Arbor Networks, Inc.

Forcepoint LLC

Lawrence Bruce Huston, Iii

James Edward Winquist

David Coffey

Andrew David Mortensen

William M Northway, Jr

Aaron Campbell

Ronald G Hay

Scott Iekel-Johnson

Eric S Jackson

Nicholas Scott

Mathew Ralph Richardson

Chester Kustarz

David Leslie Watson

Raffael Marty

Nicolas Christian Fischbach

Jose Oscar Nazario

Olan Patrick Barnes

Marc R Eisenbarth

Christopher R Hand

Alex Levine

James A Simpson

Brett Higgins

Brian Moran

Jeff Edwards

Kevin Russell Cline

Matthew Richardson

R Grant Reed

Jeremiah Martell

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying a security related activity of the entity, the security related activity being of analytic utility; accessing an entity behavior catalog based upon the security related activity, the entity behavior catalog providing an inventory of entity behaviors; and performing a security operation via a distributed security analytics environment, the security operation using entity behavior catalog data stored within the entity behavior catalog based upon the security related activity.

Using an entity behavior catalog when performing distributed security operations

A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having security policy visualization. At least one embodiment is directed to a computer-implemented method for implementing security policies in a secured network, including: retrieving a set of rules of a security policy; analyzing the set of rules of the security policy using one or more Satisfiability Modulo Theory (SMT) operations to reduce a dimensionality of the security policy; and generating a visual presentation on a user interface using results of the SMT operations, where the visual presentation includes visual indicia representing one or more targeted policy dimensions with respect to one or more fixed policy dimensions. In at least one embodiment, two or more security policies are presented with visual indicia representing differences between the security policies, including representations of one or more targeted policy dimensions with respect to one or more fixed policy dimensions.

Cybersecurity system having security policy visualization

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring an entity, the monitoring observing at least one electronically-observable data source; identifying an event of analytic utility; analyzing the event of analytic utility, the analyzing the event of analytic utility identifying an entity behavior associated with the event of analytic utility; and, performing the security operation in response to the analyzing the event of analytic utility, where the monitoring, identifying, analyzing and performing are performed via a distributed security analytics framework.

Distributed framework for security analytics

A system, method, and computer-readable medium are disclosed for performing a security operation. The security operation includes: monitoring a plurality of actions of an entity, the plurality of actions of the entity corresponding to a plurality of events enacted by the entity; maintaining information relating to the monitoring within a user edge component; identifying an event of analytic utility; analyzing the event of analytic utility at the user edge component, the analyzing generating a security risk assessment; and, providing the security risk assessment to a network edge component.

Maintaining user privacy via a distributed framework for security analytics

A system, method, and computer-readable medium are disclosed for performing a security analytics mapping operation. The security analytics mapping operation includes receiving a plurality of electronically-observable actions of a first entity, the plurality of electronically-observable actions of the first entity corresponding to a respective first plurality of events enacted by the first entity; receiving a plurality of electronically-observable actions of a second entity, the plurality of electronically-observable actions of the second entity corresponding to a respective second plurality of events enacted by the second entity; determining, via a distributed security analytics environment, whether a first event of the respective first plurality of events and a second event of the respective second plurality of events comprise an entity interaction between the first entity and the second entity; and, generating, via the distributed security analytics environment, an entity interaction map, the entity interaction map providing a representation of the entity interaction between the first entity and the second entity.

Security analytics mapping operation within a distributed security analytics environment

A system for processing data, comprising a first processor configured to operate one or more algorithms to provide an explicit proxy that directs network communications over a public network to a proxy server. The first processor configured to operate one or more algorithms to provide a firewall agent that verifies the presence of a firewall key prior to allowing data communications over the public network using the explicit proxy. Wherein the explicit proxy is installed using a proxy auto configuration file that is associated with the firewall agent.

Cloud-based explicit proxy

A system, method, and computer-readable medium are disclosed for implementing a cybersecurity system having a digital certificate reputation system. At least one embodiment is directed to a computer-implemented method executing operations including receiving a communication having an internet protocol (IP) address and a digital certificate at a device within the secured network; determining whether the IP address is identified as having a high-security risk level; if the IP address has a high-security risk level, assigning a security risk level to the digital certificate based on the security risk level of the IP address; and using the security risk level for the digital certificate in executing the one or more security policies. Other embodiments include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices.

