Cisco Technology, Inc.

Lacework Inc.

Fortinet, Inc.

Vimalkumar Jeyakumar

Navindra Yadav

Ali Parandehgheibi

Omid Madani

Ellen Christine Scheib

Mohammadreza Alizadeh Attar

Abhishek Ranjan Singh

Roberto Fernando Spadaro

Shashidhar R Gandham

Yijou Chen

Vikram Kapoor

Theron D Tock

Ying Xie

Harish Kumar Bharat Singh

Rohit Chandra Prasad

Hoang Viet Nguyen

Varun Sagar Malhotra

Bharathwaj Sankara Viswanathan

Weifei Zeng

Anubhav Gupta

Shih-Chun Chang

Ashutosh Kulshreshtha

Khawar Deen

Hai Trong Vu

Jackson Ngoc Ki Pang

Sunil Gupta

Michael Standish Watts

Supreeth Hosur Nagesh Rao

Fnu Rachita Agasthy

Duane Thomas Barlow

Sunil Kumar Gupta

Handling of certificates by intermediate actors, including: receiving, by a proxy and from a client, a client certificate and a first private key; generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate; generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination; and providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate.

Handling of certificates by intermediate actors

An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

System for monitoring and managing datacenters

Establishing a location profile for a user device, including: gathering information associated with the location of a user device; determining, based on the information associated with the location of a user device, whether the user device is being accessed at a known location; responsive to determining that the user device is being accessed at a known location: determining a characterization of the known location; and determining, based on the characterization of the known location, whether device utilization is anomalous; and responsive to determining that the user device is not being accessed at a known location: determining a characterization of the unknown location; and determining, based on the characterization of the unknown location, whether device utilization is anomalous.

Establishing a location profile for a user device

Using activity monitored by multiple data sources to identify shadow systems, the method comprising: gathering first information describing access to one or more resources by one or more user devices of a user; gathering, from at least a subset of the one or more user devices, second information describing access to the one or more resources; and identifying one or more shadow systems based on a discrepancy between the first information and the second information.

Using activity monitored by multiple data sources to identify shadow systems

This disclosure generally relate to a method and system for mapping application dependency information. The present technology relates techniques that enable user-adjustable application dependency mapping of a network system. By collecting internal network data using various sensors in conjunction with external user inputs, the present technology can provide optimized application dependency mapping using user inputs.

System and method for user optimized application dependency mapping

Detecting anomalous behavior of a device, including: generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device; gathering information describing current activity associated with the user device; and determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

User-specific data-driven network security

Elastic privileges in a secure access service edge, including: identifying, based on one or more access policies, an application accessible to a user; determining, for the user, an access pattern of the application; and restricting, without modifying the one or more access policies, access to the application by the user based on the access pattern.

Elastic privileges in a secure access service edge

Generating user-specific polygraphs for network activity, including: gathering information describing network activity associated with a user and generating, based on the information, a user-specific polygraph that includes one or more destinations associated with the network activity.

Generating user-specific polygraphs for network activity

Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.

Detecting deviations from typical user behavior

Systems, methods, and computer-readable media are provided for determining a packet's round trip time (RTT) in a network. A system can receive information of a packet sent by a component of the network and further determine an expected acknowledgement (ACK) sequence number associated with the packet based upon received information of the packet. The system can receive information of a subsequent packet received by the component and determine an ACK sequence number and a receiving time of the subsequent packet. In response to determining that the ACK sequence number of the subsequent TCP packet matches the expected ACK sequence number, the system can determine a round trip time (RTT) of the packet based upon the received information of the packet and the received information of the subsequent packet.

Round trip time (RTT) measurement based upon sequence number

An example method can include choosing a pattern or patterns of network traffic. This pattern can be representative of a certain type of traffic such as an attack. The pattern can be associated with various components of a network and can describe expected behavior of these various components. A system performing this method can then choose a nodes or nodes to generate traffic according to the pattern and send an instruction accordingly. After this synthetic traffic is generated, the system can compare the behavior of the components with the expected behavior. An alert can then be created to notify an administrator or otherwise remedy any problems.

Synthetic data for determining health of a network security system

Detecting anomalous behavior of a device

Systems and methods are provided for automatically discovering applications/clusters in a network and mapping dependencies between the applications/clusters. A network monitoring system can capture network flow data using sensors executing on physical and/or virtual servers of the network and sensors executing on networking devices connected to the servers. The system can determine a graph including nodes, representing at least the servers, and edges, between pairs of the nodes of the graph indicating the network flow data includes one or more observed flows between pairs of the servers represented by the pairs of the nodes. The system can determine a dependency map, including representations of clusters of the servers and representations of dependencies between the clusters, based on the graph. The system can display a first representation of a first cluster of the dependency map and information indicating a confidence level of identifying the first cluster.

Growing community of inventors

Sunnyvale, CA, United States of America

Vimalkumar Jeyakumar