Cisco Technology, Inc.

University of Florida Research Foundation Inc

Fabio Rodolfo Maino

Alberto Rodriguez Natal

Vina Ermagan

Victor Manuel Moreno

Claudio Desanti

Pere Monclus

Lorand Jakab

Saswat Praharaj

Alberto Rodriguez-Natal

Srinath Gundavelli

Samar Sharma

Sateesh Kumar Addepalli

Marco Di Benedetto

Sangram Kishore Lakkaraju

Lillian Lei Dai

Marc Portoles Comeras

Darrel Jay Lewis

Timothy Peter Stammers

Anubhav Gupta

Hendrikus G P Bosch

Flavio Giovanni Bonomi

Pradeep Kumar Kathail

Jeffrey Michael Napper

Chandan Mishra

John Mullooly

Steven W Wood

Lars Olaf Stefan Olofsson

Gregg Schudel

David A McGrew

Sanjay Kumar Hooda

Brian Eliot Weis

Dinesh Ganapathy Dutt

Dino Farinacci

Ramanathan Lakshmikanthan

Syed Khalid Raza

Preethi Natarajan

Anand K Oswal

Silvano Gai

Balaji Sundararajan

Paul M Quinn

Rong Pan

Xiaoqing Zhu

Satish Kumar Kondalam

Reshad Rahman

Michael Fine

John William Evans

Darren Russell Dukes

Sanjaya Kumar

Madhuri Kolli

Jesper Skriver

Edward Albert Warnicke

Ankur Jain

Yegappan Lakshmanan

Christian Cassar

Isidoros Kouvelas

John A Joyce

Thomas John Nosella

Bruce McDougall

Mikhail Davidov

Timothy James Swanson

Jeevan Sharma

Vijoy A Pandey

John George Apostolopoulos

Vivek Agarwal

Louis Gwyn Samuel

Abhijit Patra

Nagaraj Bagepalli

Dileep Kumar Devireddy

Robert T Bell

Ram Dular Singh

Sridhar Subramanian

Surendra M Kumar

Maurilio Cometto

Gilberto Loprieno

Raghuram S Sudhaakar

Atri Indiresan

Satyam Sinha

Raymond Kloth

Sachin Jain

Arthur Zavalkovsky

John Martin Graybeal

Ashok Krishnaji Moghe

Davide Bergamasco

Gaurav Rastogi

Sudarshana Kandachar Sridhara Rao

Arindam Paul

Rodolfo Alberto Milito

Suraj Nellikar

Anand Hariharan

Steven Joseph Rich

Wilson Kok

Mosaddaq Hussain Turabi

Horia Miclea

Dante Malagrino

Lev Shvarts

Landon Curt Noll

Chin-Ju Chen

Rajesh Bhandari

Jonathan M Parlan

In one embodiment, a method comprises training at least one model based at least in part on interactions between one or more users and electronic messages sent to addresses associated with the one or more users, receiving a first electronic message sent to a first address associated with a first user, analyzing the first electronic message to generate first feature data, determining one or more characteristics of the first user to generate second feature data, inputting, to the at least one model, the first feature data and the second feature data, and receiving, as output of the at least one model, data indicating whether to output, to the first user, a warning regarding the first electronic message.

Susceptibility-based warning techniques

Techniques for dynamic routing based on application load are described herein. The techniques may include receiving load information associated with resources of an application orchestration system that are allocated to host an application, the resources associated with different geographical regions. Based at least in part on the load information, a network controller may determine that first resources of the application orchestration system are less constrained than second resources of the application orchestration system, the first resources associated with a first geographical region and the second resources associated with a second geographical region. Based at least in part on the first resources being less constrained than the second resources, application traffic may be routed through the network to the application hosted by the first resources in the first geographical region.

Dynamic network routing based on application load

Systems, methods, and computer-readable media for locally applying endpoint-specific policies to an endpoint in a network environment. A network device local to one or more endpoints in a network environment can receive from a centralized network controller one or more network-wide endpoint policies. A first endpoint of the one or more endpoints can be configured to inject policy metadata into first data traffic. Policy metadata injected into the first traffic data can be received from the first endpoint. The network device can determine one or more first endpoint-specific polices for the first endpoint by evaluation the first policy metadata with respect to the one or more network-wide endpoint policies. As follows, the one or more first endpoint-specific policies can be applied to control data traffic associated with the first endpoint.

On-path dynamic policy enforcement and endpoint-aware policy enforcement for endpoints

Techniques for providing a standardized interface that is configured to provide application developers with ways for interacting with different wide area network controllers. A standardized interface may include an application programming interface (API) server that can receive a connectivity request associated with an application that is to be hosted on an application orchestration system. The API server may determine, based at least in part on the connectivity request, a vendor network to be used by the application to send traffic to a remote service. Based at least in part on determining the vendor network, the API server may translate the connectivity request into a first format that is understandable by a controller of the vendor network. The API server may also provide the connectivity request in the first format to the controller of the vendor network such that a path through the vendor network can be determined.

Standardized interface for wide area network programming

Techniques for enabling a network access provider to make automatic Software as a Service (SaaS) optimization decisions. Among other things, the techniques may include determining a SaaS application that is being accessed by client endpoints via flows through a network access provider. The techniques may also include determining, based at least in part on a policy associated with the network access provider, whether to enable network optimizations for traffic through the network access provider to the SaaS application. Based at least in part on a determination that the network optimizations are to be enabled for the traffic to the SaaS application, the techniques may include installing a service definition associated with the SaaS application in a service policy database of the network access provider.

