Cisco Technology, Inc.

Google Inc.

Navindra Yadav

Shashidhar R Gandham

Abhishek Ranjan Singh

Shih-Chun Chang

Khawar Deen

Ali Parandehgheibi

Ashutosh Kulshreshtha

Hai Trong Vu

Rohit Chandra Prasad

Anubhav Gupta

Jackson Ngoc Ki Pang

Sunil Gupta

Michael Standish Watts

Omid Madani

Varun Sagar Malhotra

Vimalkumar Jeyakumar

Supreeth Hosur Nagesh Rao

Mohammadreza Alizadeh Attar

Ellen Christine Scheib

Shashi Gandham

Thomas James Edsall

Kit Chiu Chu

Hoang Viet Nguyen

Satyam Sinha

Supreeth Rao

Darshan Shrinath Purandare

Krishna Doddapaneni

Umamaheswaran Arumugam

Aiyesha Ma

Roberto Fernando Spadaro

Francisco M Matus

Sameer Merchant

Prasannakumar Jobigenahally Malleshaiah

Gnanaprakasam Pandian

Bharathwaj Sankara Viswanathan

Tapan Shrikrishna Patwardhan

Praneeth Vallem

Bhanu Gopalasetty

Andy Sloane

Jothi Prakash Prabakaran

Vimal Jeyakumar

Shree N Murthy

Atul Mahamuni

Jeffrey D Taft

Kai Zhu

Sudhir Kumar Jain

Rohit Kumar Suri

Ravi Prasad

Rachita Agasthy

Daniel Todd Cohn

Michael R Smith

Abhijit Kumar Choudhury

Abhay Kumar Roy

Patrice R Calhoun

Pauline Shuen

Suresh Katukam

Paul Mach

Alok Lalit Wadhwa

Aria Rahadian

Xuan Zou

Fnu Rachita Agasthy

Duane Thomas Barlow

Robert Andrews

Jonathan W Hui

James P Rivers

Alec Woo

Scott A Emery

Fusun Ertemalp

Edward Crabbe

Ashok K Kumar

Janardhanan Radhakrishnan

Duy Nguyen

David Delano Ward

Kent Kinchu Leung

James Neil Guichard

Wei Hong

Paul M Quinn

Nagaraj Bagepalli

Sheausong Yang

Surendra M Kumar

Hoang-Nam Nguyen

Weifei Zeng

Xin Yi Liu

Murali Duvvury

Oliver Kempe

Ayaskant Pani

Pirabhu Raman

Amit Jain

Paul John Lesiak

Senthil Arunachalam

Shmuel Shaffer

Peter Geoffrey Jones

Hiroshi Suzuki

Thomas Jeffrey Enderwick

Sarang M Dharmapurikar

Jie Cheng Jiang

Shashi Kumar

Ly Loi

Vijayaraghavan Doraiswami

Bora A Akyol

Systems, methods, and computer-readable media for updating configurations in sensors deployed in multi-layer virtualized environments. In some examples, a system can track information of sensors and collectors in the network. In response to determining that a specific collector becomes unavailable (e.g., the specific collector is down, offline or becomes unsupported), the system can determine affected sensors corresponding to the specific collector, determine a new collector among active collectors of the network for each of the affected sensors, and dynamically update configuration and settings of the affected sensors to maintain proper collector-to-sensor mappings and other settings on the affected sensors.

Auto update of sensor configuration

The disclosed technology relates to a network agent for reporting to a network policy system. A network agent includes an agent enforcer and an agent controller. The agent enforcer is configured to implementing network policies on the system, access data associated with the implementation of the network policies on the system, and transmit, via an interprocess communication, the data to the agent controller. The agent controller is configured to generate a report including the data and transmit the report to a network policy system.

Network agent for reporting to a network policy system

Systems, methods, and computer-readable media for determine a neighborhood graph can include the following processes. A neighborhood graph system generates a neighborhood graph for a plurality of nodes in an enterprise network, the neighborhood graph representing a multi-hop connections between any two nodes of the plurality of nodes. A security score service determines a security score for each of the plurality of nodes to yield a plurality of scores. The neighborhood graph system updates the neighborhood graph of the plurality of nodes using the plurality of scores to provide a visual representation of securities of the plurality of nodes relative to each other.

