Cisco Technology, Inc.

Hewlett Packard Enterprise Development LP

Jisheng Wang

Sharad Ahlawat

Cetin Seren

Yingqi Xu

Vijaya Sarathy Kasi

Min-Yi Shen

Daniel A Quinlan

Prasad Palkar

Madhusudana Shashanka

Sriram Ramachandran

Lee Jones

Chao Yang

Entity group behavior profiling. An entity group is created that includes multiple entities, where each entity represents one of a user, a machine, and a service. A behavior profile is created for each one of the entities of the entity group. The behavior of each of one of the entities of the entity group is monitored to detect behavior change. An indicator of compromise is detected based on multiple ones of the entities experiencing substantially a same behavior change.

Entity group behavior profiling

A security appliance with one or more processors and a memory communicatively coupled to the one or more processors is described. The memory includes behavior profiling service logic that, when executed by the one or more processors, (i) creates a behavior profile for a particular entity based on received incoming data, and (ii) determines whether the behavior profile identifies that a malicious attack is being performed by the particular entity based on a comparison of the behavior profile to a reference profile. The reference profile represents historical behavior of the particular entity that is monitored over a prescribed period of time.

System and method directed to behavioral profiling services

Collaborative and adaptive threat intelligence. Data collected on a first customer network is received. One or more local models are trained with at least the received data, where the one or more local models are related to security. An amount of data to transmit to a centralized controller is determined based at least on a result of the training one or more local models and the determined amount of data is transmitted to the centralized controller. Result data is received from the centralized controller that is a result of one or more global models trained on the centralized controller using data collected on multiple customer networks including the first customer network. The one or more local models are adjusted using the received result data and the one or more adjusted local models are trained.

Collaborative and adaptive threat intelligence for computer security

Systems, methods, and other embodiments associated with data stream classification are described. One example method includes identifying packets associated with the data stream. The example method may also include updating a set of characterization data associated with the data stream based on information associated with a packet. The example method may also include assigning a data stream classifier to the data stream by comparing characterization data to identification data upon determining that the set of characterization data indicates that the data stream is able to be classified. The example method may also include providing a signal associated with the data stream classifier.

Data stream classification

Systems and methods are provided that enable probabilistic application of data traffic scanning in an effort to catch malicious software or code being carried by the data traffic. The methodology and systems operate by monitoring data traffic in an data network via an interface with the data network, calculating a first conditional probability that content in first given data traffic being monitored is malicious, calculating a second conditional probability that content in second given data traffic being monitored is malicious, ranking the first and second conditional probabilities resulting in ranked conditional probabilities, and performing at least one of anti-virus (AV) or anti-malware (AM) scanning of the content of the first or second given data traffic depending on whose conditional probability is ranked higher in the ranked conditional probabilities.

Growing community of inventors

San Mateo, CA, United States of America

Jisheng Wang