Patent search ap:("CISCO TECHNOLOGY Page INC.") AND inv:"Shashidhar Gandham"

11.

发明授权
Hierarchichal sharding of flows from sensors to collectors 有权

公开(公告)号：US10320630B2

公开(公告)日：2019-06-11

申请号：US15171855

申请日：2016-06-02

Applicant: Cisco Technology, Inc.

Inventor： Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra

IPC: H04L12/26 , H04L29/06 , G06F9/455 , G06N20/00 , G06F16/29 , G06F16/248 , G06F16/28 , G06F16/9535 , G06F16/2457 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06N99/00 , G06F16/174 , G06F16/23

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

12.

发明授权
High availability of collectors of traffic reported by network sensors 有权

公开(公告)号：US10181987B2

公开(公告)日：2019-01-15

申请号：US15171807

申请日：2016-06-02

Applicant: Cisco Technology, Inc.

Inventor： Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra

IPC: G06F15/173 , H04L12/26 , H04L29/06 , G06F9/455 , G06F17/30 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06N99/00 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56

Abstract: Systems, methods, and computer-readable media for collector high availability. In some embodiments, a system receives, from a first collector device, a first data report generated by a capturing agent deployed on a host system in a network. The system can also receive, from a second collector device, a second data report generated by the capturing agent deployed on the host system. The first and second data reports can include traffic data captured at the host system by the capturing agent during a period of time. The system can determine that the first data report and the second data report are both associated with the capturing agent, and identify duplicate data contained in the first data report and the second data report. The system can then deduplicate the first and second data reports to yield a deduplicated data report.

13.

发明授权
Technologies for annotating process and user information for network flows 有权

公开(公告)号：US10171319B2

公开(公告)日：2019-01-01

申请号：US15152163

申请日：2016-05-11

Applicant: Cisco Technology, Inc.

Inventor： Navindra Yadav , Abhishek Ranjan Singh , Anubhav Gupta , Shashidhar Gandham , Jackson Ngoc Ki Pang , Shih-Chun Chang , Hai Trong Vu

IPC: G06F9/455 , H04L12/26 , H04L29/06 , G06F17/30 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06N99/00 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

14.

发明授权
Technologies for determining sensor deployment characteristics 有权

公开(公告)号：US10116530B2

公开(公告)日：2018-10-30

申请号：US15133073

申请日：2016-04-19

Applicant: Cisco Technology, Inc.

Inventor： Navindra Yadav , Abhishek Ranjan Singh , Anubhav Gupta , Shashidhar Gandham , Jackson Ngoc Ki Pang , Shih-Chun Chang , Hai Trong Vu

IPC: H04L12/26 , H04L29/06 , G06F9/455 , G06F17/30 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06N99/00 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56

Abstract: Systems, methods, and computer-readable media for detecting sensor deployment characteristics in a network. In some embodiments, a system can run a capturing agent deployed on a virtualization environment of the system. The capturing agent can query the virtualization environment for one or more environment parameters, and receive a response from the virtualized environment including the one or more environment parameters. Based on the one or more environment parameters, the capturing agent can determine whether the virtualization environment where the capturing agent is deployed is a hypervisor or a virtual machine. The capturing agent can also determine what type of software switch is running in the virtualized environment.

15.

发明申请
SYSTEM AND METHOD OF ASSIGNING REPUTATION SCORES TO HOSTS 审中-公开
Title translation: 系统和方法将信誉评分归功于主体

公开(公告)号：US20160359888A1

公开(公告)日：2016-12-08

申请号：US15171580

申请日：2016-06-02

Applicant: Cisco Technology, Inc.

Inventor： Sunil Kumar Gupta , Navindra Yadav , Michael Standish Watts , Ali Parandehgheibi , Shashidhar Gandham , Ashutosh Kulshreshtha , Khawar Deen

IPC: H04L29/06 , G06F9/455

CPC classification number: H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F17/30241 , G06F17/3053 , G06F17/30554 , G06F17/30598 , G06F17/30604 , G06F17/30867 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N99/005 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18

Abstract: A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

Abstract translation: 一种方法提供从具有主机IP地址并在数据中心中操作的主机接收网络流量，以及分析恶意软件跟踪器以获得已被恶意软件感染的主机的IP地址以产生分析。当分析指示主机IP地址已被用于与被恶意软件感染的外部主机进行通信以产生指示时，该方法包括基于指示将信誉评分分配给主机。该方法还可以包括根据信誉分数应用与使用主机相关联的条件策略。信誉分数可以包括从主机的以前的声誉分数减少的声誉分数。

16.

