Sap Se

Mcafee, Inc.

Vmware, Inc.

Shashank Mohan Jain

Tirumaleswar Reddy Konda

Himanshu Srivastava

Piyush Pramod Joshi

Harsha Ramamurthy Joshi

Mayank Tiwary

Dinesh Kumar

Srikanth Nalluri

Pritish Mishra

Suchin Chouta

Naveen Kumar Reddy Kandadi

Dattatraya Kulkarni

Meenakshi Sundaram P

Vinayak Jadhav

Abhishek Tripathi

Eric Donald Wuehler

Gaurav Srivastava

Soumik Biswas

Urmil Mahendra Parikh

Nishii Bharill

Gaurav Kumar Gupta

Subhro Bhattacharyya

Syed Anwar

Naveen Kandadi

Devanshi Saxena

Devika Mishra

Srinivasa Reddy Challa

An onboarding request is received from a user to utilize a recommendation service. The onboarding request contains personal data (including an onboarding user identifier and a serial number requesting a stated number of credits), encrypted with a commuting function C, along with clear text account details. A blind trust is established with the user, and the recommendation service signs the onboarding request with a signing function S and sends the signed onboarding request to the user to perform a blind onboarding of the user. A consumption request is then received (e.g., a call to get recommendations) from the user including a consumption user identifier and an approved credits document. The recommendation service can then update a user-item matrix that maps user identifiers with available items and transmit an item recommendation to the user, based on the user-item matrix, and expire the approved credits document by a consumption amount.

Recommendation service using blind signatures

A system and method are disclosed associated with a cloud computing environment. The system includes a tracing tool, coupled to a controller in the cloud computing environment, that captures sequences of events associated with the controller and a deployed workload. A detection engine may detect important event patterns in the sequences captured by the tracing tool using a PrefixSpan algorithm in connection with a specific controller action associated with the deployed workload. A neural network, trained with the detected important event patterns, may predict which important event patterns caused the controller to perform the specific action associated with the deployed workload.

Determining causality for cloud computing environment controller

There is disclosed in one example an enrollment over secure transport (EST)-capable gateway device, including: a hardware platform including a processor and a memory; a first network interface to communicatively couple to an external network, including an external DNS server; a second network interface to communicatively couple to a home network; a caching DNS server including a local DNS cache, and logic to provide DNS services to the home network; and an EST proxy to authenticate to a local endpoint on the home network, provision a DNS server certificate on the local endpoint, provision an authentication domain name (ADN) on the local endpoint, and provide encrypted domain name system (DNS) services to the local endpoint.

Provisioning of encrypted DNS services

A system may include a virtual machine, of a cloud computing environment, that executes a target application workload to be intercepted. A software defined anomaly detection engine (that is separate from the target application workload and that is also executing in the virtual machine) may intercept the target application workload. A computer processor of the software defined anomaly detection engine may intercept network traffic that is external to the virtual machine and associated with the target application workload. The software defined anomaly detection engine may then automatically execute an anomaly detection algorithm in substantially real time on the intercepted network traffic to generate an intercept result. An anomaly detection alert signal may be transmitted based on a comparison of the intercept result and an anomaly threshold value.

Software defined anomaly detection for workloads

Methods, apparatus, systems, and articles of manufacture are disclosed to improve the inspection of network data flows. An example apparatus includes memory, and processor circuitry to execute machine readable instructions to at least identify network domains accessible by at least one client device in a geographic location of interest, associate the identified network domains with Autonomous System Numbers (ASNs), create a list of respective ones of the ASNs that include a non-malicious status corresponding to Internet protocol (IP) addresses associated with respective ones of the identified network domains, and in response to receiving a reputation request corresponding to a destination IP address, cause inspection of a data flow to be skipped when the destination IP address is associated with the list of non-malicious ASNs.

Methods, systems, articles of manufacture and apparatus to reduce computation corresponding to inspection of non-malicious data flows

There is disclosed in an example a gateway device, including a hardware computing platform, and a secure domain name system (DNS) engine having circuitry and stored instructions to-program the circuitry, the secure DNS engine to communicatively couple to an endpoint via a local network, begin a secure DNS transaction with the endpoint, determine whether the endpoint supports delegated credentials, and after determining that the endpoint supports delegated credentials, establish a secure DNS session with the endpoint using a delegated credential.

