-
公开(公告)号：US10708284B2
公开(公告)日：2020-07-07
申请号：US15643573
申请日：2017-07-07
Applicant: Cisco Technology, Inc.
Inventor： Martin Kopp , Petr Somol , Tomas Pevny , David McGrew
Abstract: In one embodiment, a device in a network maintains a plurality of machine learning-based detectors for an intrusion detection system. Each detector is associated with a different portion of a feature space of traffic characteristics assessed by the intrusion detection system. The device provides data regarding the plurality of detectors to a user interface. The device receives an adjustment instruction from the user interface based on the data provided to the user interface regarding the plurality of detectors. The device adjusts the portions of the feature space associated with the plurality of detectors based on the adjustment instruction received from the user interface.
-
122.发明授权公开(公告)号：US10686831B2
公开(公告)日：2020-06-16
申请号：US15353160
申请日：2016-11-16
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David McGrew , Subharthi Paul , Ivan Nikolaev , Martin Grill
Abstract: In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application.
-
123.发明授权公开(公告)号：US10666640B2
公开(公告)日：2020-05-26
申请号：US15848645
申请日：2017-12-20
Applicant: Cisco Technology, Inc.
Inventor： David McGrew , Blake Harrell Anderson , Subharthi Paul , William Michael Hudson, Jr. , Philip Ryan Perricone
Abstract: In one embodiment, a device in a network observes traffic between a client and a server for an encrypted session. The device makes a determination that a server certificate should be obtained from the server. The device, based on the determination, sends a handshake probe to the server. The device extracts server certificate information from a handshake response from the server that the server sent in response to the handshake probe. The device uses the extracted server certificate information to analyze the traffic between the client and the server.
-
124.发明授权公开(公告)号：US10536268B2
公开(公告)日：2020-01-14
申请号：US15692288
申请日：2017-08-31
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , Andrew Chi , David McGrew , Scott William Dunlop
Abstract: In one embodiment, an apparatus captures a memory dump of a device in a sandbox environment executing a malware sample. The apparatus identifies a cryptographic key based on a particular data structure in the captured memory dump. The apparatus uses the identified cryptographic key to decrypt encrypted traffic sent by the device. The apparatus labels at least a portion of the decrypted traffic sent by the device as benign. The apparatus trains a machine learning-based traffic classifier based on the at least a portion of the decrypted traffic sent by the device and labeled as benign.
-
公开(公告)号：US20190238471A1
公开(公告)日：2019-08-01
申请号：US16379352
申请日：2019-04-09
Applicant: Cisco Technology, Inc.
Inventor： Michael Joseph Stepanek , Costas Kleopa , David McGrew , Blake Harrell Anderson , Saravanan Radhakrishnan
IPC: H04L12/851 , H04W12/12 , H04L29/06 , H04L12/931 , H04L12/859 , H04L12/825
Abstract: In one embodiment, a networking device in a network detects a traffic flow conveyed in the network via the networking device. The networking device generates flow data for the traffic flow. The networking device performs a classification of the traffic flow using the flow data as input to a machine learning-based classifier. The networking device performs a mediation action based on the classification of the traffic flow.
-
Patent Agency Ranking
126.发明申请公开(公告)号：US20180278629A1
公开(公告)日：2018-09-27
申请号：US15469716
申请日：2017-03-27
Applicant: Cisco Technology, Inc.
Inventor： David McGrew , Blake Harrell Anderson
IPC: H04L29/06 , H04L12/851 , G06N99/00
CPC classification number: H04L63/1416 , G06N20/00 , H04L47/2441 , H04L63/1408 , H04L63/145 , H04L67/02
Abstract: In one embodiment, a device in a network receives telemetry data regarding a traffic flow in the network. One or more features in the telemetry data are individually compressed. The device extracts the one or more individually compressed features from the received telemetry data. The device performs a lookup of one or more classifier inputs from an index of classifier inputs using the one or more individually compressed features from the received telemetry data. The device classifies the traffic flow by inputting the one or more classifier inputs to a machine learning-based classifier.
-
公开(公告)号：US20180189677A1
公开(公告)日：2018-07-05
申请号：US15399081
申请日：2017-01-05
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David McGrew
CPC classification number: G06N20/00 , H04L63/0428 , H04L63/1408 , H04L63/1425 , H04L63/1433 , H04L63/1441
Abstract: In one embodiment, a device in a network generates a feature vector based on traffic flow data regarding one or more traffic flows in the network. The device makes a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary. The device updates the training dataset dictionary based on the determination by one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary. The device generates a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer.
-
128.发明申请公开(公告)号：US20180139214A1
公开(公告)日：2018-05-17
申请号：US15353160
申请日：2016-11-16
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David McGrew , Subharthi Paul , Ivan Nikolaev , Martin Grill
Abstract: In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application.
-
公开(公告)号：US20180139141A1
公开(公告)日：2018-05-17
申请号：US15353940
申请日：2016-11-17
Applicant: Cisco Technology, Inc.
Inventor： Michael Joseph Stepanek , Costas Kleopa , David McGrew , Blake Harrell Anderson , Saravanan Radhakrishnan
IPC: H04L12/851 , H04L12/825 , H04L12/859 , H04L12/931 , H04L29/06
CPC classification number: H04L47/2441 , H04L47/2475 , H04L47/2483 , H04L47/25 , H04L49/355 , H04L63/0254 , H04L63/0428 , H04L63/1425 , H04L63/1458 , H04L63/166 , H04W12/12
Abstract: In one embodiment, a networking device in a network detects an traffic flow conveyed in the network via the networking device. The networking device generates flow data for the traffic flow. The networking device performs a classification of the traffic flow using the flow data as input to a machine learning-based classifier. The networking device performs a mediation action based on the classification of the traffic flow.
-
公开(公告)号：US20180007084A1
公开(公告)日：2018-01-04
申请号：US15245886
申请日：2016-08-24
Applicant: Cisco Technology, Inc.
Inventor： K. Tirumaleswar Reddy , Daniel G. Wing , Blake Harrell Anderson , David McGrew
CPC classification number: H04L63/1458 , G06N20/00 , H04L63/1425 , H04L2463/144
Abstract: In one embodiment, a device in a network receives an attack mitigation request regarding traffic in the network. The device causes an assessment of the traffic, in response to the attack mitigation request. The device determines that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic. The device causes an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.
-
-
-
-
-
-
-
-
-
Search Results
171
records
(took 0.027 seconds)
