Netskope, Inc.

Juniper Networks, Inc.

Krishna Narayanaswamy

Ravi Ithal

Siying Yang

Lebin Cheng

Steve Malmskog

Abhay Kulkarni

David Tze-Si Wu

Yi Zhang

Chetan Anand

Sanjay Beri

Arjun Sambamoorthy

Bryan Burns

Ravindra K Balupari

Sean Hittel

Xiaolin Wang

Rajneesh Chopra

Qingming Ma

Ying Zhang

Ariel Faigon

Kartik Kumar Chatnalli Deshpande Sridhar

Jeevan Tambuluri

Jean-Marc Frailong

Xinhua Hong

Anjan Venkatramani

Prashanth Arun

Ajay Agrawal

Sunil Ravi

VenkataSwamy Pathapati

Hongbin Wang

Roger Allen Chickering

Jesse C Shu

Prasenna Ravi

Srinivasan Jagannadhan

Yihua Liao

Kannan Varadhan

Dong Guo

Alexander S Waterman

Michael E Knappe

Michael Luo

Shankaran Gnanashanmugam

Sudha Iyer

Rajiv Ranjan

Mahesh Gupta

Karan Mendiratta

Khurram Saqlain

Kenil Patel

Shaila Vasudev

Joe Tomasello

Nitin Kumar

Paul James Kirner

Nischal Sheth

Li Fei Zheng

Jerome Pascal Moisand

Raghavendra Mallya

Piyush V Patel

Dongyi Jiang

Steven A Malmskog

Subramanian Iyer

Venkata Rama Raju Manthena

Colby Barth

Xianzhi Li

Tsai-Zong Lin

Bhasker R Allam

Jiaxiang Su

Muhammed Shafeek

Rakesh Nair

Siming Wu

Sridhar B Venkatagowda

Vishwanath U Shenoy

Oleg Murat Smolsky

Michael Chuong Shieh

Vipin Rawat

Oren Melamud

Henry Han

Panning Huang

Xuefei Zhang

The disclosed technology teaches a method of operating an inspection proxy for encrypted sessions between users in an organization serviced by the inspection proxy and cloud-based services accessed by the users. The method comprises providing the inspection proxy comprising an intermediate certificate authority that holds a certificate authority (CA) certificate that browsers, operated by the users in the organization, recognize to be authorized to sign end-entity certificates, by virtue of being chained to a root certificate recognized by the browsers.

Using proxy certificates for operating securely between users' customers and cloud apps

The technology disclosed relates to reducing error in security enforcement by a network security system (abbreviated NSS). The NSS classifies incoming connection access requests as loss prevention inspectable or connection preserving by determining their conformance or non-conformance with semantic and content requirements of HTTP and HTTPs protocols. The NSS forwards the loss prevention inspectable connection access requests to a data inspection and loss prevention appliance (abbreviated DILPA) for deep inspection. The NSS directly sends the connection preserving connection access requests to the destination servers, preventing connection termination and error generation.

Selective deep inspection in security enforcement by a network security system (NSS)

The technology disclosed relates to configuring IoT devices for policy enforcement. In particular, the technology disclosed relates to configuring a plurality of special-purpose devices on a network segment of a network to steer outbound network traffic to an inline secure forwarder on the network segment instead of a default gateway on the network segment. The inline secure forwarder is configured to route the outbound network traffic to a policy enforcement point for a policy enforcement.

Configuring IoT devices for policy enforcement

The technology disclosed describes a network security system (NSS) for managing cloud security posture. The NSS uses synthetic request injection to determine a security posture of a resource hosted on a cloud application for policy enforcement. The NSS receives an incoming request from a client directed toward a resource hosted on a cloud application during an application session. The NSS holds the incoming request, generates the synthetic request, and transmits the synthetic request to the cloud application. The synthetic request is designed to retrieve information specifying the security posture of the resource from the cloud application using the resource identifier. The NSS receives a response to the synthetic request from the cloud application that supplies the information specifying the security posture of the resource. The NSS applies a policy on the incoming request based on the security posture information.

Synthetic request injection for real-time cloud security posture management

The technology disclosed relates to an introspector that scans an organization's accounts on cloud storage services and detects resources on the cloud storage services configured to store the organization's data, and identifies the detected resources in a resource list. The technology disclosed further includes an inline proxy that controls manipulation of the detected resources based on the resource list.

Data loss prevention (DLP) for cloud resources via metadata analysis

Disclosed is a method of building a customized deep learning (DL) stack classifier to detect organization sensitive data in images, referred to as image-borne organization sensitive documents, and protecting against loss of the image-borne organization sensitive documents, including distributing a trained feature map extractor stack, with stored parameters, configured to allow the organization to extract from image-borne organization sensitive documents, feature maps that are used to generate updated DL stacks and to save non invertible feature maps derived from the images, and ground truth labels for the image. Also included is receiving organization-specific examples including the non-invertible feature maps extracted from the organization-sensitive documents and the ground truth labels and using the received organization-specific examples to update a customer-specific DL stack classifier. Further included is sending the customer-specific DL stack classifier to the organization.

Detecting organization sensitive data in images via customized deep learning classifier

The technology disclosed relates to method and system of monitoring and controlling exfiltration of enterprise data stored on the cloud computing service (CCS). The method and system includes using a cross-application monitor to detect a could service application programming interface (API) in use and a function or activity being performed via the CCS API. The method and system determines the function or activity by parsing a data stream based on the CCS API and identifies a content of the enterprise data subject to content control by the application of a content inspection rule data subject to content control. The method and system selects a security action being applied to the enterprise data to prevent exfiltration based on the classification of the inspected data and policies applicable to the content subject to content control.

