知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

154 records (took 0.016 seconds)

    PRIVACY ENHANCING MAN-IN-THE-MIDDLE
    141.
    发明申请
    PRIVACY ENHANCING MAN-IN-THE-MIDDLE 有权

    公开(公告)号：US20210105301A1

    公开(公告)日：2021-04-08

    申请号：US16594203

    申请日：2019-10-07

    Applicant: Cisco Technology, Inc.

    Inventor： Blake Harrell Anderson ,  David McGrew

    IPC: H04L29/06

    Abstract: In one embodiment, a device in a network intercepts traffic sent from a first endpoint destined for a second endpoint. The device sends a padding request to the second endpoint indicative of a number of padding bytes. The device receives a padding response from the second endpoint, after sending the padding request to the second endpoint. The device adjusts the intercepted traffic based on the received padding response. The device sends the adjusted traffic to the second endpoint.

    MALWARE CLASSIFICATION AND ATTRIBUTION THROUGH SERVER FINGERPRINTING USING SERVER CERTIFICATE DATA
    142.
    发明申请
    MALWARE CLASSIFICATION AND ATTRIBUTION THROUGH SERVER FINGERPRINTING USING SERVER CERTIFICATE DATA 审中-公开

    公开(公告)号：US20200267164A1

    公开(公告)日：2020-08-20

    申请号：US16869726

    申请日：2020-05-08

    Applicant: Cisco Technology, Inc.

    Inventor： Blake Harrell Anderson ,  David McGrew ,  Subharthi Paul ,  Ivan Nikolaev ,  Martin Grill

    IPC: H04L29/06

    Abstract: In one embodiment, a device in a network receives certificate data for an encrypted traffic flow associated with a client node in the network. The device determines one or more data features from the certificate data. The device determines one or more flow characteristics of the encrypted traffic flow. The device performs a classification of an application executed by the client node and associated with the encrypted traffic flow by using a machine learning-based classifier to assess the one or more data features from the certificate data and the one or more flow characteristics of the traffic flow. The device causes performance of a network action based on a result of the classification of the application.

    Correlating endpoint and network views to identify evasive applications
    143.
    发明授权
    Correlating endpoint and network views to identify evasive applications 有权

    公开(公告)号：US10735441B2

    公开(公告)日：2020-08-04

    申请号：US15848150

    申请日：2017-12-20

    Applicant: Cisco Technology, Inc.

    Inventor： Blake Harrell Anderson ,  David McGrew ,  Vincent E. Parla ,  Jan Jusko ,  Martin Grill ,  Martin Vejman

    IPC: H04L29/06 ,  G06F21/55 ,  H04L9/32 ,  G06F21/44 ,  G06F21/52

    Abstract: In one embodiment, a service receives traffic telemetry data regarding encrypted traffic sent by an endpoint device in a network. The service analyzes the traffic telemetry data to infer characteristics of an application on the endpoint device that generated the encrypted traffic. The service receives, from a monitoring agent on the endpoint device, application telemetry data regarding the application. The service determines that the application is evasive malware based on the characteristics of the application inferred from the traffic telemetry data and on the application telemetry data received from the monitoring agent on the endpoint device. The service initiates performance of a mitigation action in the network, after determining that the application on the endpoint device is evasive malware.

    TRAINING A MACHINE LEARNING-BASED TRAFFIC ANALYZER USING A PROTOTYPE DATASET
    150.
    发明申请
    TRAINING A MACHINE LEARNING-BASED TRAFFIC ANALYZER USING A PROTOTYPE DATASET 审中-公开

    公开(公告)号：US20180189677A1

    公开(公告)日：2018-07-05

    申请号：US15399081

    申请日：2017-01-05

    Applicant: Cisco Technology, Inc.

    Inventor： Blake Harrell Anderson ,  David McGrew

    IPC: G06N99/00 ,  H04L29/06

    CPC classification number: G06N20/00 ,  H04L63/0428 ,  H04L63/1408 ,  H04L63/1425 ,  H04L63/1433 ,  H04L63/1441

    Abstract: In one embodiment, a device in a network generates a feature vector based on traffic flow data regarding one or more traffic flows in the network. The device makes a determination as to whether the generated feature vector is already represented in a training dataset dictionary by one or more feature vectors in the dictionary. The device updates the training dataset dictionary based on the determination by one of: adding the generated feature vector to the dictionary when the generated feature vector is not already represented by one or more feature vectors in the dictionary, or incrementing a count associated with a particular feature vector in the dictionary when the generated feature vector is already represented by the particular feature vector in the dictionary. The device generates a training dataset based on the training dataset dictionary for training a machine learning-based traffic flow analyzer.

Patent Agency Ranking