Cisco Technology, Inc.

Thomas Szigeti

David John Zacks

Jerome Henry

Walter Theodore Hulick, Jr

Robert E Barton

Carlos M Pignataro

Robert Edgar Barton

Nagendra Kumar Nainar

Akram Ismail Sheriff

Frank Michaud

Guy Keinan

Peter Geoffrey Jones

Darryl E Sladden

Walter Hulick

Malcolm Muir Smith

Maik Guenter Seewald

Anoop Vetteth

Brian C Powell

Roland Arthur Saville

Hans F Ashlock

Vikram Vikas Pendharkar

Alan Robert Lynn

Ruben Gerald Lobo

Rachana A Soni

Stefano Giorcelli

Laurent Jean Charles Hausermann

Hemamalini Subash

Daniel R Behrens

Zsolt Varga

Hanoch Haim

Shannon McFarland

Peter Turi

Gonzalo A Salgueiro

Sudhir Kumar Jain

Vincent E Parla

Sebastian Jeuk

David Tedaldi

Andrew Zawadowskiy

Ashok Krishnaji Moghe

Hazim Hashim Dahir

Prakash Kaligotla

Tal Maoz

David Hanes

Jeff Apcar

Andrew Pletcher

Jon Michael Snyder

Daniel Eckstein

Prapanch Ramamoorthy

Shawn Michael Wargo

Mark Montanez

Gangadharan Byju Pulanikkal

Oliver Boehmer

Vikram Vikas Pendhar

Tzahi Peleg

Praveen T Chandra

Ted Hulick

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining telemetry representing execution of a process on a computing system and accessing a learned control flow diagram graph for the process. A transfer of an instruction pointer is determined based on the telemetry and a validity of the transfer is determined based on the learned control flow directed graph. If invalid, then an action to terminate the process is determined, otherwise the action may be allowed to execute when valid.

Control flow integrity enforcement for applications running on platforms

A method of application program interface (API) endpoint host redirection may include with an intelligent domain name system (DNS) engine (IDE) associated with a containerized service within a pod of a mesh network, snooping a DNS query from the containerized service, identifying within the DNS query, an API endpoint name, snooping a DNS response associated with the DNS query, identifying an Internet protocol (IP) address associated with the API endpoint name, transmitting the API endpoint name and the IP address to a controller, receiving, from the controller, a list of safe API endpoint hosts with no known security vulnerabilities based on security data obtained from at least one security service, caching, at the IDE, the list of safe API endpoint hosts including safe IP addresses, and transmitting to the containerized service, via the IDE, IP addresses of safe API endpoint hosts within the list of safe API endpoint hosts.

Dynamic and transparent application program interface (API) endpoint host redirection

In one embodiment, a device obtains testing parameters used by a plurality of agents in a network to perform testing with respect to an online application. The device identifies overlapping parameters among the testing parameters and generates a consolidated set of testing parameters for the overlapping parameters. The device configures the plurality of agents such that a singular testing agent performs testing with respect to the online application using the consolidated set of testing parameters instead of multiple testing agents performing testing with respect to the online application using the overlapping parameters.

Cloud native observability migration and assessment

Techniques are described herein for dynamic service extension to provide risk mitigation upon detecting a threat. In embodiments, such techniques may be performed by a service provider platform and may comprise receiving information about a security threat, identifying one or more components susceptible to the security threat, determining, based on a software bill of materials, at least one data flow that includes a point of delivery (pod) associated with the one or more components, identifying at least one additional service determined to mitigate the security threat, and implementing the at least one additional service in relation to the at least one data flow.

Dynamic security service extension based on software bill of materials

This disclosure describes techniques for providing information associated with an inter-cluster segment. For instance, system(s) may determine dependencies for first services associated with a first cluster and second dependencies for second services associated with a second cluster. The system(s) may then determine information for interconnections between the first cluster and the second cluster. The information may include at least dependencies for third services included in the inter-cluster segment and/or performance information for the third services. The system(s) may then generate a user interface that includes the first dependencies for the first services, the second dependencies for the second services, and the information for the inter-cluster segment. This way, a user is able to use the user interface to identify both problems occurring within the clusters and/or problems that are caused by the third services in the inter-cluster segment.

