Akamai Technologies, Inc.

Eyal Heiman

Eugene (“John”) Neystadt

Elisha Ben-Zvi

John Devasia

Asaf Nadler

Christopher Dewar

Eugene (John) Neystadt

Robert D Blumofe

Eugene Neystadt

This document describes among other things, network security systems that incorporate a feedback loop so as to automatically and dynamically adjust the scope of network traffic that is subject to inspection. Risky traffic can be sent for inspection; risky traffic that is demonstrated to have high rate of threats can be outright blocked without further inspection; traffic that is causing errors due to protocol incompatibility or should not be inspected for regulatory or other reasons can be flagged so it bypasses the security inspection system. The system can operate on a domain by domain basis, IP address basis, or otherwise.

Network security analysis system with reinforcement learning for selecting domains to scan

Network security system with enhanced traffic analysis based on feedback loop

Among other things, this document describes systems, methods and devices for providing a cloud proxy auto-config (PAC) function for clients connected to a private network, such as an enterprise network. The teachings hereof are of particular use with cloud hosted proxy services provided by server deployments outside of the private network (e.g., external to the enterprise or other organizational network). This document also describes systems, methods and devices for providing a proxy auto-config (PAC) function for clients connected to a third party network, such as when the client moves outside of the enterprise network.

Proxy auto-configuration for directing client traffic to a cloud proxy with cloud-based unique identifier assignment

It is known in the art to route client traffic to a network security gateway using the domain name system, or DNS. More specifically, a local DNS resolver on a private network may apply security intelligence to client DNS lookup requests, based on the domains that clients are seeking to resolve. If a requested domain represents a known security threat, the client can be blocked or directed to the network security gateway instead of to the desired host. This routing of the client request to the network security gateway can be accomplished by giving the client the IP address of the network security gateway instead of the actual IP address corresponding to the domain name, in response to a given DNS name query from the client. Request routing can be accomplished using other techniques, such as IP layer routing, as well.

Network security system with enhanced traffic analysis based on feedback loop and low-risk domain identification

Proxy auto-configuration for directing client traffic to a cloud proxy

Growing community of inventors

Tel Aviv, Israel

Eyal Heiman