Lacework Inc.

Cisco Technology, Inc.

Fortinet, Inc.

Weifei Zeng

Yijou Chen

Vikram Kapoor

Vimalkumar Jeyakumar

Ying Xie

Harish Kumar Bharat Singh

Navindra Yadav

Shashidhar R Gandham

Varun Sagar Malhotra

Omid Madani

Paul Mach

Sayeed Mohammed Tasnim

Yash Vipul Doshi

Ashutosh Kulshreshtha

Shashi Gandham

Alok Lalit Wadhwa

Thanh Trung Ngo

Thanh Nhan Nguyen

Trevor A Welsh

James Gabriel Fontenot

Maxwell Aaron Mechanic

Chakradhar Reddy Vangeti

Sameer Salim Mahomed Ali Ladiwala

Sasidhar Evuru

Sai Ankith Averineni

Thanh Nhan Thi Nguyen

Methods, apparatuses, and products for a tiered risk engine with user cohorts, including: detecting one or more alerts associated with a user; determining, based on a corresponding risk for each alert of the one or more alerts, a risk score; and controlling access to one or more resources based on the risk score.

Tiered risk engine with user cohorts

Establishing a location profile for a user device, including: gathering information associated with the location of a user device; determining, based on the information associated with the location of a user device, whether the user device is being accessed at a known location; responsive to determining that the user device is being accessed at a known location: determining a characterization of the known location; and determining, based on the characterization of the known location, whether device utilization is anomalous; and responsive to determining that the user device is not being accessed at a known location: determining a characterization of the unknown location; and determining, based on the characterization of the unknown location, whether device utilization is anomalous.

Establishing a location profile for a user device

Using activity monitored by multiple data sources to identify shadow systems, the method comprising: gathering first information describing access to one or more resources by one or more user devices of a user; gathering, from at least a subset of the one or more user devices, second information describing access to the one or more resources; and identifying one or more shadow systems based on a discrepancy between the first information and the second information.

Using activity monitored by multiple data sources to identify shadow systems

Detecting anomalous behavior of a device, including: generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device; gathering information describing current activity associated with the user device; and determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

User-specific data-driven network security

Elastic privileges in a secure access service edge, including: identifying, based on one or more access policies, an application accessible to a user; determining, for the user, an access pattern of the application; and restricting, without modifying the one or more access policies, access to the application by the user based on the access pattern.

Elastic privileges in a secure access service edge

Generating user-specific polygraphs for network activity, including: gathering information describing network activity associated with a user and generating, based on the information, a user-specific polygraph that includes one or more destinations associated with the network activity.

Generating user-specific polygraphs for network activity

Detecting deviations from typical user behavior, including: identifying a geographic location of a device that is associated with a user; determining device activity associated with the user; and detecting, based on a profile associated with the user, that the device activity associated with the user deviates from normal activity for the user.

Detecting deviations from typical user behavior

Detecting anomalous behavior of a device

This disclosure provides solutions for automatically grouping network devices (e.g., endpoints) into clusters based on device characteristics. In some aspects, the disclosed technology also provides solutions for generating user selectable queries based on cluster characteristics. A process of the disclosed technology can include steps for identifying one or more device characteristics associated with a first network device, identifying one or more cluster characteristics for each of a first cluster and a second cluster, and comparing the device characteristics associated with the first network device with the one or more cluster characteristics for the first cluster and the second cluster. The process can further include steps for adding the first network device to the first cluster based on the cluster characteristics for the first cluster and the device characteristics for the first network device. Systems and machine-readable media are also provided.

Endpoint cluster assignment and query generation

The present disclosure relates to methods, systems, and non-transitory computer readable media for discovering policy scopes within an enterprise network and managing network policies for discovered policy scopes. In one aspect, a method includes identifying one or more communities of devices in an enterprise network; defining, from the one or more communities of devices, policy scopes in the enterprise network; generating a hierarchical representation of the policy scopes; identifying, based on the hierarchical representation of the policy scopes, one or more policies governing traffic flow between devices associated with each of the policy scopes; and managing application of the one or more policies at the devices.

Scope discovery and policy generation in an enterprise network

Disclosed herein are methods, systems, and non-transitory computer-readable storage media for scoring network segmentation policies in order to determine their effectiveness before, during and after enforcement. In one aspect, a method includes identifying one or more applications within an enterprise network; identifying at least one network security policy in association with the one or more applications within the enterprise network; determining a score of the network security policy based on information corresponding to exposure of each of the one or more applications within the enterprise network; and executing the network security policy based on the score.

Systems and methods for determining effectiveness of network segmentation policies

Growing community of inventors

Sunnyvale, CA, United States of America

Weifei Zeng