Juniper Networks, Inc.

Mu Dynamics, Inc.

Spirent Communications, Inc.

Kowsik Guruswamy

Nir Zuk

Yu Ming Mao

Sundar Vasan

Siu-Wang Leung

Marshall Allen Beddoe

Yuri Khodosh

Dmitrijs F Sapovalovs

James Maze

Siyang Yang

Yuming Mao

David Helder

Joshua Nisenson

Nick Baggott

Adam Bozanich

Ajit Sancheti

Ming Mao Yu

A discovery system (and corresponding method and computer program product) for automatically discovering assets and their roles and functional relationships in a network system is described. In one aspect, the discovery system interrogates known assets through protocol messages, normalizes response messages, and contextually analyzes the normalized response message to identify additional assets and their roles and functional relationships with the interrogated assets. The discovery system can recursively interrogate newly discovered assets to discover additional assets. In another aspect of the present invention, the discovery system is scheduled to periodically interrogate known assets for up-to-date information of the assets and their roles and functional relationships. Such information can be used to provide various services.

System and method for discovering assets and functional relationships in a network

Systems and methods for detecting and preventing network security breaches are described. The systems and methods present a gateway-based packet-forwarding network security solution to not only detect security breaches but also prevent them by directly dropping suspicious packets and connections. The systems and methods employ multiple techniques to detect and prevent network security breaches, including stateful signature detection, traffic signature detection, and protocol anomaly detection.

Multi-method gateway-based network security systems and methods

Methods and apparatuses for inspecting packets are provided. A primary security system may be configured for processing packets. The primary security system may be operable to maintain flow information for a group of devices to facilitate processing of the packets. A secondary security system may be designated for processing packets upon a failover event. Flow records may be shared from the primary security system with the secondary security system.

Intelligent integrated network security device for high-availability applications

Various example embodiments are directed to computer-implemented systems and methods for generating tests. A computer system may execute an application host and a browser. Messages originating from the application host and messages directed to the application host may be routed through the browser. The browser may be programmed to capture a plurality of application-level messages, which may comprise a plurality of requests originating from an application host and a plurality of responses directed to the application host. The computer system may generate a test scenario based on the plurality of application-level messages.

Generating test scenarios from application-layer messages

A security analyzer tests the security of a device by attacking the device and observing the device's response. Attacking the device includes sending one or more messages to the device. A message can be generated by the security analyzer or generated independently of the security analyzer. The security analyzer uses various methods to identify a particular attack that causes a device to fail or otherwise alter its behavior. Monitoring includes analyzing data (other than messages) output from the device in response to an attack. Packet processing analysis includes analyzing one or more messages generated by the device in response to an attack. Instrumentation includes establishing a baseline snapshot of the device's state when it is operating normally and then attacking the device in multiple ways while obtaining snapshots periodically during the attacks.

Platform for analyzing the security of communication protocols and channels

Various embodiments are directed to testing a pass-through device under test. For example, a computer system may receive a scenario describing a model of a message exchange involving the device under test, which specifies, for at least one message a source address location, a destination address location, and an identifier location. The computer system may also execute a plurality of instances of the scenario. Executing each instance may comprise generating a first outgoing message based on the model of the message exchange; and transmitting the first outgoing message to the device under test. Additionally, the computer system may receive and apply a filter to the first forwarded message from the device under test. Applying the filter may extract a second message exchange identifier value from the identifier location of the first forwarded message. Using the second message exchange identifier, the first forwarded message may be matched to at least one outgoing message.

Pass-through testing using message exchange identifiers

A system is used to analyze the implementation of a protocol by a device-under-analysis (DUA). The system includes a source endpoint, a destination endpoint (the DUA), and a message generator. The source endpoint generates an original message and attempts to send it to the DUA. The original message is intercepted by the message generator, which generates a replacement message. The replacement message is then sent to the DUA instead of the original message. The replacement message is deliberately improper so as to analyze the DUA's implementation of the protocol. The message generator includes a structure recognition system and a mutation system. The structure recognition system determines the underlying structure and/or semantics of a message. After the structure recognition system has determined the structure, it creates a description of the structure (a structure description). The mutation system modifies the message based on the structure description to generate a replacement message.

Modification of messages for analyzing the security of communication protocols and channels

A security analyzer includes a single software application that both sends test messages to a device under analysis (DUA) and receives response messages generated by the DUA in response to the test messages. In this way, synchronization of which response messages correspond to which test messages can be reduced or avoided. The software application further determines whether the DUA operated correctly by analyzing the received response messages.

Analyzing the security of communication protocols and channels for a pass through device

A packet capture is received from actual network traffic, the traffic including a multiple protocol message exchange. A scenario may be generated based on an analysis of the received packet capture, the scenario modeling the multiple protocol message exchange. The scenario is used to generate tests, for example protocol mutation tests.

Generating communication protocol test cases based on network traffic

Various example embodiments are directed to scale testing based on scenarios. A computer system may receive a scenario, which may comprise a plurality of scenario objects including, a first host, a second host, a plurality of transports, a plurality of variables and a plurality of steps. The computer system may also receive a pattern. The scenario may be processed to generate a processed scenario. The computer system may execute a first track including executing a plurality of concurrencies of the processed scenario according to the pattern.

Scenario based scale testing

A test system (and corresponding method and computer program product) for generating unit tests for a heterogeneous network system and validating test results to ensure that the network system functions properly is described. In one embodiment, the test system is an appliance that is capable of normalizing communication protocols supported by component systems of the network system. The test system creates objects and methods corresponding to component systems and their supported protocol commands in the network system, and generates unit test cases based on the objects, the methods, and the normalized protocols. The test system transmits the unit test cases to the component systems, receives test results, and validates the test results to ensure that the network system functions properly.

Test driven deployment and monitoring of heterogeneous network systems

A security analyzer is capable of generating attacks to test the security of a device under analysis. The security analyzer further has the capability to generate a portable, executable program to generate specified attacks. In this way, others can recreate the attacks without requiring access to the security analyzer.

Growing community of inventors

Sunnyvale, CA, United States of America

Kowsik Guruswamy