Ca, Inc.

Acalvio Technologies, Inc.

Sreenivas Gukal

Rammohan Varadarajan

Johnson L Wu

Sanjay Vyas

Rajendra Arcot Gopalakrishna

Abhishek Singh

Kiran Jyotsna Achyutuni

Vaishali Palkar

Linh Do

Provided are systems, methods, and computer-program products for providing network deceptions using a network tunnel. In various implementations, a network device on a first network can be configured as a projection point. A projection point can be configured as one endpoint of a network tunnel. The other end of the network tunnel can terminate at a deception farm. The deception farm can host a second network, where the second network includes network devices configured as deception mechanisms. By assigning a deception mechanism a network address from the first network, the network address and the network tunnel enable the deception mechanism to appear as a node in the first network.

Tunneling for network deceptions

Provided are methods, network devices, and computer-program products for dynamically configuring a deception mechanism in response to network traffic from a possible network threat. In various implementations, a network deception system can receive a packet from a network. The network deception system can determine an intent associated with the packet by examining the contents of the packet. The network deception system can further configure a deception mechanism to respond to the intent, for example with the appropriate network communications, software or hardware configuration, and/or data.

Responsive deception mechanisms

Provided are methods, including computer-implemented methods or methods implemented by a network device, devices including network devices, and computer-program products for providing dynamic security mechanisms for mixed networks. A mixed network can include an IoT type device and a non-IoT device. Using a configuration of the network, a deception device type can be determined. A second network that includes a deception mechanism corresponding to the deception device type can be determined. A network tunnel from the mixed network to the second network can be configured. The network tunnel enables the deception mechanism to be a node on the mixed network, such that the deception mechanism can be accessed from the mixed network. The deception mechanism can be used to monitor the mixed network for network abnormalities. An action can be taken when the deception mechanism detects an abnormality.

Dynamic security mechanisms for mixed networks

A log record from a host machine node includes an invariant string and a term. A template identifier is selected, from among template identifiers within a template repository, for a template string matching the invariant string. A sampling count threshold is selected from among a set of sampling count thresholds based on the template identifier and the term. A template-term count is obtained based on a number of earlier log records that were received since the count was reset and have a template identifier and a term that match the template identifier and the term of the log record. Based on the template-term count satisfying the sampling count threshold, an index entry is generated in a sampled log records index based on the log record and the template-term count is reset to a defined value. Based on the template-term count not satisfying the sampling count threshold, the template-term count is incremented.

Stratified sampling of log records for approximate full-text search

Provided are methods, network devices, and computer-program products for targeted threat intelligence using a high-interaction network. In some implementations, a network device in a network may receive suspect network traffic. The suspect network traffic may include network traffic identified as potentially causing harm to the network. The network device may determine that the suspect traffic is associated with an unknown threat. The network device may further analyze the suspect network traffic using a high-interaction network. In various implementations, the high-interaction network may be configured to emulate at least a part of the network. In various implementations, analyzing the suspect network traffic may include determining a behavior of the suspect network traffic in the high-interaction network. The network device may further generate indicators, where the indicators may describe the suspect network traffic. In various implementations, the indicators facilitate analysis of a network's susceptibility to the unknown threat.

Using high-interaction networks for targeted threat intelligence

An application analysis computer receives reports from user terminals which contain application performance metrics and dimensions having values characterizing the applications and the user terminals. Statistics for each different one of the performance metrics across the reports are generated for repeating time intervals. One of the statistics that has changed between two of the time intervals by an amount that satisfies a defined rule is identified, and the associated performance metric is selected for analysis. For each combination of a different one of the dimensions and a different one of the values occurring for the dimension, a statistic is generated for the selected performance metric associated with the combination, and a counter is incremented that tracks a number of occurrences of the combination among the reports. Sets of the statistic and the counter for particular ones of the combinations that satisfy an action rule are identified.