Secure neighborhoods assessment in enterprise networks

In one aspect, a computerized method for locating one or more shadow vulnerable datastores for cloud-platform datastores includes the step of identifying a cloned data store of an original datastore in a cloud database instance. It includes the step of determining that the cloned datastore comprises a shadow vulnerable datastore. It includes the step of defining a security posture of the cloned datastore. It includes the step of publishing a digitized data clone security differential report comprising the security posture and one or more remediations to fix security posture issues.

Locating shadow vulnerable datastores for cloud data table/API/data lake stores

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

In one aspect, a method for implementing a cloud-platform push for one or more known data breaches includes the step of, for each data breach of the one or more known data breaches, providing a functionality that maps one or more kill chains or Tactics, Techniques, and Procedures (TTPs) for a specified set of security dimensions. A step includes generating a security rule for each mapped kill chain or TTP based on the functionality that maps the one or more kill chains or Tactics, Techniques, and Procedures (TTPs) for a specified set of security dimensions. A step includes pushing the security rule to an enterprise so that the enterprise is aware of a vulnerability in the data breach. A step includes generating a customized posture for a Virtual private cloud (VPC) in the enterprise's cloud-based network. A step includes determining that the data breach can occur within the enterprise's cloud-based network.

Cloud-platform push for known data breaches

In one aspect, a computerized system for locating anomalous query activity with a cloud-based database, comprising: with an atypical query engine: analyzing and understanding data within a cloud-based database, processing all accesses to the data within cloud-based database and SAAS environment, generating a list of user that accesses a table from a location in the cloud-based database using, and capture a set of specified key statistics about the cloud-based database query; and role suggestion engine: generating a user behavior fingerprint comprising a history of the user's behavior within the cloud-based database, identifying that a user is an outlier with respect to behavior with respect to the set of specified key statistics, and suggesting a new role within an enterprise managing the cloud-based database for the user, wherein the fingerprint of the outlier user is used to generate the suggestion for the new role.

Methods and systems for locating anomalous query activity on data stores

The present disclosure provides systems, methods, and computer-readable media for implementing security polices at software call stack level. In one example, a method includes generating a call stack classification scheme for an application, detecting a call stack during deployment of the application; using the call stack classification scheme during runtime of the application, classifying the detected call stack as one of an authorized call stack or an unauthorized call stack to yield a classification; and applying a security policy based on the classification.

Security policies for software call stacks

Disclosed herein are methods of forwarding data over an IP network. The methods may include receiving a packet from a source host connected to the IP network, identifying the IP address of a destination host designated in the packet, determining the location on the IP network where the destination host designated by the packet is connected, without reference to the MAC address specified in the packet, by using location-identification information stored on the IP network, and forwarding the packet to the location on the IP network where the destination host is connected without reference to the MAC address specified in the packet. Also disclosed herein are related network devices implementing such techniques and operations, as well as IP networks which include such network devices.

IP-based forwarding of bridged and routed IP packets and unicast ARP

This disclosure generally relate to a method and system for mapping application dependency information. The present technology relates techniques that enable user-adjustable application dependency mapping of a network system. By collecting internal network data using various sensors in conjunction with external user inputs, the present technology can provide optimized application dependency mapping using user inputs.

System and method for user optimized application dependency mapping

Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Technologies for managing compromised sensors in virtualized environments

This disclosure generally relate to a method and system for network policy simulation in a distributed computing system. The present technology relates techniques that enable simulation of a new network policy with regard to its effects on the network data flow. By enabling a simulation data flow that is parallel and independent from the regular data flow, the present technology can provide optimized network security management with improved efficiency.

System and method for network policy simulation

A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

System and method of assigning reputation scores to hosts

An example method according to some embodiments includes receiving flow data for a packet traversing a network. The method continues by determining a source endpoint group and a destination endpoint group for the packet. The method continues by determining that a policy was utilized, the policy being applicable to the endpoint group. Finally, the method includes updating utilization data for the policy based on the flow data.

Policy utilization analysis

Growing community of inventors

Cupertino, CA, United States of America

Navindra Yadav