Method and system of monitoring and controlling exfiltration of enterprise data on cloud

Disclosed is a training data generation system for generating training data used to train machine learning models to inspect GenAI traffic to identify security and privacy concerns related to GenAI use. The training data generation system is seeded with initial prompts. The initial prompts include benign prompts, prompt injection attacks, and uploaded files. Each initial prompt is submitted to multiple GenAI applications to obtain responses. The corresponding prompts and responses are stored in a training data repository. Variations of the initial prompts are generated using, for example, one of the GenAI applications. Each variation is submitted to each of the GenAI applications as well, and the corresponding prompts and responses are stored. Another machine learning model, regex patterns, a combination, or the like may be used to label the prompts and responses in the training data repository to generate a large training data set quickly and efficiently.

Efficient training data generation for training machine learning models for security and privacy inspection of bidirectional generative artificial intelligence traffic

Disclosed is a cloud-based security system implemented in a reverse proxy that provides bidirectional traffic inspection to protect against privacy and security concerns related to the GenAI services. The security system intercepts requests directed to the GenAI service protected by the reverse proxy implementation of the network security system. The security system includes a GenAI request classifier trained to classify prompts submitted to the GenAI application as one of benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses from the GenAI application as one of normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies on both the requests and responses that block the traffic, trigger alerts to administrators, and the like to enforce security and privacy protection on bidirectional traffic.

Security and privacy inspection of bidirectional generative artificial intelligence traffic using a reverse proxy

The technology disclosed relates to detecting a ransomware attack on a cloud-based file storage system. The detecting includes collecting metadata on files at they are manipulated, storing the collected metadata as historical metadata, detecting multiple artifacts of the ransomware attack resulting from ransomware manipulation of the files by (i) comparing at least one of the extension, the magic number and the size included in the historical metadata to at least one of the extension, the magic number and the size included in current metadata of the files to identify a volume of changes in the files, and (ii) detecting that the identified volume of changes exceeds a change volume to determine that the ransomware attack is in progress, and identifying a user/machine that manipulated the files and responding to the determination that the ransomware attack is in progress by restricting further manipulation of other files by the identified user/machine.

Systems and methods of detecting and responding to ransomware on a cloud-based file storage system by identifying a volume of changes in the files stored on the cloud-based file storage system

Disclosed is a cloud-based security system implemented using API notifications provided by a GenAI service or application. The security system provides bidirectional traffic inspection to protect against privacy and security concerns related to the GenAI services. The security system receives notifications of traffic including requests directed to the GenAI service from endpoints as well as the GenAI responses. The security system includes a GenAI request classifier trained to classify prompts as benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses as normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies based on both the requests and responses that may include triggering alerts to administrators, deleting data stored by the GenAI service, and the like.

Security and privacy inspection of bidirectional generative artificial intelligence traffic using API notifications

Disclosed is a cloud-based security system implemented in a forward proxy that provides generative artificial intelligence (GenAI) traffic inspection to protect against security and privacy concerns related to GenAI use for protected endpoints. The security system intercepts requests and determines whether those requests are directed to a GenAI application. The security system includes a GenAI request classifier trained to classify prompts submitted to GenAI applications as one of benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses from GenAI applications as one of normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies on both the requests and responses that block the traffic, trigger alerts to administrators, and the like to enforce security and privacy protection on bidirectional traffic.

Security and privacy inspection of bidirectional generative artificial intelligence traffic using a forward proxy

The technology disclosed relates to detecting a data attack on a file system stored on an independent data store. The detecting includes scanning a list to identify files of the independent data store that have been updated within a timeframe, assembling current metadata for files identified by the scanning, obtaining historical metadata of the files, determining that a malicious activity is in process by analyzing the current metadata of the files and the historical metadata to identify a pattern of changes that exceeds a predetermined change velocity. Further, the detecting includes determining that the malicious activity is in process by analyzing the current metadata of the files and known patterns of malicious metadata to identify a match between the current metadata and the known patterns of malicious metadata, determining a machine/user that initiated the malicious activity, and implementing a response mechanism that restricts file modifications by the determined machine/user.

Systems and methods of detecting and responding to a ransomware attack impacting a cloud-based file storage service

A cloud-based network security system that includes a packet tap and exposes a synthetic packet stream representing the bidirectional data between enterprise client devices and cloud hosted services is disclosed. The security system intercepts packets of communication sessions and uploads a copy of the packets to cloud storage. A proxy of the security system derives session keys for the communication session and uploads the session keys to the cloud storage. An enterprise stitcher obtains the packets from the cloud storage, stitches the packets together in sequential order, and modifies the Layer 3 and Layer 4 headers to generate synthetic packet streams representing the communication sessions. The stitcher may decrypt the packets or provide the session key with the synthetic packet stream. The stitcher provides the synthetic packet streams to enterprise packet analysis systems for storage, auditing, analysis, and the like.

Cloud packet tap

The technology relates to machine responses to anomalies detected using machine learning based anomaly detection. In particular, to receiving evaluations of production events, prepared using activity models constructed on per-tenant and per-user basis using an online streaming machine learner that transforms an unsupervised learning problem into a supervised learning problem by fixing a target label and learning a regressor without a constant or intercept. Further, to responding to detected anomalies in near real-time streams of security-related events of tenants, the anomalies detected by transforming the events in categorized features and requiring a loss function analyzer to correlate, essentially through an origin, the categorized features with a target feature artificially labeled as a constant. An anomaly score received for a production event is determined based on calculated likelihood coefficients of categorized feature-value pairs and a prevalencist probability value of the production event comprising the coded features-value pairs.

Machine learning based anomaly detection initialization

Growing community of inventors

Saratoga, CA, United States of America

Krishna Narayanaswamy