-
公开(公告)号：US20230146962A1
公开(公告)日：2023-05-11
申请号：US18096143
申请日：2023-01-12
Applicant: Cisco Technology, Inc.
Inventor： K. Tirumaleswar Reddy , Daniel G. Wing , Blake Harrell Anderson , David McGrew
CPC classification number: H04L63/1458 , H04L63/1425 , G06N20/00 , H04L2463/144
Abstract: In one embodiment, a device in a network receives an attack mitigation request regarding traffic in the network. The device causes an assessment of the traffic, in response to the attack mitigation request. The device determines that an attack detector associated with the attack mitigation request incorrectly assessed the traffic, based on the assessment of the traffic. The device causes an update to an attack detection model of the attack detector, in response to determining that the attack detector incorrectly assessed the traffic.
-
公开(公告)号：US11582208B1
公开(公告)日：2023-02-14
申请号：US17498392
申请日：2021-10-11
Applicant: Cisco Technology, Inc.
Inventor： David McGrew , Blake Harrell Anderson
Abstract: According to an embodiment, a method receives one or more messages associated with connecting a client and a first host. At least one of the messages comprises an encrypted portion indicating the first host and at least one of the messages comprises a cleartext portion indicating a second host. The method determines first and second sets of links associated with the first and second host, respectively. The first set is determined based on monitoring a result of connecting the client and the first host. The second set is determined based on observing behavior associated with connecting to the second host. The method detects domain fronting in response to determining, based on comparing the first set of links and the second set of links, that the first host differs from the second host.
-
公开(公告)号：US11558424B2
公开(公告)日：2023-01-17
申请号：US17307677
申请日：2021-05-04
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David Arthur McGrew
Abstract: Techniques and mechanisms for using passively collected network data to automatically generate a fingerprint prevalence database without the need for endpoint ground truth. The process first clusters all observations with the same fingerprint string and similar source and destination context. The process then annotates each cluster with descriptive information and uses a rule-based system to derive an informative name from that descriptive information, e.g., “winnt amp client” or “cross-platform browser”. Optionally, the learned database may be augmented by a user to clarify custom process labels. Additionally, the generated database may be used to report the inferred processes in the same way as databases generated with endpoint ground truth.
-
公开(公告)号：US11451578B2
公开(公告)日：2022-09-20
申请号：US17029156
申请日：2020-09-23
Applicant: Cisco Technology, Inc.
Inventor： Jan Kohout , Blake Harrell Anderson , Martin Grill , David McGrew , Martin Kopp , Tomas Pevny
IPC: H04L9/40 , G06N20/00 , H04L41/0686 , H04L47/2441 , G06N20/20
Abstract: In one embodiment, a device in a network detects an encrypted traffic flow associated with a client in the network. The device captures contextual traffic data regarding the encrypted traffic flow from one or more unencrypted packets associated with the client. The device performs a classification of the encrypted traffic flow by using the contextual traffic data as input to a machine learning-based classifier. The device generates an alert based on the classification of the encrypted traffic flow.
-
公开(公告)号：US11316871B2
公开(公告)日：2022-04-26
申请号：US15891708
申请日：2018-02-08
Applicant: Cisco Technology, Inc.
Inventor： Santosh Ramrao Patil , Gangadharan Byju Pularikkal , David McGrew , Blake Harrell Anderson , Madhusudan Nanjanagud
Abstract: Methods and systems to estimate encrypted multi-path TCP (MPTCP) network traffic include restricting traffic in a first direction (e.g., uplink) to a single path, and estimating traffic of multiple subflows of a second direction (e.g., downlink) based on traffic over the single path of the first direction. The estimating may be based on, without limitation, acknowledgment information of the single path, a sequence of acknowledgment numbers of the single path, an unencrypted initial packet sent over the single path as part of a secure tunnel setup procedure, TCP header information of the unencrypted initial packet (e.g., sequence number, acknowledgment packet, and/or acknowledgment packet length), and/or metadata of packets of the single path (e.g., regarding cryptographic algorithms, Diffie-Helman groups, and/or certificate related data).
