Juniper Networks, Inc.

Lacework Inc.

Fortinet, Inc.

Sanjay Kalra

Yijou Chen

Vikram Kapoor

Stephen Wilson Turner

Hsien-Chung Woo

Truman Joe

Wendy R Cartee

Murat Bog

Samuel Joseph Pullara, Iii

Mathias Kokot

Colby Barth

John C Scano

John Liddy

Jason P Poirier

Sudhir Krishnan

Javier Aviles Blanco

Raghavendra Mallya

Anand S Athreya

Activities within a network environment are monitored (e.g., using agents). At least a portion of the monitored activities are used to generate a logical graph model. The generated logical graph model is used to determine an anomaly. The detected anomaly is recorded and can be used to generate an alert.

Detecting anomalies in a network environment

In some embodiments, a data platform receives information associated with activities within a network environment, generates a logical graph based on the information, stores data representative of the logical graph in a database, receives, in response to a user interaction with an interface of the data platform, a request to filter the information, in response to the request generates a query using a graph-based schema, and performs the generated query against the database.

Graph-based query composition for monitoring an environment

Using graph-based models to identify anomalies in a network environment

In some embodiments, a request to filter information associated with activities within a network environment is received in response to a user interaction with a graph that comprises a plurality of nodes. At least one node included in the graph is associated with an activity within a network environment. As one example, the request to filter is triggered by a user interaction with a visual representation of at least a portion of the graph. As another example, the request to filter is triggered by a user interaction with a query field. In response to receiving the filter request, a query is generated based on a join using a query service.

Graph-based query composition

A request to filter information associated with activities within a network environment is received in response to a user interaction with a graph that comprises a plurality of nodes. At least one node included in the graph is associated with an activity within a network environment. As one example, the request to filter is triggered by a user interaction with a visual representation of at least a portion of the graph. As another example, the request to filter is triggered by a user interaction with a query field. In response to receiving the filter request, a query is generated based on an implicit join using a query service.

Extensible query interface for dynamic data compositions and filter applications

Using graph-based models to identify datacenter anomalies

A request to filter information associated with activities within a network environment is received. As one example, the request to filter is triggered by a user interaction with a graph. As another example, the request to filter is triggered by a user interaction with a query field. In response to receiving the filter request, a query is generated based on an implicit join using a query service.

Network (cloud) based customer premises equipment may receive, over a broadband access circuit, layer 2 traffic from an access device at a customer premises; provide dynamic host configuration protocol (DHCP) services for computing devices at the customer premises, the DHCP services providing Internet Protocol (IP) addresses to the computing devices at the customer premises; and provide network address translation (NAT) services for the computing devices at the customer premises.

Cloud based customer premises equipment

A network device may act as a proxy for a client requesting video from a server and may control the quality of the video requested from the server. The network device may detect a negotiation for a video stream, the negotiation including at least a first message from the client indicating a requested video quality by the client; and determine a maximum allowed video quality for the client. The network device may additionally determine whether the requested video quality by the client is greater than the maximum allowed video quality and modifying, when the requested video quality by the client is greater than the maximum allowed video quality, a first message to change the requested video quality to be equal to the maximum allowed video quality.

Video transcoding using a proxy device

A network router includes a set of interface cards to receive packets from a network, and a set of accounting modules to calculate flow statistics for the packets. The router further includes a control unit to adaptively update routing information in response to the calculated flow statistics, and to route the packets in accordance with the routing information. The control unit identifies potentially malicious packet flows for the received packets based on the flow statistics, and applies an intercept filter to intercept the packets of the identified packet flows. The control unit analyzes the intercepted packets in real-time to determine the presence of a network event, and updates the routing information based on the determination, e.g., by terminating routing for packets associated with malicious packet flows. In this manner, the router may adaptively respond to network events, such as network security violations.

Adaptive network router

A network device integrates accounting functionality for generation of flow statistics with packet intercept functionality to provide a comprehensive traffic analysis environment. The device comprises a set of network interface cards to receive packets from a network, and a set of accounting service cards to calculate flow statistics for the packets. The device further comprises a control unit to receive the network packets from the interface cards and distribute the packets to the set of accounting service cards. The accounting service card comprises an interface for insertion within a slot of a network device. Accounting service cards may be added to easily scale the network device to support higher bandwidth communication links, such as OC-3, OC-12, OC048 and higher rate links. Additional accounting service cards may be used for purposes of redundancy to support continuous, uninterrupted packet processing and accounting in the event of a card failure.

Network device having accounting service card

A service/device discovery protocol which allows a customer premise device (CPD) to automatically discover other CPDs sharing common service related characteristics, and techniques for self-configuration of the service are described. For example, when a new customer site or CPD is to be added to an existing shared service, the service discovery protocol allows a CPD at the new customer site to automatically discover the other customer sites and/or CPDs associated with the existing shared service. The self-configuration techniques allow the new CPD to automatically configure itself as a member of the shared service, and also allow the existing CPDs to update their service configuration information to include the new customer site and/or CPD.

Growing community of inventors

San Jose, CA, United States of America

Sanjay Kalra