Netskope, Inc.

Juniper Networks, Inc.

Krishna Narayanaswamy

Ravi Ithal

Siying Yang

Lebin Cheng

Steve Malmskog

Abhay Kulkarni

Yi Zhang

Chetan Anand

Sanjay Beri

David Tze-Si Wu

Arjun Sambamoorthy

Bryan Burns

Ravindra K Balupari

Sean Hittel

Xiaolin Wang

Rajneesh Chopra

Qingming Ma

Ying Zhang

Ariel Faigon

Jeevan Tambuluri

Kartik Kumar Chatnalli Deshpande Sridhar

Jean-Marc Frailong

Xinhua Hong

Anjan Venkatramani

Prashanth Arun

Ajay Agrawal

Sunil Ravi

VenkataSwamy Pathapati

Hongbin Wang

Roger Allen Chickering

Jesse C Shu

Prasenna Ravi

Srinivasan Jagannadhan

Yihua Liao

Kannan Varadhan

Dong Guo

Alexander S Waterman

Michael E Knappe

Sudha Iyer

Rajiv Ranjan

Shankaran Gnanashanmugam

Michael Luo

Khurram Saqlain

Joe Tomasello

Shaila Vasudev

Kenil Patel

Karan Mendiratta

Mahesh Gupta

Nitin Kumar

Paul James Kirner

Nischal Sheth

Li Fei Zheng

Jerome Pascal Moisand

Raghavendra Mallya

Piyush V Patel

Dongyi Jiang

Steven A Malmskog

Subramanian Iyer

Venkata Rama Raju Manthena

Colby Barth

Xianzhi Li

Tsai-Zong Lin

Bhasker R Allam

Muhammed Shafeek

Jiaxiang Su

Rakesh Nair

Oleg Murat Smolsky

Vishwanath U Shenoy

Panning Huang

Michael Chuong Shieh

Vipin Rawat

Oren Melamud

Henry Han

Xuefei Zhang

The technology disclosed describes a network security system (NSS) for managing cloud security posture. The NSS uses synthetic request injection to determine a security posture of a resource hosted on a cloud application for policy enforcement. The NSS receives an incoming request from a client directed toward a resource hosted on a cloud application during an application session. The NSS holds the incoming request, generates the synthetic request, and transmits the synthetic request to the cloud application. The synthetic request is designed to retrieve information specifying the security posture of the resource from the cloud application using the resource identifier. The NSS receives a response to the synthetic request from the cloud application that supplies the information specifying the security posture of the resource. The NSS applies a policy on the incoming request based on the security posture information.

Synthetic request injection for real-time cloud security posture management

The technology disclosed relates to an introspector that scans an organization's accounts on cloud storage services and detects resources on the cloud storage services configured to store the organization's data, and identifies the detected resources in a resource list. The technology disclosed further includes an inline proxy that controls manipulation of the detected resources based on the resource list.

Data loss prevention (DLP) for cloud resources via metadata analysis

Disclosed is a method of building a customized deep learning (DL) stack classifier to detect organization sensitive data in images, referred to as image-borne organization sensitive documents, and protecting against loss of the image-borne organization sensitive documents, including distributing a trained feature map extractor stack, with stored parameters, configured to allow the organization to extract from image-borne organization sensitive documents, feature maps that are used to generate updated DL stacks and to save non invertible feature maps derived from the images, and ground truth labels for the image. Also included is receiving organization-specific examples including the non-invertible feature maps extracted from the organization-sensitive documents and the ground truth labels and using the received organization-specific examples to update a customer-specific DL stack classifier. Further included is sending the customer-specific DL stack classifier to the organization.

Detecting organization sensitive data in images via customized deep learning classifier

The technology disclosed relates to method and system of monitoring and controlling exfiltration of enterprise data stored on the cloud computing service (CCS). The method and system includes using a cross-application monitor to detect a could service application programming interface (API) in use and a function or activity being performed via the CCS API. The method and system determines the function or activity by parsing a data stream based on the CCS API and identifies a content of the enterprise data subject to content control by the application of a content inspection rule data subject to content control. The method and system selects a security action being applied to the enterprise data to prevent exfiltration based on the classification of the inspected data and policies applicable to the content subject to content control.

