Zscaler, Inc.

Rohit Goyal

Rishabh Gupta

Abhinav Bansal

Vikas Mahajan

Amit Sinha

Patrick Foxhoven

Systems and methods for detecting malicious mobile applications using machine learning in a cloud-based system utilize a traffic forwarding technique and a cloud-based Machine Learning (ML) model to assess the security of apps installed on a user device. This architecture enables the cloud-based system to have visibility of user devices, train the ML model in real-time with a vast amount of mobile app data from multiple users, and enforce security on the user devices from the cloud-based system. Advantageously, the ML model is trained with a vast amount of mobile traffic, leading to better accuracy of prediction. The cloud-based system can be multi-tenant (enterprise), have a large user base, be spread over a large geographic area, etc. This provides a great opportunity for training data. Feedback from live production data can be fed back into the ML model.

Detecting malicious mobile applications using machine learning in a cloud-based system

Systems and methods for securely handling data traffic on local or private networks, such as by using cloud computing, are provided. A non-transitory computer-readable medium, according to one implementation, may be configured to store executable instructions enabling a processor of a user device to perform the step of discovering an origin of a source application associated with network packets bound for a private address space. The executable instructions may further enable the processor to send a tuple regarding the discovered origin to a cloud server to request an analysis of the tuple. Upon receiving an allow instruction from the cloud server, the instructions enable the processor to allow the network packets to flow normally to a destination associated with the private address space. Upon receiving a deny instruction from the cloud server, the instructions enable the processor to drop the network packets.

Securing local network traffic using cloud computing

Systems and methods implemented by a mobile device include establishing a plurality of tunnels to a gateway, wherein each of the plurality of tunnels is on one of a plurality of link layer channels at the mobile device; intercepting network traffic on the mobile device; forwarding the network traffic to one of the plurality of tunnels based on a set of traffic forwarding rules; and responsive to a network change for the mobile device, managing the plurality of tunnels and continuing the forwarding based on the managing. The systems and methods can further include determining characteristics including bandwidth of each of the plurality of link layer channels; and utilizing the characteristics with the set of traffic forwarding rules for the forwarding.

Adaptive multipath tunneling in cloud-based systems

Systems and methods include intercepting traffic on the user device; forwarding the traffic to a cloud-based system for security processing therein; and, responsive to unavailability of the cloud-based system preventing the forwarding, performing local security processing of the traffic at the user device including determining whether the traffic is allowed based on a cache at the user device, forwarding the traffic separate from the cloud-based system when it is allowed, and blocking the traffic when it is not allowed.

Disaster recovery for a cloud-based security service

Systems and methods include providing functionality for the user device while operating in background on the user device including providing secure connectivity with a cloud-based system over a network; continuously collecting packets intercepted by the enterprise application over a time interval, wherein the collected packets are collected over the time interval; and responsive to an issue with functionality of the enterprise application, transmitting the collected packets to a back end server for troubleshooting of the issue. The time interval is a set amount of time, and each collected packet is deleted at the expiration of the time interval.

Cloud application design for efficient troubleshooting

Systems and methods include intercepting traffic on a mobile device based on a set of rules; determining whether a connection associated with the traffic is allowed based on a local map associated with an application; responsive to the connection being allowed or blocked based on the local map, one of forwarding the traffic associated with the connection when allowed and generating a block of the connection at the mobile device when blocked; and, responsive to the connection not having an entry in the local map, forwarding a request for the connection to a cloud-based system for processing therein. The cloud-based system is configured to allow or block the connection based on the connection not having an entry in the local map.

Enforcing security policies on mobile devices in a hybrid architecture

An enterprise application executed on a user device is configured to perform steps of providing functionality for a user device while operating in background on the user device; determining an issue with the functionality of the enterprise application; presenting a user of the user device a list of a plurality of issue types for selection thereof; receiving a selection from the user of an issue type for the issue; and collecting data from the user device based on the selected issue type. The steps can further include transmitting the collected data to a back end server for troubleshooting of the issue.

Systems and methods include providing functionality for a user device while operating in background on the user device; responsive to a user request, starting collection of packets intercepted by the enterprise application; storing the collected packets on the user device; receiving a selection from the user of an issue type of a plurality of issue types for an issue; and providing the issue type and the collected packets for debugging of the issue type. The systems and methods can further include transmitting the collected data and the collected packets to a back end server for troubleshooting of the issue.

Packet dump utility in a mobile application for efficient troubleshooting

Systems and methods of identifying and processing certificate pinned applications through a cloud based security system include monitoring traffic associated with a connection; developing a profile of an application associated with the traffic based on the monitoring, wherein the profile comprises whether or not the application is a certificate pinned application which requires a predefined set of criterion to be matched against an advertised certificate; and selectively performing SSL interception of the connection in the cloud based security system based on the profile. The monitoring can include monitoring handshake messages between a client and a server to determine a handshake status and a certificate status.

Growing community of inventors

Chandigarh, India

Rohit Goyal