via the network interface, select a connected server to route each requests to, thereby defining a selected server per request, create a connection per request to its selected server using the network interface, route the requests to their selected servers using the connections, and monitor the connections while the selected servers service the requests, so as to create monitored connection data for each connection. The monitored connection data is stored in data structures that are referenced by a buffer, and upon creation of a data structure relating to the most recently created connection, reference to the oldest data structure in the buffer is removed.

Growing community of inventors

Sydney, Australia

Declan Conlon