Method and system of monitoring and controlling exfiltration of enterprise data on cloud

Disclosed is a training data generation system for generating training data used to train machine learning models to inspect GenAI traffic to identify security and privacy concerns related to GenAI use. The training data generation system is seeded with initial prompts. The initial prompts include benign prompts, prompt injection attacks, and uploaded files. Each initial prompt is submitted to multiple GenAI applications to obtain responses. The corresponding prompts and responses are stored in a training data repository. Variations of the initial prompts are generated using, for example, one of the GenAI applications. Each variation is submitted to each of the GenAI applications as well, and the corresponding prompts and responses are stored. Another machine learning model, regex patterns, a combination, or the like may be used to label the prompts and responses in the training data repository to generate a large training data set quickly and efficiently.

Efficient training data generation for training machine learning models for security and privacy inspection of bidirectional generative artificial intelligence traffic

Disclosed is a cloud-based security system implemented in a reverse proxy that provides bidirectional traffic inspection to protect against privacy and security concerns related to the GenAI services. The security system intercepts requests directed to the GenAI service protected by the reverse proxy implementation of the network security system. The security system includes a GenAI request classifier trained to classify prompts submitted to the GenAI application as one of benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses from the GenAI application as one of normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies on both the requests and responses that block the traffic, trigger alerts to administrators, and the like to enforce security and privacy protection on bidirectional traffic.

Security and privacy inspection of bidirectional generative artificial intelligence traffic using a reverse proxy

The technology disclosed relates to detecting a ransomware attack on a cloud-based file storage system. The detecting includes collecting metadata on files at they are manipulated, storing the collected metadata as historical metadata, detecting multiple artifacts of the ransomware attack resulting from ransomware manipulation of the files by (i) comparing at least one of the extension, the magic number and the size included in the historical metadata to at least one of the extension, the magic number and the size included in current metadata of the files to identify a volume of changes in the files, and (ii) detecting that the identified volume of changes exceeds a change volume to determine that the ransomware attack is in progress, and identifying a user/machine that manipulated the files and responding to the determination that the ransomware attack is in progress by restricting further manipulation of other files by the identified user/machine.

Systems and methods of detecting and responding to ransomware on a cloud-based file storage system by identifying a volume of changes in the files stored on the cloud-based file storage system

Disclosed is a cloud-based security system implemented using API notifications provided by a GenAI service or application. The security system provides bidirectional traffic inspection to protect against privacy and security concerns related to the GenAI services. The security system receives notifications of traffic including requests directed to the GenAI service from endpoints as well as the GenAI responses. The security system includes a GenAI request classifier trained to classify prompts as benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses as normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies based on both the requests and responses that may include triggering alerts to administrators, deleting data stored by the GenAI service, and the like.

Security and privacy inspection of bidirectional generative artificial intelligence traffic using API notifications

Disclosed is a cloud-based security system implemented in a forward proxy that provides generative artificial intelligence (GenAI) traffic inspection to protect against security and privacy concerns related to GenAI use for protected endpoints. The security system intercepts requests and determines whether those requests are directed to a GenAI application. The security system includes a GenAI request classifier trained to classify prompts submitted to GenAI applications as one of benign, prompt injection attack, or uploaded files. The security system further includes a GenAI response classifier trained to classify responses from GenAI applications as one of normal, leaked system prompt, leaked user uploaded files, or leaked training data. Based on the classification, and optionally other security analysis, the security system may enforce security policies on both the requests and responses that block the traffic, trigger alerts to administrators, and the like to enforce security and privacy protection on bidirectional traffic.

