Hewlett Packard Enterprise Development LP

Aruba Networks, Inc.

Cisco Technology, Inc.

Hewlett-packard Development Company, L.p.

Ramsundar Janakiraman

Ravinder Verma

Brijesh Nambiar

Prasad Palkar

Kalyan Ghosh

Gaurav Rastogi

Shankar Subramaniam

Badri Ramaswamy

Joy J Chatterjee

Rajesh Mirukula

Mohan Parthasarathy

Bhanu Gopalasetty

Giri Gopalan

Sachin Jain

Praveen Jain

Ranganathan Rajagopalan

Rajneesh Bajpai

Srinivasan Jayarajan

Avinash Sridharan

Steven Alexander

Vijayaraghavan Doraiswami

Shashank Gupta

Venkatesan Marichetty

Suhas Shetty

Andrew Schweig

Sridhar Kamsetty

Saji Xavier

Ronald Calvo Rojas

Jain Praveen

Systems and methods for providing remote network security using a network embeddings model are provided. A method consistent with the present disclosure includes retrieving a corpus of network activity data associated with a first network. The network activity data may be generated from users within the first network submitting network requests for network assets to service the network requests. The method also includes creating a crafted encoded corpus by selecting a subset of the corpus of network activity data and creating a network embeddings model based on the crafted encoded corpus. Lastly, the method includes generating an alert in an event that the network security system identifies an anomaly associated with the crafted encoded corpus of network activity data.

Network embeddings model for personal identifiable information protection

A system may identify a resource deployed in a computer, where discovery protocol data traffic is unencrypted. The system may receive metadata associated with the discovery protocol data traffic, update the computer network based at least in part on the information included in the metadata, and provide a response to the client. The system may authenticate a request from the client to access the resource using an encrypted protocol, and provide, to the client, access to the resource upon authentication, according to a resource attribute.

Using intent to access in discovery protocols in a network for analytics

Systems and methods are provided for utilizing natural language process (NLP), namely sequence prediction approaches, in the realm of network security. Techniques include analyzing network transaction records to form network sentences representative of network activity. The network sentences are formulated by regularizing transactions records using words, allowing the network sentences to represent the network activity using natural language terminology. In some cases, multiple variations of the network sentences having different sequences of words are generated to form a corpus of network sentences related to a semantics of network activity. Accordingly, an NLP-based network prediction model can be created and trained using the corpus of network sentences. The network prediction model can be trained over to identify dimensions corresponding to particular sequences of words in the network sentences, and predict an expected dimension. Using the network prediction model predictions of expected network are provided, and anomalies efficiently detected.

Methods and systems for creating multi-dimensional baselines from network conversations using sequence prediction models

Systems and methods are provided for utilizing natural language process (NLP), namely semantic learning approaches in network security. Techniques include analyzing network transaction records to form a corpus related to a semantics of network activity. The corpus includes formulated network sentences, representing sequences of network entities that are accessed in the network. A corpus of network sentences can include sequences of servers accessed by each user. A network sentence embeddings model can be trained on the corpus. The network sentence embeddings model includes an embedding space of text that captures the semantic meanings of the network sentences. In sentence embeddings, network sentences with equivalent semantic meanings are co-located in the embeddings space. Further, proximity measures in the embedding space can be used to identify whether network sentences (e.g., access sequences), are semantically equivalent. Using network sentence embeddings model, equivalent semantics of access can be established to efficiently detect anomalies.

Methods and systems for establishing semantic equivalence in access sequences using sentence embeddings

A system may select a list of servers in a computer network to perform behavioural profiling, wherein each server is associated with a domain name, the list of servers includes domain name entries, and the list of servers is prioritized according to a popularity value for each server. The system may update the list of servers based on a popularity threshold, partition the computer network into one of: subnetworks or subdomains, and establish a hierarchy along one of: the subnetworks or the subdomains based on the domain name entries in the list of servers. The system may update the popularity value for a server associated with a resolved network address, and may update the hierarchy along one of: the subnetworks or the subdomains based on the popularity value.

Gain customer trust with early engagement through visualization and data driven configuration

Systems and methods are provided for utilizing natural language process (NLP), namely semantic learning approaches, in the realm of network security. Techniques include analyzing network transaction records to form a crafted corpus related to a semantics of network activity. The crafted corpus can be adapted to include sequences of network entities that are deemed most appropriate for analyzing a particular category related to network activity. For example, crafted corpuses can include sequences of servers accessed by each user, in order to identify activity trends in a user's normal activity. A network embeddings model can be trained on the crafted corpus. The network embeddings model includes an embedding space of text that represents interactions between network entities and captures contextual similarities of text, which further measures similarities between the network entities in the embedding space. Using network embeddings model, network activity is monitored and modeled over time, and anomalies efficiently detected.

