Narus, Inc.

Awake Security, Inc.

Ram Keralapura

Antonio Nucci

Alok Tongaonkar

Marco Mellia

Marios Iliofotou

Ignacio Bermudez

Joshua Robinson

Gary Golomb

Maurizio Matteo Munafo

Supranamaya Ranjan

Chunsheng Fang

Ruben Torres

Luigi Grimaudo

Eric Karasuda

Guowu Xie

A method for profiling network traffic of a network. The method includes extracting cells from bi-directional payloads generated by a network application, wherein each cell comprises at least one direction reversal in a corresponding bi-directional flow, generating a cell group comprising a portion of the cells that are similar, analyzing the cell group to generate a signature of the network application, and classifying, based on the signature of the network application, a new bi-directional flow as being generated by the network application.

Transaction based network application signatures for text based protocols

A method to provide traveler content service. The method includes receiving, from the traveler and prior to the trip, a request to access traveler content during the trip, wherein the request comprises travel ticket information associated with the trip and access information to a source of the traveler content, wherein the trip crosses a region with no access to the source of the traveler content, retrieving, prior to the trip, the traveler content from the source using the access information, transmitting, in response to detecting a first vehicle assigned to the trip at a departure port of the trip, the traveler content to a first traveler content repository onboard the first vehicle to generate a traveler content first onboard copy, and providing, during the trip and by an onboard computer processor of the first vehicle, the traveler content first onboard copy from the first traveler content repository to the traveler.

Traveller content service

A method for analyzing a binary-based application protocol of a network. The method includes obtaining conversations from the network, extracting content of a candidate field from a message in each conversation, calculating a randomness measure of the content to represent a level of randomness of the content across all conversation, calculating a correlation measure of the content to represent a level of correlation, across all of conversations, between the content and an attribute of a corresponding conversation where the message containing the candidate field is located, and selecting, based on the randomness measure and the correlation measure, and using a pre-determined field selection criterion, the candidate offset from a set of candidate offsets as the offset defined by the protocol.

Automatic parsing of binary-based application protocols using network traffic

System and method to identify a security entity in a computing environment is disclosed. Communication between a user computer and at least one destination computer by a security appliance is monitored by a security appliance. Selective information from the communication is extracted by the security appliance. At least one security entity is identified based on a subset of the selective information. One or more selective information is associated to at least one security entity. A knowledge graph is generated based on the associated selective information.

System and method for identifying security entities in a computing environment

System and method to characterize a security entity in a computing environment is disclosed. Communication between a user computer and at least one destination computer by a security appliance is monitored by a security appliance. Selective information from the communication is extracted by the security appliance, selective information indicative of the security entity. A plurality of words from the communication between the identified security entity and at least one destination computer are selectively extracted. A word cloud is generated based on the selectively extracted plurality of words. The word cloud is evaluated to characterize the identified security entity.

System and method for characterizing security entities in a computing environment

A method for analyzing an application protocol of a network. The method includes extracting non-alphanumeric tokens from conversations of the network, selecting frequently occurring non-alphanumeric token as a field delimiter candidate for dividing each conversation into a slice-set, analyzing slice-sets of the conversations to determine a statistical measure of matched slices for each conversation, and -o determine a field delimiter candidate score by aggregating the statistical measure of matched slices for all conversations, and selecting the non-alphanumeric token as the field delimiter of the protocol based on the field delimiter candidate score associated with the non-alphanumeric token.

Automatic parsing of text-based application protocols using network traffic data

A method for profiling network traffic of a network is presented. The method includes obtaining a cohesive flow-set based on a (port number, transport protocol) pair, identifying a statistically representative training set from the flow-set, identifying a network application associated with the (port number, transport protocol) pair, determining a packet content based signature term of the network application based on the training set, generate a nondeterministic finite automaton (NFA) using the signature terms to represent regular expressions in the training set, matching a portion of a new flow to the NFA in real time and identify a server attached to the new flow as executing the network application, and generate an alert in response to the match for blocking the new flow prior to the server completing a task performed using the new flow.

System and method for determining network application signatures using flow payloads

A method for profiling network traffic of a network, including obtaining a plurality of flows comprising a plurality of client IP addresses, a plurality of server IP addresses, and a plurality of server ports, extracting a plurality of fully qualified domain names (FQDNs) from a plurality of DNS flows in the network traffic, analyzing correlation between the plurality of flows and the plurality of FQDNs to generate a result, and presenting the result to an administrator user of the network.

Discerning web content and services based on real-time DNS tagging

A method for classifying network traffic, including (1) processing a first working set portion of a flow batch for a first iteration by dividing the first working set portion into clusters and filtering a cluster by (i) identifying a first server port as most frequently occurring comparing to all other server ports in the cluster, (ii) in response to determining that a first frequency of occurrence of the first server port in the cluster exceeds a pre-determined threshold: (a) identifying the cluster as a dominatedPort cluster, (b) removing the cluster from the first working set portion to generate a remainder as a second working set portion, and (c) removing, from the cluster to be added to the second working set portion, one or more flows having different server port than the first server port, and (2) processing the second working set portion for a second iteration.

Self-learning classifier for internet traffic

Embodiments of the invention provide a method, system, and computer readable medium for classifying network traffic based on application signatures generated during a training phase using a modified subspace clustering scheme based on feature vectors extracted from network flows in a training set generated by a particular application and applying the signatures to a new feature vector extracted in real-time from current network data. The newly extracted feature vector is projected into the subspaces and compared with the signatures.

Network traffic classification using subspace clustering techniques

A method for profiling network traffic of a network, including defining a set of features each corresponding to a set of pre-determined bit positions for selecting a pre-determined number of data bits from each flow in a flow set generated by a network application to form a feature value assigned to the feature for the each flow, identifying the feature as a deterministic feature based on a frequency of occurrence of the feature value, extracting a set of paths from the flow set based on a number of deterministic features, generating a state machine based on the set of paths, and analyzing a new flow associated with a server in the network to determine the server as executing the network application.

Network application signatures for binary protocols

A method for profiling network traffic of a network. The method includes identifying a training set having captured payloads corresponding to a set of flows associated with a network application, determining a set of signature terms from the training set, representing a portion of the captured payloads as regular expressions, representing a regular expression as a path in a term transition state machine (TTSM) including states coupled by at least a link that is assigned a signature term and a transition probability, the transition probability corresponding to a signature term transition to the signature term in the regular expression, and analyzing, based on the TTSM according to at least the transition probability, a flow separate from the set of flows and associated with a server in the network to determine the server as executing the network application.

System and method for using network application signatures based on term transition state machine

A method for profiling network traffic of a network. The method includes identifying a training set having captured payloads corresponding to a set of flows associated with a network application, determining a set of signature terms from the training set, representing a portion of the captured payloads as regular expressions, representing a regular expression as a path in a modified term transition state machine (MTTSM) including states coupled by at least a link that is assigned a signature term, and analyzing, based on the MTTSM, a flow separate from the set of flows and associated with a server in the network to determine the server as executing the network application.

Growing community of inventors

San Jose, CA, United States of America

Ram Keralapura