Nicira, Inc.

Mcafee, Inc.

Arista Networks, Inc.

Awake Security, Inc.

Keith Eric Amidon

Martin Casado

Teemu Koponen

Paul Ingram

Daniel J Wendlandt

Justin Pettit

Benjamin L Pfaff

Peter J Balland, Iii

W Andrew Lambeth

Fengmin Gong

Debabrata Dash

Jesse Ernest Gross, Iv

Srikant Vissamsetti

Parveen Jain

Ananth Raman

Ramesh M Gupta

Gary Golomb

Steve M Haeffele

Natasha Gude

Scott J Shenker

Pankaj Thakkar

Ethan J Jackson

Andy Zhou

Michael Callahan

Alexander Yip

Ronghua Zhang

Manuel Nedbal

Jeevan Madhu Kamisetty

Mehak Mahajan

David Pearson

Johannes Mayr

Paul Fazzone

Manasa Chalasani

Jeff Polakow

Matthew Park

Benjamin Levy Pfaff

Peter J Iii Balland

Jesse E Gross Iv

Jesse Gross Iv

Peter Balland

Benjamin Levry Pfaff

Temu Koponen

Peter J Balland Iii

Jesse Gross

Jesse E Iv Gross

Embodiments of the present disclosure include techniques for generating hybrid network activity records. A stream of packet data is received. A flow in the stream of packet data is identified. Deep packet inspection operations are performed on a first subset of packets in the flow to extract a first set of data. Flow stat operations are performed on a second subset of packets in the flow to extract a second set of data. Based on the first and second sets of data, a set of network activity records are generated.

Generating hybrid network activity records

System and method for detecting a likely threat from a malicious attack is disclosed. Communication between a user computer and a destination computer is monitored by a security appliance. Selective information from the communication is extracted. One or more weak signals of a threat is detected based on the selective information. One or more weak signals are evaluated for a likely threat based on a threshold value. A corrective action is initiated for the likely threat, based on the evaluation.

System and method for detecting a malicious activity in a computing environment

An automated framework provides security monitoring and analysis in a network by autonomously detecting actual and potential threats to the network. In response to detection of a threat, the framework instantiates a Situation to provide directed monitoring of the threat. The Situation invokes specific skills based on the state of the Situation to monitor network traffic for activity specific to the threat that instantiated the Situation. As data is collected, additional skills may be invoked based on the additional data to collect new data, and previously invoked skills may be terminated depending on the additional data to avoid collecting information that is no-longer relevant.

Threat representation and automated tracking and analysis

Systems and methods for managing a network are described. A view of current state of the network is maintained where the current state of the network characterizes network topology and network constituents, including network entities and network elements residing in or on the network. Events are announced that correspond to changes in the state of the network and one or more network elements can be configured accordingly. Methods for managing network traffic are described that ensure forwarding and other actions taken by network elements implement globally declared network policy and refer to high-level names, independently of network topology and the location of network constituents. Methods for discovering network constituents are described, whereby are automatically configured. Routing may be performed using ACL and packets can be intercepted to permit host to continue in sleep mode. The methods are applicable to virtual environments.

Network operating system for managing and securing networks

Some embodiments provide a method that processes network data through a network. The method receives a packet destined for a network host associated with a logical datapath set implemented by a set of managed edge switching elements and a set of managed non-edge switching elements in the network. The method determines whether the packet is a known packet. When the packet is a known packet, the method forwards the packet to a managed switching element in the set of managed edge switching elements for forwarding to the network host. When the packet is not a known packet, the method forwards the packet to a managed switching element in the set of managed non-edge switching elements for further processing.

Packet processing for logical datapath sets

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g, GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

Method and apparatus for implementing and managing virtual switches

In general, the present invention relates to a virtual platform in which one or more distributed virtual switches can be created for use in virtual networking. According to some aspects, the distributed virtual switch according to the invention provides the ability for virtual and physical machines to more readily, securely, and efficiently communicate with each other even if they are not located on the same physical host and/or in the same subnet or VLAN. According other aspects, the distributed virtual switches of the invention can support integration with traditional IP networks and support sophisticated IP technologies including NAT functionality, stateful firewalling, and notifying the IP network of workload migration. According to further aspects, the virtual platform of the invention creates one or more distributed virtual switches which may be allocated to a tenant, application, or other entity requiring isolation and/or independent configuration state. According to still further aspects, the virtual platform of the invention manages and/or uses VLAN or tunnels (e.g., GRE) to create a distributed virtual switch for a network while working with existing switches and routers in the network. The present invention finds utility in both enterprise networks, datacenters and other facilities.

Some embodiments provide a method for reducing the transmission of connection validating control signals when they are not needed. Network entities transmit connection validating control signals over network connections at regular intervals to validate that the network connections and the network entities remain functional. The method monitors data traffic fluctuations on the network connections to determine when connection validating control signals may not be needed. The method reduces unnecessary connection validating control signals in order to optimize the usage of network resources.

Adjusting connection validating control signals in response to changes in network traffic

System and method for detecting a likely threat from a malicious attack is disclosed. Communication between a user computer and a destination computer is monitored by a security appliance. Selective information from the communication is extracted. Selective information is associated to one or more attributes of a security entity. A knowledge graph is generated for a plurality of security entities based on the associated selective information.

System and method for evaluating communication between a plurality of computing devices is disclosed. A plurality of communication between a user computer and at least one a destination computer is monitored by a security appliance. Selective information from the plurality of communication is extracted by the security appliance. Extracted selective information between a pair of communication is compared for a match. An activity record is generated for the user computer and at least one destination computer, based on the match.

Some embodiments provide a system that includes a set of network controllers for receiving definitions of first and second logical switching elements. The system includes several managed switching elements. The set of network controllers configure the several managed switching elements to implement the defined first and second logical switching elements. The system includes several network hosts that are each (1) communicatively coupled to one of the several managed switching elements and (2) associated with one of the first and second logical switching elements. Network data communicated between network hosts associated with the first logical switching element are isolated from network data communicated between network hosts associated with the second logical switching element.

Mesh architectures for managed switching elements

Growing community of inventors

Los Altos, CA, United States of America

Keith Eric Amidon