Monitoring user terminal applications using performance statistics for combinations of different reported characteristic dimensions and values

A method by a computer includes, for each of a plurality of log records received as part of a log stream from a host machine node, identifying a template identifier within a template repository for a template string matching an invariant string of the log record, and identifying an attribute identifier in an attribute repository for an attribute string matching a variant string of the log record. The log records are partitioned into batches. Each of the batches are defined by a data structure that includes the template identifier and the attribute identifier for each of the log records within the batch. The data structures for each of the batches are stored into a log repository.

Batch processed data structures in a log repository referencing a template repository and an attribute repository

Provided are methods, network devices, and computer-program products for a network deception system. The network deception system can engage a network threat with a deception mechanism, and dynamically escalating the deception to maintain the engagement. The system can include super-low, low, and high-interaction deceptions. The super-low deceptions can respond to requests for address information, and requires few computing resources. When network traffic directed to the super-low deception requires a more complex response, the system can initiate a low-interaction deception. The low-interaction deception can emulate multiple devices, which can give the low-interaction deception away as a deception. Hence, when the network traffic includes an attempted connection, the system can initiate a high-interaction deception. The high-interaction more closely emulates a network device, and can be more difficult to identify as a deception. The high-interaction deception can fully engage a network threat, and can be initiated only as needed.

Threat engagement and deception escalation

A computer partitions a log stream into records having defined intervals. For each of the records, the computer selects a template from among a set of templates in a templates index repository based on an identifier for the record being associated in the templates index repository with the template, identifies an attribute contained in the record based on the template, and stores the attribute associated with an identifier for the record and an identifier for the template in an attributes index repository. The attributes index repository and the templates index repository are used to retrieve records responsive to search queries.

Indexing and searching log records using templates index and attributes index

Provided are systems, methods, and computer-program products for using deceptions to detect network scans. In various implementations, a network device, configured as a decoy network device can be configured to determine a particular network address. The network device can determine that the particular network address is unassigned. The network device can configure itself with the particular network address, wherein the network device uses the particular network address to monitor network activity for a network scan. The network device can receive a packet addressed to the particular network address. The network device can determine that received packet is associated with a scan of the network, including associating the received packet with other packets in the monitored network activity. The network device can configure one or more security settings for the network when the received packet is determined to be associated with a scan of the network.

Deception to detect network scans

Provided are systems, methods, and computer-program products for providing network deceptions using a network tunnel. In various implementations, a network device on a first network can be configured as a projection point. A projection point can be configured as one endpoint of a network tunnel. The other end of the network tunnel can terminate at a deception center. The deception center can host a second network, where the second network includes network devices configured as deception mechanisms. By assigning a deception mechanism a network address from the first network, the network address and the network tunnel enable the deception mechanism to appear as a node in the first network.

A method by a computer includes receiving a search query from a user equipment, where the search query defines a logical combination of terms to be searched within a defined interval of records of a log stream. An estimate is generated for the number of occurrences of the logical combination of terms in the defined interval of records. A message containing the estimate for the number of occurrences of the logical combination of terms in the defined interval of records is communicated toward the user equipment.

Estimating full text search results of log records

A log record from a host machine node includes terms. Frequency of occurrence of the terms across a stream of log records is determined. Based on the frequency satisfying a threshold, a Bloom filter vector is selected from among a plurality of Bloom filter vectors based on the frequency, the Bloom filter vector is updated based on the terms, and an identifier for the log record is stored with an association to the Bloom filter vector. In contrast, based on the frequency of occurrence not satisfying the defined frequency range, a type identifier is identified based on the terms, a Bloom filter vector is selected from among the plurality of Bloom filter vectors based on the type identifier, the Bloom filter vector is updated based on the terms, and an identifier for the log record is stored with an association to the Bloom filter vector.

Partitioning log records based on term frequency and type for selective skipping during full-text searching

A method by a log stream analysis computer includes identifying records of log streams within a log repository containing a defined term. The log streams are generated by respective software sources executed by the host nodes. Similarity values are determined to indicate similarity between content of the records containing the defined term. A term node is generated to contain a data structure that identifies the defined term and lists identities of the records and corresponding ones of the similarity values. Related log stream analysis computers are disclosed.

Growing community of inventors

Santa Clara, CA, United States of America

Sreenivas Gukal