Cisco Technology, Inc.

Xg Technology, Inc.

Hai Trong Vu

Navindra Yadav

Shih-Chun Chang

Jackson Ngoc Ki Pang

Abhishek Ranjan Singh

Shashidhar R Gandham

Anubhav Gupta

Varun Sagar Malhotra

Ashutosh Kulshreshtha

Khawar Deen

Rohit Chandra Prasad

Michael Standish Watts

Ali Parandehgheibi

Shashi Gandham

Omid Madani

Hoang Viet Nguyen

Sunil Gupta

Roberto Fernando Spadaro

Praneeth Vallem

Vimalkumar Jeyakumar

Supreeth Hosur Nagesh Rao

Ellen Christine Scheib

Bharathwaj Sankara Viswanathan

Fnu Rachita Agasthy

Duane Thomas Barlow

Supreeth Rao

Umamaheswaran Arumugam

Aiyesha Ma

Andy Sloane

Vimal Jeyakumar

Jothi Prakash Prabakaran

Duy Nguyen

Kai Chang

Prasannakumar Jobigenahally Malleshaiah

Tapan Shrikrishna Patwardhan

Ravi Prasad

Kai Zhu

Allen Chen

Darshan Shrinath Purandare

Amit Shukla

Sreekant Nair

Xin Yi Liu

Paul John Lesiak

Xuan Zou

Vaishali Palkar

Thanh Nhan Nguyen

Micheal Watts

Siddhardha Garige

Sunil Kumar Gupta

Systems, methods, and computer-readable media for updating configurations in sensors deployed in multi-layer virtualized environments. In some examples, a system can track information of sensors and collectors in the network. In response to determining that a specific collector becomes unavailable (e.g., the specific collector is down, offline or becomes unsupported), the system can determine affected sensors corresponding to the specific collector, determine a new collector among active collectors of the network for each of the affected sensors, and dynamically update configuration and settings of the affected sensors to maintain proper collector-to-sensor mappings and other settings on the affected sensors.

Auto update of sensor configuration

The disclosed technology relates to a network agent for reporting to a network policy system. A network agent includes an agent enforcer and an agent controller. The agent enforcer is configured to implementing network policies on the system, access data associated with the implementation of the network policies on the system, and transmit, via an interprocess communication, the data to the agent controller. The agent controller is configured to generate a report including the data and transmit the report to a network policy system.

Network agent for reporting to a network policy system

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

Unique ID generation for sensors

Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Technologies for managing compromised sensors in virtualized environments

Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Technologies for annotating process and user information for network flows

An application and network analytics platform can capture telemetry from servers and network devices operating within a network. The application and network analytics platform can determine an application dependency map (ADM) for an application executing in the network. Using the ADM, the application and network analytics platform can resolve flows into flowlets of various granularities, and determine baseline metrics for the flowlets. The baseline metrics can include transmission times, processing times, and/or data sizes for the flowlets. The application and network analytics platform can compare new flowlets against the baselines to assess availability, load, latency, and other performance metrics for the application. In some implementations, the application and network analytics platform can automate remediation of unavailability, load, latency, and other application performance issues.

Application performance monitoring and management platform with anomalous flowlet resolution

Systems, methods, and non-transitory computer-readable storage media are disclosed for detecting vulnerabilities in real-time during execution of a process or an application. In one example, a device may have one or more memories storing computer-readable instructions and one or more processors configured to execute the computer-readable instructions to obtain real-time process information associated with a process executing in an endpoint. The device can then determine package information for a package associated with the process based on the process information. The device can then identify at least one vulnerability associated with the package information using a database of vulnerabilities stored on a backend component of the network. The backend component may have a database of vulnerabilities for packages.

Systems and methods for detecting vulnerabilities in network processes during runtime

Growing community of inventors

San Jose, CA, United States of America

Hai Trong Vu