知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

171 records (took 0.028 seconds)

    Detection of malware and malicious applications
    141.
    发明授权
    Detection of malware and malicious applications 有权

    公开(公告)号：US11700275B2

    公开(公告)日：2023-07-11

    申请号：US17360910

    申请日：2021-06-28

    Applicant: Cisco Technology, Inc.

    Inventor： David McGrew ,  Andrew Zawadowskiy ,  Donovan O'Hara ,  Saravanan Radhakrishnan ,  Tomas Pevny ,  Daniel G. Wing

    IPC: H04L9/40 ,  H04L69/16

    CPC classification number: H04L63/145 ,  H04L63/1408 ,  H04L63/166 ,  H04L69/16 ,  H04L2463/121

    Abstract: A method comprises receiving, at a network infrastructure device, a flow of packets, determining, using the network infrastructure device and for a first subset of the packets, that the first subset corresponds to a first datagram and determining a first length of the first datagram, determining, using the network infrastructure device and for a second subset of the packets, that the second subset corresponds to a second datagram that was received after the first datagram, and determining a second length of the second datagram, determining, using the network infrastructure device, a duration value between a first arrival time of the first datagram and a second arrival time of the second datagram, sending, to a collector device that is separate from the network infrastructure device, the first length, the second length, and the duration value for analysis.

    Automatically detecting authorized remote administration sessions in a network monitoring system
    142.
    发明授权
    Automatically detecting authorized remote administration sessions in a network monitoring system 有权

    公开(公告)号：US11632309B2

    公开(公告)日：2023-04-18

    申请号：US17376924

    申请日：2021-07-15

    Applicant: Cisco Technology, Inc.

    Inventor： David McGrew ,  Martin Rehak ,  Blake Harrell Anderson ,  Sunil Amin

    IPC: H04L41/28 ,  H04L9/40 ,  H04W12/12 ,  G06F21/55 ,  H04L67/143

    Abstract: In one embodiment, a service receives administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device. The service analyzes the administration traffic data to determine whether any portion of the administration traffic data is resulting from an administration session involving a trusted administrator. The service flags a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from an administration session involving a trusted administrator, and a second portion of the administration traffic data is non-flagged. The service assesses the second portion of the administration traffic data using a machine learning-based traffic classifier to determine whether the second portion of the administration traffic data is malicious.

    USING A TRUST ANCHOR TO VERIFY AN IDENTITY OF AN ASIC
    145.
    发明申请
    USING A TRUST ANCHOR TO VERIFY AN IDENTITY OF AN ASIC 有权

    公开(公告)号：US20220382912A1

    公开(公告)日：2022-12-01

    申请号：US17335245

    申请日：2021-06-01

    Applicant: Cisco Technology, Inc.

    Inventor： Chirag Shroff ,  David McGrew

    IPC: G06F21/73 ,  G06F21/72 ,  G06F7/58

    Abstract: According to certain embodiments, a method comprises performing a posture assessment at a trust anchor in order to determine whether a hardware component is authorized to run on a product. Performing the posture assessment comprises determining a random value (K), encrypting the random value (K) using a long-term key associated with the hardware component in order to yield an encrypted value, communicating the encrypted value to the hardware component, and receiving, from the hardware component, a message encrypted using the random value (K). The message comprises an identifier associated with the hardware component. Performing the posture assessment further comprises determining whether the hardware component is authorized to run on the product based at least in part on the identifier associated with the hardware component. The method further comprises performing an action that depends on whether the hardware component is authorized to run on the product.

    USING A TRUST ANCHOR TO CONTROL FUNCTIONALITY OF AN ASIC
    146.
    发明申请
    USING A TRUST ANCHOR TO CONTROL FUNCTIONALITY OF AN ASIC 有权

    公开(公告)号：US20220382867A1

    公开(公告)日：2022-12-01

    申请号：US17335219

    申请日：2021-06-01

    Applicant: Cisco Technology, Inc.

    Inventor： Chirag Shroff ,  David McGrew

    IPC: G06F21/57 ,  H04L9/08

    Abstract: According to certain embodiments, a method performed by a trust anchor comprises determining a random value (K), encrypting the random value (K) using a long-term key associated with a hardware component in order to yield an encrypted value, communicating the encrypted value to the hardware component, and receiving a response encrypted using the random value (K). The response is received from the hardware component. The method further comprise encrypting a schema using the random value (K) and sending the encrypted schema to the hardware component. The schema indicates functionality that the hardware component is authorized to enable.

    Endpoint-assisted inspection of encrypted network traffic
    148.
    发明授权
    Endpoint-assisted inspection of encrypted network traffic 有权

    公开(公告)号：US11310246B2

    公开(公告)日：2022-04-19

    申请号：US16100361

    申请日：2018-08-10

    Applicant: Cisco Technology, Inc.

    Inventor： Martin Rehak ,  David McGrew ,  Blake Harrell Anderson ,  Scott William Dunlop

    IPC: H04L29/06

    Abstract: In one embodiment, a traffic inspection service executed by an intermediary device obtains, from a monitoring agent executed by an endpoint device, keying information for an encrypted traffic session between the endpoint device and a remote entity. The traffic inspection service provides a notification to the monitoring agent that acknowledges receipt of the keying information. The traffic inspection service uses the keying information to decrypt encrypted traffic from the encrypted traffic session. The traffic inspection service applies a policy to the encrypted traffic session between the endpoint device and the remote entity, based on the decrypted traffic from the session.

Patent Agency Ranking