Techniques for providing inter-cluster dependencies

Methods are provided in which a domain name system (DNS) service obtains a lookup request for information about a source of a traffic flow being transmitted to a network resource external of a service cluster and performs, based on the lookup request, a lookup operation for a microservice that is the source of the traffic flow, among a plurality of microservices of the service cluster registered with the DNS service. The methods further include providing information about the microservice based on the lookup operation. The information includes at least a name of the microservice for visibility of the microservice external of the service cluster.

Microservice visibility and control

This disclosure describes techniques for redirecting data traffic based on endpoint risk. An example method includes determining a risk associated with a first endpoint connected to a redirection point; determining that the risk exceeds a threshold; and based on determining that the risk exceeds the threshold, causing the redirection point to direct data traffic to a second endpoint and to refrain from directing the data traffic to the first endpoint.

Redirecting data traffic to endpoints based on risk

In one embodiment, an agent executed by a device intercepts webpage code for a website sent from an application server to a client of the website. The agent identifies a portion of the webpage code as being used for webpage analytics. The agent forms modified webpage code by disabling the portion of the webpage code, based on one or more performance metrics associated with the website. The agent sends the modified webpage code to the client of the website.

Dynamic web content management system

Provided herein are techniques to facilitate enhanced cloud access security broker (CASB) functionality via in-band application observability in which a CASB can be implemented in-line between the client device and an embedded application security service. In one instance, a method may include, obtaining, by a CASB from a client device, a first message for an application transaction involving an application operating via the client device. The first message can be augmented to include first security metadata and can be forwarded to trigger one or more actions by an embedded application security service associated with the application. The CASB may obtain a second message from the embedded application security service that includes second security metadata, and one or more actions can be triggered at the CASB based, at least in part, on the second security metadata included in the second message.

Enhanced cloud access security broker functionality utilizing in-band application observability

Method for application control and Quality of Service (QoS) handling may be provided. A request may be received for scheduling a communication between an Access Point (AP) and a user device for sending data of an application. It may be determined that the request does not comprise network characteristics of the application. In response to determining that the request does not comprise the network characteristics of the application, the network characteristics may be requested from a Wireless Local Area Network (WLAN) controller. The network characteristics may be received from the WLAN controller. Schedules for the application may be determined based on the network characteristics. The schedules may be enabled.

Method for application control and adaptive quality of service (QoS) handling

In an embodiment, a device controller determines a deliberate change to be made within a network, and generates a profile of a behavioral update that an analytics engine should expect to see based on the deliberate change. The device controller then transmits, to the analytics engine, the profile of the behavioral update to cause the analytics engine to proactively expect the behavioral update in response to the deliberate change.

Intelligent closed-loop device profiling for proactive behavioral expectations

In one embodiment, a service determines authentication credentials for a web application transaction. The service determines one or more performance metrics regarding the web application transaction. The service generates an enhanced web token comprising the one or more performance metrics regarding the web application transaction. The service sends the enhanced web token and the authentication credentials along a path of the web application transaction, the path including one or more services configured to use the one or more performance metrics sent in addition to the authentication credentials to process the web application transaction.

Web tokens for enhanced microservice observability

According to one or more embodiments of the disclosure, the techniques herein are directed toward a dynamic transaction-aware web application authentication using call intercepts. In one embodiment, a method comprises: intercepting, by a monitoring process, calls made for transactions within an executing application; determining, by the monitoring process, whether a particular intercepted call triggers an enhanced user authentication requirement for a particular transaction; initiating, by the monitoring process in response to the particular intercepted call triggering the enhanced user authentication requirement, a corresponding challenge to adequately authenticate a user for the particular transaction; and allowing, by the monitoring process, the particular intercepted call to proceed for the particular transaction in response to an adequately authenticated user for the particular transaction.

Dynamic transaction-aware web application authentication using call intercepts

Methods are provided to perform a name resolution triggered monitoring agent selection for full stack observability. The methods involve obtaining a name resolution request for an enterprise service to be accessed by an endpoint device. A plurality of service instances are configured to provide the enterprise service. The methods further involve determining, based on the name resolution request, a monitoring agent from a plurality of monitoring agents of a monitoring service that monitors performance of the enterprise service and selecting a service instance, from the plurality of service instances, that is associated with the monitoring agent in a name resolution record. The methods further involve providing, to the endpoint device, location information for accessing the service instance and provisioning the monitoring agent to monitor the performance of the enterprise service executed by the service instance for the endpoint device.

Name resolution triggered monitoring agent selection

Growing community of inventors

Vancouver, Canada

Thomas Szigeti