Cybersecurity system having digital certificate reputation system

A method for configuring a network monitoring device is provided. A plurality of flow records is received. The plurality of flow records is analyzed according to user-specified criteria to identify one or more network traffic patterns. A plurality of network entities associated with the one or more identified network traffic patterns is identified. A managed object including the identified plurality of network entities is generated.

Using a flow database to automatically configure network traffic visibility systems

A system for controlling data services, comprising a plurality of host computers configured to communicate over the network and to request a data tunnel. A plurality of server computers configured to provide data tunnel services to the plurality of host computers. An address allocator operating on one or more processors and configured to implement one or more algorithms that cause a range of addresses to be assigned to each of the server computers, wherein each of the host computers receives one of the addresses for use as part of a data tunnel service request from the host computer to the server computer.

Resilient tunnels

A method for optimizing performance analysis of a plurality of network hosts associated with a communications network includes aggregating captured network performance data including a plurality of captured network performance metrics for a plurality of network flows. Each one of the plurality of network flows is associated with a plurality of network hosts. The aggregated captured network performance data is encoded by employing at least one data modification function. Dimensionality of the encoded captured network performance data is reduced using a neural network model. One or more reduced-dimensional clusters of the encoded captured network performance data are generated. Each of the one or more reduced-dimensional clusters is grouping one or more hosts of the plurality of network hosts based on the captured network performance metrics.

Scalable unsupervised host clustering based on network metadata

A method for encoding domain name information into flow records includes receiving a flow record. The flow record includes initial network flow information in a standard flow record format including at least a source address and a destination address. Domain name information associated with each of the source address and destination address is retrieved from a database. The domain name information is encoded into the received flow record while maintaining the initial network flow information to yield an enhanced flow record.

Augmenting network flow with passive DNS information

A method for configuring a network monitoring device is provided. One or more performance metrics associated with one or more thresholds to be configured are received from a user. Historical network traffic flow information associated with a previously detected malicious activity is analyzed to identify characteristic values for the one or more performance metrics. Threshold values are automatically configured based on the identified characteristic values.

DoS detection configuration

A system for mitigating network attacks includes a protected network and one or more attack mitigation devices communicatively coupled to the protected network. The attack mitigation devices are configured to receive a request from a host having an IP address and determine whether the IP address is included in a first probabilistic data structure representing addresses of hosts having failed to authenticate using a first authentication procedure. The attack mitigation devices are also configured to perform the first authentication procedure, responsive to a determination that the IP address of the host is not included in the first data structure. The attack mitigation devices are yet further configured to allow the host to access the protected network, responsive to successful completion of the first authentication procedure and to update the first data structure to include the IP address of the host, responsive to unsuccessful completion of the first authentication procedure.

Probabilistic tracking of host characteristics

A system for mitigating network attacks within encrypted network traffic is provided. The system includes a protected network including a plurality of devices. The system further includes attack mitigation devices communicatively coupled to the protected network and to a cloud platform. The attack mitigation devices are configured and operable to decrypt the encrypted traffic received from the cloud platform and destined to the protected network to form a plurality of decrypted network packets and analyze the plurality of decrypted network to detect attacks. The attack mitigation devices are further configured to generate, in response to detecting the attacks, attack signatures corresponding to the detected attacks and configured to send the generated attack signatures to attack mitigation services provided in the cloud platform. The attack mitigation services are configured and operable to drop encrypted network traffic matching the attack signatures received from the attack mitigation devices.

Scalable DDoS protection of SSL-encrypted services

A system for mitigating network attacks is provided. The system includes a protected network including a plurality of devices. The system further includes one or more attack mitigation devices communicatively coupled to the protected network. The attack mitigation devices are configured and operable to employ a recurrent neural network (RNN) to obtain probability information related to a request stream. The request stream may include a plurality of at least one of: HTTP, RTSP and/or DNS messages. The attack mitigation devices are further configured to analyze the obtained probability information to detect one or more atypical requests in the request stream. The attack mitigation services are also configured and operable to perform, in response to detecting one or more atypical requests, mitigation actions on the one or more atypical requests in order to block an attack.

Growing community of inventors

Ann Arbor, MI, United States of America

Lawrence Bruce Huston, Iii