Automatic SAAS optimization

Techniques for using proxies with overprovisioned IP addresses to demultiplex data flows, which may otherwise look the same at L7, into multiple subflows for L3 policy enforcement without having to modify an underlying L3 network. The techniques may include establishing a subflow through a network between a first proxy and a second proxy, the subflow associated with a specific policy. In some examples, the first proxy node may receive an encrypted packet that is to be sent through the network and determine, based at least in part on accessing an encrypted application layer of the packet, a specific application to which the packet is to be sent. The first proxy node may then alter an IP address included in the packet to cause the packet to be sent through the network via the subflow such that the packet is handled according to the specific policy.

Layer-3 policy enforcement for layer-7 data flows

Techniques for automating traffic optimizations for egress traffic of an application orchestration system that is being sent over a network to a remote service. In examples, the techniques may include receiving, at a controller of the network, an egress traffic definition associated with egress traffic of an application hosted on the application orchestration system, the egress traffic definition indicating that the egress traffic is to be sent to the remote service. Based at least in part on the egress traffic definition, the controller may determine a networking path through the network or outside of the network that is optimized for sending the egress traffic to the remote service. The controller may also cause the egress traffic to be sent to the remote service via the optimized networking path.

Egress traffic optimization

Techniques for steering overlay network traffic along specific paths through an underlay network. The techniques may include determining a path through an underlay network that is optimized for sending a packet from a first node of an overlay network to a second node of the overlay network. The techniques may also include determining a destination address for sending the packet along the path from the first node to the second node, the destination address including a micro segment identifier (uSID) corresponding with an underlay node that is disposed along the path through the underlay network and trailing bits representing a portion of an address that corresponds with the second node. The techniques may also include causing the packet to be modified to include the destination address such that the packet is sent from the first node to the second node along the path.

Underlay network traffic steering

Provided is an infrastructure for enforcing target service level parameters in a network. In one example, a network service level agreement (SLA) registry obtains one or more input service level parameters for at least one service offered by an application. Based on the one or more input service level parameters, the network SLA registry provides one or more target service level parameters to a plurality of network controllers. Each network controller of the plurality of network controllers is configured to enforce the one or more target service level parameters in a respective network domain configured to carry network traffic associated with the application.

Infrastructure for enforcing per-application target service level parameters in multi-domain networks

Techniques for obtaining application network metadata from a service registry so that a network routing policy may be derived for traffic associated with the application are described herein. The techniques may include receiving, at a service registry, network metadata associated with traffic of an application hosted by a scalable application service platform. The techniques may also include obtaining, by a controller of a network and from the service registry, the network metadata associated with the traffic of the application. Based at least in part on the network metadata, the controller may determine a routing policy that is optimized for sending the traffic through the network. Additionally, the controller may send an indication of the routing policy to a node of the network or otherwise provision the network such that the traffic of the application is sent through the network according to the routing policy.

Passing application network metadata to network controllers using service registries

Techniques for providing network traffic security in a virtualized environment are described. A threat aware controller uses a threat feed provided by a threat intelligence service to establish a threat detection engine on virtual switches. The threat aware controller and threat detection engine work together to detect any anomalous or malicious behavior of network traffic on the virtual switch and established virtual network functions to quickly detect, verify, and isolate network threats.

Virtual switch-based threat defense for networks with multiple virtual network functions

Techniques are described for extending a cellular quality of service bearer through an enterprise fabric network. In one example, a method obtaining, by a first switch of a network, a packet to be delivered to a client connected to the network via a cellular access point; identifying quality of service (QoS) bearer information associated with the packet, wherein the QoS bearer information is associated with a radio access bearer for the client and the QoS bearer information comprises a bearer indicator and a QoS class identifier; providing a fabric tunnel encapsulation for the packet, wherein the bearer indicator and the QoS class identifier are included within the fabric tunnel encapsulation of the packet; and forwarding the packet within the fabric tunnel encapsulation toward a second switch of the network via a fabric tunnel, wherein the cellular access point is connected to the network via the second switch.

Techniques for extending a cellular quality of service bearer through an enterprise fabric

Techniques for informing a network of an application's service-level agreement (SLA) objective(s) so the network can ensure the SLA is met end-to-end, thereby allowing core network support of deterministic SLA and application-based routing without using network-based application recognition (NBAR) and/or compromising user privacy. The techniques may include receiving a first connection request to establish a network-domain connection between different network domains that meets or exceeds a service level objective. Based on the first connection request, the network-domain connection may be established between the different network domains to meet or exceed the service-level objective. In some examples, a second connection request may be received to establish a tunnel between a source application and a destination application, which are disposed in the different network domains. Based on the second connection request, the techniques may include establishing the tunnel between the source application and the destination application utilizing the network-domain connection.

Core network support for application requested network service level objectives

Techniques for extending network elements to inspect, extract, and complement tracing information added to L7 flows by application distributed tracing systems. The techniques may include receiving a Layer-7 (L7) message of an L7 flow associated with a distributed application and determining that the L7 message includes tracing information. In some examples, the tracing information may be mapped to a marking that is to be included in a Layer 3 (L3) or Layer-4 (L4) packet carrying the L7 message, and the L3 or L4 packet including the marking may be sent to an L3 or L4 network element. In some examples, the L3 or L4 network element may be configured to utilize the marking to determine a network decision for the L3 or L4 packet.

Extending distributed application tracing for network optimizations

Growing community of inventors

Palo Alto, CA, United States of America

Fabio Rodolfo Maino