Ncircle Network Security, Inc.

Cisco Technology, Inc.

Tripwire, Inc.

Timothy David Keanini

Brian Buchanan

Oliver Lavery

David J Meltzer

Alexander L Quilter

John S Flowers

Martin A Quiroga

David A McGrew

Akram Ismail Sheriff

Sunil Amin

Matthew Scott Robertson

Ellie Marie Daw

Jeremy Cooper

Yves Perrenoud

Patrick James McNerthney

Brent R Torre

Joe B Boyle

James A Acquaviva

Mark Wittenberg

Jeffrey Markey

Robert W Thomas

Andrew Molitor

Jesse Craig-Goodell

John-Mark Gurney

Runtime security threats are detected and analyzed for serverless functions developed for hybrid clouds or other cloud-based deployment environments. One or more serverless functions may be received and executed within a container instance executing in a controlled and monitored environment. The execution of the serverless functions is monitored, using a monitoring layer in the controlled environment to capture runtime data including container application context statistics, serverless function input and output data, and runtime parameter snapshots of the serverless functions. Execution data associated with the serverless functions may be analyzed and provided to various supervised and/or unsupervised machine-learning models configured to detect and analyze runtime security threats.

Runtime security analytics for serverless workloads

In one embodiment, a service receives captured traffic flow data regarding a traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone. The service identifies, from the captured traffic flow data, one or more cryptographic parameters of the traffic flow. The service determines whether the one or more cryptographic parameters of the traffic flow satisfy an inter-zone policy associated with the first and second network zones. The service causes performance of a mitigation action in the network when the one or more cryptographic parameters of the traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.

Cryptographic security audit using network service zone locking

In one example embodiment, a server compares derived values of a plurality of machine learning features with specified values of the plurality of machine learning features according to an ontology that defines a relationship between the plurality of machine learning features and a corresponding higher-order behavior for the specified values of the plurality of machine learning features. When the derived values of the plurality of machine learning features match the specified values of the plurality of machine learning features, the server aggregates the weights of the plurality of machine learning features to produce an aggregated weight. The server assigns the aggregated weight to the higher-order behavior so as to indicate a significance of the higher-order behavior in producing the machine learning result.

Automated identification of higher-order behaviors in a machine-learning network security system

An organization's security data is compared to an aggregation of multiple organizations' security data. Security data is received from multiple organizations having organizational characteristics. The received security data is aggregated based on the organizational characteristics to generate sets of aggregate data associated with the organizational characteristics. A query is received from an organization of the multiple organizations. The query specifies a particular organizational characteristic. A set of aggregate data associated with the specified organizational characteristic is identified. A representation of the organization's security data in relation to the identified set of aggregate data is generated. The representation is transmitted to the organization in response to the query.

Comparing an organization's security data to aggregate security data

A system comprises a security manager to scan a network for host instances representing hosts on the network at that time, and record characteristics of the host instances in a host record. The security manager subsequently scans the network for host instances in order to identify persistent hosts. A host profiling module takes snapshots of the network to generate host instances based on characteristics such as an IP address, a NetBIOS name, a DNS name, a MAC address. A host matching module correlates host instances from different snapshots using weighted rules (predetermined or customized) to discriminate between multiple potential matching host instances. Also, security logic makes security decisions based on data including persistent host information.

Persistent host determination

A network services platform provides services to remote enterprise networks. The services platform provides a control module to a computer in the enterprise network. The control module executes on the computer and interacts with the services platform to establish an Internet Protocol (IP) tunnel between the services platform and the computer. The control module also establishes a bridge between the IP tunnel and the enterprise network. The services platform allocates a unique private IP address space to the enterprise network, and translates IP addresses in network communications between enterprise network addresses and corresponding services platform addresses in the allocated unique private address space. The services platform provides network services to the enterprise network via the IP tunnel and bridge.

Network services platform

An enterprise network includes hosts running services. Some of the services have security vulnerabilities. There are one or more threat zones associated with the network. For example, a firewall may create two threat zones, one internal to the firewall and one external to it. A device profiler in the first threat zone profiles the hosts on the network and identifies the vulnerabilities that are present. A device profiler in the second threat zone determines which of the identified vulnerabilities are accessible from its zone. A risk module calculates the risk associated with a vulnerability based on the vulnerability's severity, threat level metrics for the threat zones, and an asset value of the host with the vulnerability. A reporting module prioritizes the vulnerabilities based on their risks.

Prioritizing network security vulnerabilities using accessibility

A system and method for providing distributed security of a network. Several device profilers are placed at different locations of a network to assess vulnerabilities from different perspectives. The device profiler identifies the hosts on the network, and characteristics such as operating system and applications running on the hosts. The device profiler traverses a vulnerability tree having nodes representative of characteristics of the hosts, each node having an associated set of potential vulnerabilities. Verification rules can verify the potential vulnerabilities. A centralized correlation server, at a centrally accessible location in the network, stores the determined vulnerabilities of the network and associates the determined vulnerabilities with attack signatures. Traffic monitors access the attack signatures and monitor network traffic for attacks against the determined vulnerabilities.

Network security system having a device profiler communicatively coupled to a traffic monitor

Growing community of inventors

Austin, TX, United States of America

Timothy David Keanini