Secure DNS using delegated credentials and keyless SSL

A first forwarding VM may execute in a first availability zone and have a first IP address. Similarly, a second forwarding VM may execute in a second availability zone and have a second IP address. The first and second IP addresses may be recorded with a cloud DNS web service of a cloud provider such that both receive requests from applications directed to a particular DNS name acting as a single endpoint. A service cluster may include a master VM node and a standby VM node. An IPtable in each forwarding VM may forward a request having a port value to a cluster port value associated with the master VM node. Upon a failure of the master VM node, the current standby VM node may be promoted to execute in master mode and the IPtables may be updated to now forward requests having the port value to a cluster port value associated with the newly promoted master VM node (which was previously the standby VM node).

Dynamic, distributed, and scalable single endpoint solution for a service in cloud platform

Methods, apparatus, systems, and articles of manufacture are disclosed that determine a dynamic password update notification interval based on a breach risk classification and an automatic password update mechanism of an online service with which a user has an account. The disclosed methods, apparatus, systems, and articles of manufacture generate a password update suggestion and/or an automatic password update for the user at the dynamic password update notification interval determined by the processor circuitry.

Methods and apparatus to generate dynamic password update notifications

Methods, apparatus, systems and articles of manufacture are disclosed to analyze telemetry data of a network device for malicious activity. An example apparatus includes an interface to obtain first telemetry data, a rules generator to, using the first telemetry data, generate a global block list using a machine learning model, the machine learning model generated based on a device specific block list and a device specific allow list, and a model manager to transmit the global block list to a gateway, the gateway to facilitate on-path classification of second telemetry data.

Methods and apparatus to analyze telemetry data of a network device for malicious activity

A system for enterprise analytics may include a Machine Learning ('ML') model data store containing at least one generic ML model and a fine-tuning data store containing prior natural language user requests and associated enterprise database queries generated by analysts. The system may also include an enterprise data store containing enterprise business data. A transformation framework may retrieve the generic ML model and fine-tune the model using the prior user requests and associated enterprise database queries to create a fine-tuned ML model. The framework may then receive a new natural language request from a user and use the fine-tuned ML model and new natural language request to automatically create a new enterprise analytics query. The new enterprise analytics query may then be executed to fetch enterprise analytics data from the enterprise data store. In some embodiments, an analytics chart may be automatically created and provided to the user.

Transforming natural language request into enterprise analytics query using fine-tuned machine learning model

Methods and systems may be associated with a cloud computing environment. A proxy platform data store may contain node data associated with nodes of the cloud computing environment. Each node might, for example, store multi-party computation information. A proxy platform, able to access the proxy platform data store, may detect that a first node needs to access a cloud application secret key and determine, based on information in the proxy platform data store, a set of nodes associated with the secret key that the first node needs to access. The proxy platform may then use a multi-party computation algorithm and information received from the set of nodes to generate the secret key.

Protecting cloud application secret key with multi-party computation algorithm

A system may include a nested probabilistic data structure that contains nested tables, each table having electronic records associated with different hash functions. A data analytics engine may receive information about a detected action, including action characteristics. In response to the detected action, insertions are executed into the nested probabilistic data structure at multiple levels based on the action characteristics (each insertion incrementing an entry in the data structure selected using the hash functions). The engine then continues to monitor for detected actions. Upon receipt of a query associated with the monitored action (including a query type), a key and level of nesting associated with the query is determined based on the query type. The hash functions are executed on the determined key to retrieve a value from each electronic record in an appropriate nested table, and a minimum of the retrieved values is output in response to the query.

Framework for nested probabilistic data structures as a service for big data analytics

There is disclosed in an example, a gateway apparatus, including a hardware platform having a processor and a memory; a wireless network interface; and instructions encoded within the memory to instruct the processor to: provide a first virtual access point (VAP) secured by an IEEE 802.1x extensible authentication protocol (EAP) enterprise security method; provide a second VAP secured by a WiFi protected access pre-shared key (WPA-PSK) method; onboard a device, comprising determining whether the device supports the EAP method, and enrolling the device with the EAP method if the device supports the EAP method; and if the device does not support the EAP method, enrolling the device with the WPA-PSK method.

Wireless access point with multiple security modes

There is disclosed in one example a network gateway device, including: a hardware platform including a processor and a memory; a network interface, including network interface hardware; and instructions encoded within the memory to instruct the processor to: receive from an endpoint device, via the network interface, a signed security posture data structure, the signed security posture data structure including information about a security posture of the endpoint device; cryptographically verify the signed security posture data structure; and according to the signed security posture data structure, assign a network security policy to the endpoint device.

Growing community of inventors

Karnataka, India

Shashank Mohan Jain