Narus, Inc.

Yong Liao

Mario Baldi

Antonio Nucci

Stanislav Miskovic

Amedeo Sapio

Sung-Ju Lee

Lili Qiu

Qiang Xu

Yi-Chao Chen

Zhi-Li Zhang

Aleksandar Kuzmanovic

Alok Tongaonkar

Marios Iliofotou

Han See Song

Han Hee Song

Ning Xia

Syed M Hussain

A method for profiling network traffic. The method includes capturing, from the network traffic using a packet capturing device, a plurality of packets, identifying a first portion of the plurality of packets as a first flow based at least on a common Internet Protocol (IP) address assigned to each packet of the first flow by a network address translation (NAT) device, extracting, by a hardware processor separate from the NAT device and based on an NAT profile of the NAT device, a first data item from the first flow, wherein the first data item is inserted into the first flow by the NAT device for identifying a first host device coupled to the NAT device, and determining, by the hardware processor based on the first data item, that the first flow is generated by the first host device.

Attributing network address translation device processed traffic to individual hosts

A method for classifying network traffic in a network. The method includes obtaining, from an application distribution source, an application distribution data set of comprising information associated with distributing an application from the pre-determined application distribution source, extracting, based on a pre-determined extraction criterion, a token from the application distribution data set of the application, obtaining, from the network traffic, a plurality of flows generated by the application, extracting, in response to detecting the token in a flow of the plurality of flows, context information associated with the token in the flow, and generating an identification rule of the application based on the token and the context information, wherein the identification rule describes one or more rule steps to locate the token in the flow, wherein the network traffic is classified using at least the identification rule.

System and method for extracting signatures from controlled execution of applications and application codes retrieved from an application source

Embodiments of the invention provide a method, system, and computer readable medium for classifying network traffic based on application signatures generated during a training phase. The application signatures are generated based on tokens extracted from a training set that is generated by a particular application during the training phase. Accordingly, a new token extracted in real-time from current network data is compared to the application signatures to determine if the current network data is generated by the particular application.

System and method for extracting signatures from controlled execution of applications and using them on traffic traces

A method for applying a user-specific policy in a network. The method includes identifying a historical portion of network traffic of the network as associated with a user, analyzing, by a computer processor, the historical portion of network traffic to generate a fingerprint of the user, wherein the fingerprint represents characteristics of user activity in the network, identifying, by the computer processor, an ongoing portion of network traffic of the network as associated with the user, analyzing, by the computer processor and based on the fingerprint, the ongoing portion of network traffic to determine a match, wherein the match is determined at a time point within the ongoing portion of network traffic, and applying, in response to determining the match, the user-specific policy to the ongoing portion of network traffic subsequent to the time point.

User-specific policy enforcement based on network traffic fingerprinting

A method for profiling network traffic of a network. The method includes capturing packets based at least on a common source IP address shared by each of the packets, where said each packet is assigned a source timestamp by a source of said each packet and further assigned a capture timestamp by a packet capturing device, identifying a first portion of the packets as a first flow and a second portion of the packets as a second flow, extracting a first monotonic timestamp-pair (MTSP) sequence and a second MTSP sequence from the first flow and the second flow, respectively, comparing the first MTSP sequence and the second MTSP sequence to generate a result, and determining, based on the result, whether the first flow and the second flow are generated by a single host of the network.

Method, system and non-transitory computer readable medium for profiling network traffic of a network

Identifying IP traffic from multiple hosts behind a network address translation device

A method for accessing (e.g., processing, storing, retrieving, etc.) network traffic data of a network. The method includes using separate data analysis device and data access device for capturing and analyzing network traffic data blocks concurrently and cooperatively to store and retrieve large amount of high speed network traffic data. In particular, the data analysis device and the data access device are synchronized using a linked set containing unique data block identifier and associated packet identifiers. The synchronization allows the data analysis device to focus on the full packet analysis task and the data access device to focus on the full packet storing and retrieving task without analyzing full packet content.

Efficient storage and flexible retrieval of full packets captured from network traffic

A method for profiling user activity in a mobile network, including extracting user identifiers from application sessions identified from a mobile network, analyzing the application sessions to determine session blocks based on shared IP address and a minimum separation time threshold, extracting a traffic marker from the session blocks based on a user identifier, identifying a first portion of the session blocks based on the user identifier, wherein the first portion is associated with first mobile network activities of a user identified by the user identifier, identifying a second portion of the session blocks based on the traffic marker, wherein the second portion is associated with second mobile network activities of the user, and analyzing the first portion and the second portion to determine a measure of a mobile network activity of the user.

Quantifying privacy leakage in mobile networks

A method for comparing documents, including extracting, by a computer processor, a plurality of extracted elements from a first image of a first formatted document, wherein each of the plurality of extracted elements corresponds to a text element of the first formatted document, extracting, by the computer processor, a first plurality of text fingerprints from a sequence of the plurality of extracted elements to form a first text feature of the first image, comparing, by the computer processor, the first text feature and a second formatted document to generate a comparison result, and determining, in response to the comparison result meeting a pre-determined criterion, that each of the first formatted document and the second formatted document contains common text content.

Document fingerprint

Embodiments of the invention provide a method, system, and computer readable medium for classifying network traffic based on application signatures generated during a training phase. The application signatures are generated using (a) seeding flows obtained from a network trace based on a pre-determined selection criterion, and (b) for each seeding flow, a seeded flow group that is obtained from the network trace based on a pre-determined seeding criterion associated with the seeding flow. Specifically, persistent data patterns frequently occurring across multiple seeded flow groups are analyzed to generate the signatures.

System and method for extracting signatures from seeded flow groups to classify network traffic

A method for managing a secured document. The method includes storing and retrieving the secured document based on hybrid fragmentation and replication scheme to provide user viewing of the secured document by (a) generating an image representing human discernible content of the secured document, (b) modifying the image to generate a modified image that is embedded with a digital watermark, where the digital water mark is human indiscernible and represents a security policy extracted from the secured document, and (c) sending, to a secured device for displaying to the requesting user, the modified image embedded with the digital watermark.

Growing community of inventors

Sunnyvale, CA, United States of America

Yong Liao