Methods and systems for using embedding from Natural Language Processing (NLP) for enhanced network analytics

A method including correlating a network address of a user to a domain name in a domain name system of a computing network, based on a service log, is provided. The method includes identifying a user group, generating a watch list of servers that control access to a new resource, and establishing a baseline behaviour for a client device based on a first access and a last access to one server in the watch list of servers during a time to live period. The method also includes adding the true network address and a correlated domain name to the baseline behaviour, retrieving a timestamp of an access by the client device to the network address, and flagging, as a violation, the access by the client device to the network address when the access is outside of a legitimate window around the baseline behaviour.

Behavioral profiling of service access using intent to access in discovery protocols

A system may retrieve a packet in a network edge of a computer network. The system may identify a source address of the packet and a domain name that is being resolved that is associated with the packet and determining a time to live for the domain name, based at least in part on a record associated with the domain name. The server may further determine a relevance value indicative of an importance of a server associated with the domain name based at least in part on a frequency of the domain name in a domain name system list comprising a plurality of servers associated with a plurality of domain names, wherein the frequency is normalized by the time to live for the domain name. The system may sort the domain name system list according to the relevance value.

Identify assets of interest in enterprise using popularity as measure of importance

Systems and methods are provided for interactively clustering a plurality of devices within a communication network. Techniques can include collecting intent to access messages and service advertisement messages that are communicated to a plurality of devices within the communication network. The intent to access messages and service advertisement messages can be formatted in accordance with a discovery protocol. The collected messages are analyzed to identify services, attributes, and attribute values associated with the plurality of devices using text-based analysis. Distances separating each the plurality of devices according to an associated distance value, can be determined. Distance values relate to a degree of similarity between each of the plurality devices based on the identify services, attributes, and attribute values. Clusters of devices can be generated based on the determined distances. A visualization of the communication network including graphical representations of the generated clusters of devices can be provided.

Methods and systems for device grouping with interactive clustering using hierarchical distance across protocols

A network sensor that features a data store and a packet processing engine. In communication with the data store, the packet processing engine comprises (1) a cache management logic and (2) deduplication logic. The cache management logic is configured to analyze packets to determine whether (a) a packet under analysis include duplicated data and (b) content of the packet is targeted for storage in a same continuous logical storage area as the duplicated data. The deduplication logic, when activated by the cache management logic, is configured to generate a deduplication reference for insertion into the packet prior to storage.

System, apparatus and method for managing redundancy elimination in packet storage during observation of data movement

A network sensor that features a data store and a packet processing engine. Communicatively coupled to the data store, the packet processing engine is configured to (i) generate a retention priority for at least a first flow within a first storage region of a plurality of storage regions and (ii) identify, in response to an eviction request, the priority of each of the plurality of storage regions. The priority of the first storage region is partially based on the retention priority associated with the first flow while the priority of a second storage region is based on retention priorities associated with flows stored within the second storage region. The packet processing engine also is configured to identify, through use of the retention priorities of the stored flows within the first storage region, which flows are to be retained and which flows are to be evicted.

System, apparatus and method for prioritizing the storage of content based on a threat index

The present disclosure discloses a method and system for achieving enhanced performance for application message handling. The disclosed system includes a device and is configured to receive, at a first processing layer implemented by the device, a message addressed to a first port. The system is further configured to modify the message to be addressed to a second port indicated in a body of the message prior to forwarding the message to a second processing layer implemented by the device. Furthermore, the system is configured to forward, by the first processing layer to the second processing layer, the modified message addressed to the second port.

System and method for message handling in a network device

The present disclosure discloses a method and network device for control plane protection for various tables using storm prevention entries. Specifically, the disclosed system receives a first packet, and creates an inactive entry in a table. The system then forwards the first packet from a first processor to a second processor for processing. Also, the system associates the inactive entry with a timestamp indicating when the first packet is forwarded to the second processor, and determines a configured interval (CI) associated with the table. Further, the system compares a difference between a current timestamp and the timestamp associated with the inactive entry against the CI upon receiving a second packet. If the difference is longer than the CI, the system associates the inactive entry with the current timestamp, and forwards the second packet to the second processor for processing. Otherwise, the system discards the second packet.

Control plane protection for various tables using storm prevention entries

Processing of MLD control packets in an access point (AP) connected to a digital network. According to the present invention, an AP in a network converts MLD queries from multicast to unicast and sends these unicast packets to each client of the AP. These MLD query packets may be filtered or restricted by per-user client rules These MLD query packets may also be tagged as high priority packets to speed their delivery. The AP also suppresses the retransmission of MLD Join packets to clients of the AP.

Growing community of inventors

Sunnyvale, CA, United States of America

Ramsundar Janakiraman