Security and privacy inspection of bidirectional generative artificial intelligence traffic using a forward proxy

The technology disclosed relates to detecting a data attack on a file system stored on an independent data store. The detecting includes scanning a list to identify files of the independent data store that have been updated within a timeframe, assembling current metadata for files identified by the scanning, obtaining historical metadata of the files, determining that a malicious activity is in process by analyzing the current metadata of the files and the historical metadata to identify a pattern of changes that exceeds a predetermined change velocity. Further, the detecting includes determining that the malicious activity is in process by analyzing the current metadata of the files and known patterns of malicious metadata to identify a match between the current metadata and the known patterns of malicious metadata, determining a machine/user that initiated the malicious activity, and implementing a response mechanism that restricts file modifications by the determined machine/user.

Systems and methods of detecting and responding to a ransomware attack impacting a cloud-based file storage service

A cloud-based network security system that includes a packet tap and exposes a synthetic packet stream representing the bidirectional data between enterprise client devices and cloud hosted services is disclosed. The security system intercepts packets of communication sessions and uploads a copy of the packets to cloud storage. A proxy of the security system derives session keys for the communication session and uploads the session keys to the cloud storage. An enterprise stitcher obtains the packets from the cloud storage, stitches the packets together in sequential order, and modifies the Layer 3 and Layer 4 headers to generate synthetic packet streams representing the communication sessions. The stitcher may decrypt the packets or provide the session key with the synthetic packet stream. The stitcher provides the synthetic packet streams to enterprise packet analysis systems for storage, auditing, analysis, and the like.

Cloud packet tap

The technology relates to machine responses to anomalies detected using machine learning based anomaly detection. In particular, to receiving evaluations of production events, prepared using activity models constructed on per-tenant and per-user basis using an online streaming machine learner that transforms an unsupervised learning problem into a supervised learning problem by fixing a target label and learning a regressor without a constant or intercept. Further, to responding to detected anomalies in near real-time streams of security-related events of tenants, the anomalies detected by transforming the events in categorized features and requiring a loss function analyzer to correlate, essentially through an origin, the categorized features with a target feature artificially labeled as a constant. An anomaly score received for a production event is determined based on calculated likelihood coefficients of categorized feature-value pairs and a prevalencist probability value of the production event comprising the coded features-value pairs.

Machine learning based anomaly detection initialization

Disclosed are methods and systems for detecting screenshot images and protecting against loss of sensitive screenshot-borne data. One disclosed method includes collecting examples of the screenshot images and non-screenshot images and creating labelled ground-truth data for the examples. The method also includes applying re-rendering of at least some of the collected example screenshot images to represent different variations of screenshots that may contain sensitive information, and further includes training a deep learning stack by forward inference and back propagation using labelled ground-truth data for the screenshot images and the examples of the non-screenshot images. The method further includes using results of the back propagation to configure parameters of the trained DL stack for inference from images in production. Also disclosed is applying a screenshot robot to collect the examples of the screenshot images and non-screenshot images.

Training and configuration of DL stack to detect attempted exfiltration of sensitive screenshot-borne data

A computer-implemented method is described to monitor and control enterprise information stored on a cloud computing service (CCS). The method includes using a cross-application monitor to detect a cloud computing service (CCS) application programming interface (API) in use and a function or an activity being performed via the CCS API. The method also includes determining the function or the activity being performed via the CCS API by parsing a data stream based on the CCS API and identifying content being transmitted to the CCS. The method further includes applying a content inspection rule to find strings and interrelated strings in the content that are subject to content control and triggering a security action responsive to finding the strings and interrelated strings subject to content control in the parsed stream.

Systems and methods of monitoring and controlling enterprise information stored on a cloud computing service (CCS)

The technology disclosed relates to a proxy receiving a request to manipulate a data object on an independent object store. The proxy is interposed between a user system from which the request originates and the independent object store. The technology disclosed further relates to the proxy accessing a metadata store that contains object metadata for the data object and retrieving the object metadata. The technology disclosed further relates to the proxy enforcing a policy on the request based on the object metadata. Enforcing the policy further includes enforcing malware detection policies and threat detection policies.

Cloud security based on object metadata

Growing community of inventors

Saratoga, CA, United States of America

Krishna Narayanaswamy