Riverbed Technology, Inc.

Mazu Networks, Inc.

Riverbed Technologies, Inc.

Prem K Gopalan

Massimiliano Antonio Poletto

Kyle Jamieson

Daniel Weber

Bryan Thomas Elverson

Panayiotis Mavrommatis

Andrew Ratin

Christopher James White

According to an aspect of the invention, a system and method is configured to detect time series outliers in network traffic.

Detecting outliers in network traffic time series

A system, method, and computer program product for identifying a worm are disclosed. The system, method, and computer product are configured to generate a signature for a computer worm by identifying a set of bits representing the signature, generate a first worm signature based on the signature, and generate a second worm signature based on the signature. The first worm signature is formatted for a first device and the second worm signature is formatted for a second, different device. The first worm signature and the second worm signature are different.

Worm propagation mitigation

Some embodiments of the present invention provide systems and methods for detecting anomalies in network traffic. Some embodiments detect anomalies based on time-series activity in network traffic. Upon detection of an anomaly, significant changes can be analyzed to identify abnormal changes in network traffic across different network entities. The identified changes can then be used to determine the cause and the impact of the detected anomaly on the network traffic.

Impact scoring and reducing false positives

A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.

Event detection/anomaly correlation heuristics

A system, method and computer program product for exploit-based worm detection and mitigation are disclosed. The system, method, and computer program product are configured to identify a signature representing content prevalent in network traffic, determine if the traffic including the signature exhibits propagation, determine if the traffic including the signature exhibits connectedness, and generate a worm signature based on the signature if the signature exhibits both connectedness and propagation.

Growing community of inventors

Cambridge, MA, United States of America

Prem K Gopalan