Cisco Technology, Inc.

Michael Cheung

Mark Ammar Rayes

Ammar Rayes

Ralph Droms

Petre Dini

An isolation approach for network users associated with elevated risk is disclosed for protecting networks. In one approach a method comprises the computer-implemented steps of determining a user identifier associated with a network device that has caused a security event in a network; causing the network device to receive a network address that is selected from a subset of addresses within a specified pool associated with suspected malicious network users; and configuring one or more security restrictions with respect to the selected network address.

Isolation approach for network users associated with elevated risk

A method of determining an amount of bandwidth needed on a communication link is disclosed. According to one aspect of the method, instead of considering only user behavior or only traffic characteristics, the amount of bandwidth needed on the link is determined based on both user behavior and traffic characteristics. The determined amount is stored in memory. By accounting for both user behavior and traffic characteristics, the method determines the amount of bandwidth needed on a communication link more accurately.

Link sizing based on both user behavior and traffic characteristics

A policy-based network security management system is disclosed. In one embodiment, the system comprises a security management controller comprising one or more processors; a computer-readable medium carrying one or more sequences of instructions for policy-based network security management, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of receiving a set of data regarding a user of a computer network; automatically deciding on a course of action based on the set of data, wherein the course of action may be adverse to the user although the set of data is insufficient to establish whether the user is performing a malicious action; and sending signals to one or more network elements in the computer network to implement the decision.

Policy-based network security management

A method is disclosed for preventing spoofing of network addresses. A binding is established between an Internet Protocol (IP) address, a Media Access Control (MAC) address, and a port. An Address Resolution Protocol (ARP) table is updated based on the binding.

Method and apparatus for preventing spoofing of network addresses

A method and a system for re-establishing the connection of a network device with a network, using viral communication, are provided. According to the various embodiments, a disconnected network device acts as a simple wireless device and contacts a neighboring network device to obtain configuration information. The request can be forwarded to a network management station (NMS) through one or more neighbors of the disconnected network device. Connectivity is obtained by executing the configuration instructions obtained from the NMS.

Growing community of inventors

San Jose, CA, United States of America

Michael Cheung