Cisco Technology, Inc.

Zscaler, Inc.

Shashank Gupta

Narinder Paul

Howie Xu

Rex Shang

Changsha Ma

Praveen Jain

Parnit Sainion

Kalyan Ghosh

Deepen Desai

Dianhuan Lin

Douglas A Koch

Tushar Desai

Tarun Dewan

Visvanathan Thothathri

Bharath Kumar

Bharath Meesala

Uday Pratap Singh

Naveen Selvan

Nirmal Singh

Rakshitha Hedge

Murali Basavaiah

Ramsundar Janakiraman

Sachin Jain

John Andrew Fingerhut

Ranganathan Rajagopalan

Kalyan K Ghosh

Jain Praveen

Systems and methods of sandboxing a file include responsive to receiving a file associated with a user, obtaining policy for the user; analyzing the file with a machine learning model; and based on a combination of the policy for the user and a verdict of the machine learning model, one of quarantining the file for analysis in a sandbox and allowing the file to the user. The present disclosure presents a smart quarantine with a goal of minimizing the number of files quarantined, the number of malicious files passed through to an end user, and a number of files scanned by a sandbox.

Utilizing machine learning for smart quarantining of potentially malicious files

Systems and methods include performing inline monitoring of production traffic between users, the Internet, and cloud services via a cloud-based system; utilizing a trained machine learning model to inspect static properties of files in the production traffic; and classifying the traffic as one of malicious or benign based on the trained machine learning model.

Utilizing machine learning to detect malicious executable files efficiently and effectively

Systems and methods include receiving a trained machine learning model that has been processed with training information removed therefrom, wherein the training information is utilized in training of the trained machine learning model; monitoring traffic, inline at the node, including processing the traffic with the trained machine learning model; obtaining a verdict on the traffic based on the trained machine learning model; and performing an action on the traffic based on the verdict.

Machine learning model abstraction layer for runtime efficiency

Systems and methods include determining a plurality of features associated with executable files, wherein the plurality of features are each based on static properties in predefined structure of the executable files; obtaining training data that includes samples of benign executable files and malicious executable files; extracting the plurality of features from the training data; and utilizing the extracted plurality of features to train a machine learning model to detect malicious executable files.

Utilizing Machine Learning to detect malicious executable files efficiently and effectively

Systems and methods include obtaining a file associated with a user for processing; utilizing a combination of policy for the user and machine learning to determine whether to i) quarantine the file and scan the file in a sandbox, ii) allow the file to the user and scan the file in the sandbox, and iii) allow the file to the user without the scan; responsive to the quarantine of the file and the sandbox determining the file is malicious, blocking the file; and, responsive to the quarantine of the file and the sandbox determining the file is benign, allowing the file.

Systems and methods include training a machine learning model with data for identifying features in monitored traffic in a network; analyzing the trained machine learning model to identify information overhead therein, wherein the information overhead is utilized in part for the training; removing the information overhead in the machine learning model; and providing the machine learning model for runtime use for identifying the features in the monitored traffic, with the removed information overhead from the machine learning model.

N_Ports and F_Ports are provided with logic allowing designation of multiple virtual interfaces on a single host bus adaptor or other Fiber Channel interface, one virtual interface for each VSAN operating on the node interface. Node ports with this additional functionality are referred to as trunking N_Ports or TN_Ports. These ports have a functional design allowing creation of the multiple virtual interfaces as appropriate for the application at hand. This port design also includes logic for communicating with a peer fabric port to initialize and modify the configuration of the virtual interfaces on the TN_Port. A corresponding functional design and communication logic is provided for fabric ports, referred to herein as trunking F_Ports or TF_Ports.

Trunking for fabric ports in Fibre channel switches and attached devices

Methods and devices are provided for detecting whether peer ports interconnecting two network devices can perform a novel protocol called Exchange Peer Parameters ('EPP'). If the peer ports are so configured to perform EPP, EPP services are exchanged between the peer ports. In a first phase, information is exchanged about peer port configurations of interest. In a second phase, the results of the exchange of information are applied to hardware and/or software of the respective ports, as needed.

Methods and devices for exchanging peer parameters between network devices

An interface is operable to receive an element for deletion from a bloom filter. The bloom filter includes multiple hash functions and an array. A processor is operable to generate hash function output values for the element using the hash functions. The hash function output values correspond to indices identifying bits in the array. A memory is operable to maintain supplemental data structure entries. The supplemental data structure has entries associated with the indices. The processor is operable to modify the supplemental data structure entries to delete the element from the bloom filter.

Enhanced bloom filters

Trunking for fabric ports in fibre channel switches and attached devices

A port shutdown protocol coordinates among various components involved in the process of administratively bringing down a link at both ends of a link connecting two switches. Execution of the protocol avoids or reduces frame drops and/or reordering. In this protocol, peer switches perform various actions when bringing down an ISL in a synchronized manner. In one implementation, this protocol uses the Exchange Peer Protocol (EPP) as the underlying transport to carry the port shutdown protocol frames.

Growing community of inventors

San Jose, CA, United States of America

Shashank Gupta