Palo Alto Networks, Inc.

Martin Walter

Song Wang

Suiqiang Deng

Zhipu Jin

Wilson Xu

Michael Soren Jacobsen

Monty Sher Gill

Yueh-Zen Chen

Nicholas Campagna

Wei Xu

Jun Wang

Daiping Liu

Ashwath Sreenivasa Murthy

Seokkyung Chung

Charles Bransi

Prabhakar M V B R Mangam

Shriram S Jandhyala

Fan Fei

Karthik Ganesan

Jeffrey Fitz-Gerald

Suquan Li

Ben Hua

Amro A Younes

Nicholai Gian Piagentini

Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.

In-line detection of algorithmically generated domains

A request to establish a session with a first server is received from a client device. The first server is associated with a first hostname, and the request includes information identifying a second hostname purported to correspond to the first server. A Domain Name System (DNS) lookup using the second hostname is performed. A determination that the second hostname was spoofed by the client device is determined based on a response to the DNS lookup. In response to the determination being made that the request received from the client device includes the spoofed second hostname, a determination that the client device has injected or overridden at least one of an HTTP Host header and a Server Name Indicator in the request is made, and an action to take with respect to the client device is determined.

Hostname validation and policy evasion prevention

Techniques for multifactor authentication as a network service are disclosed. In some embodiments, a system, process, and/or computer program product for multifactor authentication as a network service includes monitoring a session at a firewall, applying an authentication profile based on the new session, and performing an action based on the authentication profile.

Multifactor authentication as a network service

Enforcing a policy is described. A mapping between an IP address of a device and a user identity is identified at a first appliance, at least in part by correlating event information. The mapping is transmitted to a second appliance. A policy is applied by the second appliance to the device based at least in part on the user identity.

User-ID information propagation among appliances

Enforcing a policy is described. System log messages are received, via an interface, from a network device. At least a portion of the received system log messages are parsed to obtain an IP address and to obtain a user identifier. A policy to apply to a session associated with the IP address is determined, based at least in part on the user identifier. The policy is applied to the session.

Using log event messages to identify a user and enforce policies

A request to access a network resource is received from a client device. The request includes a purported hostname of the network resource. A Domain Name System (DNS) lookup of the purported hostname is performed. A result of the lookup is used in making a determination that the request received from the client device is invalid. In response to the determination being made that the request received from the client device is invalid, an action to take with respect to the client device is determined.

A policy that includes an address group is received. The policy is compiled into a set of one or more rules. The compiling is performed at least in part by determining members of the address group. The compiling can further include substituting one or more IP addresses of the members for the address group. At least one rule included in the set of rules is enforced.

Policy enforcement based on dynamically attribute-based matched network objects

Policy enforcement in an environment that includes virtualized systems is disclosed. Virtual machine information associated with a first virtual machine instance executing on a host machine is received. The information can be received from a variety of sources, including an agent, a log server, and a management infrastructure associated with the host machine. A policy is applied based at least in part on the received virtual machine information.

Policy enforcement in a virtualized environment

Policy enforcement is disclosed. A first identity and second notification are respectively received from a network device at different first and second times. In response to the receipt of the second identity notification, a determination is made that an IP address associated with the network advice has changed from a first IP address to a second IP address. A mapping between an identifier associated with the device and the first IP address is updated to a mapping between the identifier and the second IP address. A policy is updated based on the updated mapping.

Dynamic address policy enforcement

Techniques for credentials management in large scale virtual private network (VPN) deployment are disclosed. In some embodiments, credentials management in large scale VPN deployment includes generating a public/private key pair and a certificate signing request at a satellite device; automatically communicating the certificate signing request to a portal over a public, untrusted network to authenticate the satellite device using a serial number associated with the satellite device, in which the certificate signing request and the serial number are verified by the portal; and receiving a certificate from the portal for using to establish VPN connections and configuration information for the satellite device, in which the certificate includes a credential signed by a trusted certificate authority, and the configuration information includes gateway configuration information identifying a plurality of gateways to which the satellite device is configured to connect using VPN connections.

Growing community of inventors

Livermore, CA, United States of America

Martin Walter