Cisco Technology, Inc.

Amazon Technologies, Inc.

Xg Technology, Inc.

Shih-Chun Chang

Navindra Yadav

Abhishek Ranjan Singh

Hai Trong Vu

Shashidhar R Gandham

Anubhav Gupta

Rohit Chandra Prasad

Jackson Ngoc Ki Pang

Khawar Deen

Varun Sagar Malhotra

Ali Parandehgheibi

Hoang Viet Nguyen

Ashutosh Kulshreshtha

Shashi Gandham

Sunil Gupta

Omid Madani

Michael Standish Watts

Roberto Fernando Spadaro

Vimalkumar Jeyakumar

Supreeth Hosur Nagesh Rao

Ellen Christine Scheib

Bharathwaj Sankara Viswanathan

Praneeth Vallem

Ravi Prasad

Fnu Rachita Agasthy

Duane Thomas Barlow

Vimal Jeyakumar

Andy Sloane

Kai Chang

Edward James Gayles

Xin Yi Liu

Paul Mach

Rachita Agasthy

Allen Chen

Varadarajan Gopalakrishnan

Sreekant Nair

Thanh Trung Ngo

Xuan Loc Bui

Xiaofei Guo

Duan Tran

Andrew Jay Roths

In Chul Hyun

Mohammadreza Alizadeh Attar

Menashe Haskin

Subram Narasimhan

David George Butler

Andrew David Price

James David Meyers

Arvind Thiagarajan

Amit Shukla

John Lawrence Miller

Yi Zhu

Daniel Christopher Bay

Varada Gopalakrishnan

Omar FawazHashim Zakaria

Mark Wodrich

Vlad Troyanker

Vaishali Palkar

Karthikeya V Muppalla

Thanh Nhan Nguyen

Sam Bowen

Siddhardha Garige

Sunil Kumar Gupta

Systems, methods, and computer-readable media for updating configurations in sensors deployed in multi-layer virtualized environments. In some examples, a system can track information of sensors and collectors in the network. In response to determining that a specific collector becomes unavailable (e.g., the specific collector is down, offline or becomes unsupported), the system can determine affected sensors corresponding to the specific collector, determine a new collector among active collectors of the network for each of the affected sensors, and dynamically update configuration and settings of the affected sensors to maintain proper collector-to-sensor mappings and other settings on the affected sensors.

Auto update of sensor configuration

The disclosed technology relates to a network agent for reporting to a network policy system. A network agent includes an agent enforcer and an agent controller. The agent enforcer is configured to implementing network policies on the system, access data associated with the implementation of the network policies on the system, and transmit, via an interprocess communication, the data to the agent controller. The agent controller is configured to generate a report including the data and transmit the report to a network policy system.

Network agent for reporting to a network policy system

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

Unique ID generation for sensors

Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Technologies for managing compromised sensors in virtualized environments

A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.

System and method of detecting packet loss in a distributed sensor-collector architecture

Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Technologies for annotating process and user information for network flows

A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

System and method of detecting whether a source of a packet flow transmits packets which bypass an operating system stack

An application and network analytics platform can capture telemetry from servers and network devices operating within a network. The application and network analytics platform can determine an application dependency map (ADM) for an application executing in the network. Using the ADM, the application and network analytics platform can resolve flows into flowlets of various granularities, and determine baseline metrics for the flowlets. The baseline metrics can include transmission times, processing times, and/or data sizes for the flowlets. The application and network analytics platform can compare new flowlets against the baselines to assess availability, load, latency, and other performance metrics for the application. In some implementations, the application and network analytics platform can automate remediation of unavailability, load, latency, and other application performance issues.

Application performance monitoring and management platform with anomalous flowlet resolution

Systems, methods, and computer-readable media for gathering network intrusion counter-intelligence. A system can maintain a decoy network environment at one or more machines. The system can identify a malicious user accessing network services through the network environment. Further, the system can receive network service access requests from the user at one or more machines in the network environment and subsequently direct the network service access requests from the malicious user to the decoy network environment based on an identification of the malicious user. The network services access requests can be satisfied with network service access responses generated in the decoy network environment. Subsequently, the system can maintain malicious user analytics based on the network service access requests of the malicious user that are directed to the decoy network environment.

Network intrusion counter-intelligence

Systems, methods, and non-transitory computer-readable storage media are disclosed for detecting vulnerabilities in real-time during execution of a process or an application. In one example, a device may have one or more memories storing computer-readable instructions and one or more processors configured to execute the computer-readable instructions to obtain real-time process information associated with a process executing in an endpoint. The device can then determine package information for a package associated with the process based on the process information. The device can then identify at least one vulnerability associated with the package information using a database of vulnerabilities stored on a backend component of the network. The backend component may have a database of vulnerabilities for packages.

Systems and methods for detecting vulnerabilities in network processes during runtime

Growing community of inventors

San Jose, CA, United States of America

Shih-Chun Chang