-
Patent Agency Ranking
公开(公告)号：US11223653B2
公开(公告)日：2022-01-11
申请号：US16512474
申请日：2019-07-16
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David McGrew , Keith Richard Schomburg
Abstract: In one embodiment, a device obtains telemetry data regarding an encrypted traffic session in a network. The telemetry data includes Transport Layer Security (TLS) features of the traffic session and auxiliary information indicative of a destination address of the traffic session, a destination port of the traffic session, or a server name associated with the traffic session. The device retrieves, using the obtained telemetry data, a plurality of candidate processes from a TLS fingerprint database that relates processes with telemetry data from encrypted traffic sessions initiated by those processes. The device uses a probabilistic model to assign probabilities to each of the plurality of candidate processes. The device identifies one of the plurality of candidate processes as having initiated the encrypted traffic session based on its assigned probability.
-
公开(公告)号：US11032314B2
公开(公告)日：2021-06-08
申请号：US16220115
申请日：2018-12-14
Applicant: Cisco Technology, Inc.
Inventor： David McGrew , Blake Harrell Anderson , Julien Thomas Piet
Abstract: In one embodiment, a security service classifies traffic telemetry data for traffic between an endpoint device and a server as potentially associated with a particular type of remote access Trojan (RAT). The security service constructs a scan message to elicit a type of server response associated with the particular type of RAT. The security service obtains a server response from the server, by sending the constructed scan message to the server. The security service determines whether the endpoint device is infected with the particular type of RAT, by validating whether the server response from the server matches the type of server response associated with the particular type of RAT.
-
公开(公告)号：US20210160275A1
公开(公告)日：2021-05-27
申请号：US16693885
申请日：2019-11-25
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David McGrew
Abstract: In one embodiment, a telemetry exporter in a network establishes a tunnel between the telemetry exporter and a traffic analysis service. The telemetry exporter obtains packet copies of a plurality of packets sent between devices via the network. The telemetry exporter forms a set of traffic telemetry data by discarding at least a portion of one or more of the packet copies, based on a filter policy. The telemetry exporter applies compression to the formed set of traffic telemetry data. The telemetry exporter sends, via the tunnel, the compressed set of traffic telemetry data to the traffic analysis service for analysis.
-
公开(公告)号：US20210160268A1
公开(公告)日：2021-05-27
申请号：US17142533
申请日：2021-01-06
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David McGrew
IPC: H04L29/06 , G06N20/00 , H04L12/24 , H04L12/851
Abstract: In one embodiment, a device in a network receives traffic data regarding a plurality of observed traffic flows. The device maps one or more characteristics of the observed traffic flows from the traffic data to traffic characteristics associated with a targeted deployment environment. The device generates synthetic traffic data based on the mapped traffic characteristics associated with the targeted deployment environment. The device trains a machine learning-based traffic classifier using the synthetic traffic data.
-
公开(公告)号：US20210144455A1
公开(公告)日：2021-05-13
申请号：US17154053
申请日：2021-01-21
Applicant: Cisco Technology, Inc.
Inventor： Blake Harrell Anderson , David Arthur McGrew , Alison Kendler
Abstract: In one embodiment, a method includes receiving a traffic flow including a plurality of packets encrypted using a cryptographic protocol, determining cryptographic protocol data of the traffic flow, and transmitting telemetry data of the traffic flow including the cryptographic protocol data. In another embodiment, a method includes receiving telemetry data of a traffic flow including a plurality of packets encrypted using a cryptographic protocol, the telemetry data including cryptographic protocol data of the traffic flow, classifying the traffic flow based on the cryptographic protocol data using a machine learning classifier; and taking a remedial action with respect to the traffic flow based on the classification of the traffic flow.
-
-
-
-
-
-
-
-
-
Search Results
154
records
(took 0.027 seconds)
