Zscaler, Inc.

Sushil Pangeni

Chakkaravarthy Periyasamy Balaiah

Srikanth Devarajan

Kailash Kailash

Amit Sinha

Vladimir Stepanenko

Kumar Gaurav

Manoj Apte

Ravinder Verma

Sridhar Narasimhan

Samuel John Crank

Sandeep Kamath

Ajit Singh

Chenglong Zheng

Pratap Ramachandra

Abhishek Bathla

Sandeep Kamath Voderbet

Satish Kalipatnapu

Lakshmaiah Regoti

Khaireddine Mazboudi

Naresh Kumar Povlavaram Munirathnam

Shashi Kiran Meda Ravi

Amber Wu

Techniques for deep tracing of one or more users via a cloud-based system include receiving a request from an administrator to actively troubleshoot a user; causing a user device associated with the user to create a deep tracing session based on the request; assisting the user device in performing one or more traces of a plurality of traces to a destination; receiving results from any of the plurality of traces and results from metrics collected at the user device; and displaying a network map between the user device and the destination.

Deep tracing of user experience

Systems and methods implemented in a node in a cloud-based system include operating a first cloud service that is implemented as a monolith system; operating a RESTful framework (Representational State Transfer web service) embedded in the cloud node; and operating one or more applications for one or more cloud services utilizing the RESTful framework, wherein the one or more applications are microservices. The RESTful framework utilizes Hypertext Transfer Protocol (HTTP) methods.

Highly scalable RESTful framework

Systems and methods include connecting to and authenticating a set of user devices of a plurality of user devices; determining an election of a subset of user devices of the set of user devices, wherein the election determines which user devices perform metric collection; providing any of policy and configuration to the plurality of user devices including election information; and receiving metrics based on measurements at the subset of user devices of user devices according to corresponding policy and configuration.

Distributed adaptive probability for population selection of remote devices in a network

Cloud-based Intrusion Prevention Systems (IPS) include receiving traffic associated with a user of a plurality of users, wherein each user is associated with a customer of a plurality of customers for a cloud-based security system, and wherein the traffic is between the user and the Internet; analyzing the traffic based on a set of signatures including stream-based signatures and security patterns; blocking the traffic responsive to a match of a signature of the set of signatures; and performing one or more of providing an alert based on the blocking and updating a log based on the blocking.

Cloud-based intrusion prevention system

System and methods implemented in a node in a cloud-based security system include obtaining a plurality of rules each define via a rule syntax that includes a rule header and rule options, wherein each rule header is used to for a rule database lookup, and each rule options is used to specify details about the associated rule; monitoring data associated with a user of the cloud-based security system; analyzing the data with the plurality of rules; and performing one or more security functions on the data based on triggering of a rule of the plurality of rules.

Stream scanner for identifying signature matches

Systems and methods of detecting Domain Name System (DNS) tunnels for monitoring thereof include obtaining data related to DNS traffic between DNS nameservers and clients; determining a score for each DNS nameserver based on the data to characterize DNS queries over a period of time for each DNS nameserver, wherein the score incorporates all DNS queries associated with the associated DNS nameserver over the period of time; determining one or more DNS nameservers likely operating DNS tunnels based on the score; and performing one or more actions on the one or more DNS nameservers related to the DNS tunnels.

Systems and methods to detect and monitor DNS tunneling

A computer-implemented method and system for querying aggregates in a database include maintaining aggregates based on a dimension in the database with at least two grain sizes; receiving a query of the aggregates for a defined range of the dimension; finding a start and an end for a read operation for a larger grain size of the at least two grain sizes of the aggregates for the defined range; reading a first set from the start to the end in the database of the larger grain size of the at least two grain sizes of the aggregates; reading a second set comprising a smaller grain size of the at least two grain sizes of the aggregates based on the defined range and the start and the end; and adjusting the first set with the second set.

Optimized query processing using aggregates with varying grain sizes

A computer-implemented method for querying a data source using an optimized exclusion filter expression created from a full filter expression is described. The method includes receiving one or more queries defined by the full filter expression, wherein the one or more queries are for obtaining an output from the data source; performing a reduction on the full filter expression to determine the optimized exclusion filter expression; applying the optimized exclusion filter expression in the data source to exclude data; and applying the full filter expression to data not excluded by the optimized exclusion filter expression.

Optimized exclusion filters for multistage filter processing in queries

Systems and methods of integrating log data from a cloud system with an internal management system are described, wherein the cloud system is located externally from a secure network which contains the internal management system. The systems and methods include receiving log data from a cloud system through a secure connection between the secure network and the cloud system; buffering the received log data; filtering the buffered, received log data; and transmitting the filtered, buffered, received log data to the internal management system in a format associated with the internal management system.

Systems and methods for integrating cloud services with information management systems

Systems and methods for managing sparsely updated counters in memory include, for a given interval of time and N counters associated with the given interval, managing a first set of the N counters in a first level of storage in the memory, wherein the first level of storage utilizes a hash table to store a counter identifier and a value for each of the first set; and responsive to filling up the first level of storage for a given user in the given interval, managing the first set and a second set of the N counters in a second level of storage in the memory, wherein the set utilizes memory buckets to incrementally store the first set and the second set.

Systems and methods for a memory model for sparsely updated statistics

A system includes an enterprise network including an internal management system communicatively coupled thereon, the enterprise network includes security and the internal management system is disposed behind the security; a cloud system external to the enterprise network and communicatively coupled to the enterprise network, at least one user associated with the enterprise network is configured to communicate through the cloud system for cloud-based services, and the cloud system is configured to log data associated with the at least one user for the cloud-based services; and an external service bridge located in the enterprise network behind the security, the external service bridge is configured to securely communicate with the cloud system to receive the log data and to communicate with the internal management system to provide the log data thereto.

Growing community of inventors

Kathmandu, Nepal

Sushil Pangeni