发明申请
HIERARCHICHAL SHARDING OF FLOWS FROM SENSORS TO COLLECTORS 审中-公开
Title translation: 传感器流向收集器的流动性较好

公开(公告)号：US20160359708A1

公开(公告)日：2016-12-08

申请号：US15171855

申请日：2016-06-02

Applicant: Cisco Technology, Inc.

Inventor： Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra

IPC: H04L12/26 , G06F9/455 , H04L12/24

CPC classification number: H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F17/30241 , G06F17/3053 , G06F17/30554 , G06F17/30598 , G06F17/30604 , G06F17/30867 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N99/005 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18

Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.

Abstract translation: 用于从传感器到收集器的流层分层划分的系统，方法和计算机可读介质。第一收集器可以接收来自第一捕获代理的网络流的第一部分，并且确定网络流的第二部分未被从第一捕获代理接收。然后，第一收集器可以将网络流的第一部分发送到第二收集器。第三收集器可以从第二捕获代理接收网络流的第二部分，并且确定第三收集器没有接收网络流的第一部分。然后，第三收集器可以将网络流的第二部分发送到第二收集器。然后，第二收集器可以聚合网络流的第一部分和第二部分以产生网络流的整个部分。

17.

发明申请
IDENTIFYING BOGON ADDRESS SPACES 审中-公开
Title translation: 识别BOGON地址空间

公开(公告)号：US20160359699A1

公开(公告)日：2016-12-08

申请号：US15171836

申请日：2016-06-02

Applicant: Cisco Technology, Inc.

Inventor： Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra

IPC: H04L12/26 , H04L12/851 , H04L12/741

Abstract: Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.

Abstract translation: 用于识别浮标地址的系统，方法和计算机可读介质。系统可以获得网络中地址空间的指示。该指示可以基于与网络相关联的路由器发送的路由通告。系统可以接收由主机部署的捕获代理生成的报告。报告可以识别主机捕获代理捕获的流量。系统可以识别与流相关联的网络地址，并且基于地址空间的指示，系统可以确定网络地址是否在网络中的地址空间内。当网络地址不在网络中的地址空间内时，系统可以确定网络地址是一个浮标地址。当网络地址在网络中的地址空间内时，系统可以确定网络地址不是一个浮标地址。

18.

发明申请
TECHNOLOGIES FOR ANNOTATING PROCESS AND USER INFORMATION FOR NETWORK FLOWS 审中-公开
Title translation: 提出流程的技术和网络流量的用户信息

公开(公告)号：US20160357587A1

公开(公告)日：2016-12-08

申请号：US15152163

申请日：2016-05-11

Applicant: Cisco Technology, Inc.

Inventor： Navindra Yadav , Abhishek Ranjan Singh , Anubhav Gupta , Shashidhar Gandham , Jackson Ngoc Ki Pang , Shih-Chun Chang , Hai Trong Vu

IPC: G06F9/455 , H04L12/723 , H04L12/26

CPC classification number: H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F17/30241 , G06F17/3053 , G06F17/30554 , G06F17/30598 , G06F17/30604 , G06F17/30867 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N99/005 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Abstract translation: 用于为网络流注释流程和用户信息的系统，方法和计算机可读介质。在一些实施例中，在网络中的第一设备上执行的捕获代理可以监视与第一设备相关联的网络流。第一设备可以是例如虚拟机，管理程序，服务器或网络设备。接下来，捕获代理可以基于网络流生成控制流。控制流可以包括描述网络流的元数据。然后，捕获代理可以确定在第一设备上执行的哪个进程与网络流程相关联，并用该信息标记控制流。最后，捕获代理可以将标记的控制流传送到网络中的第二设备，例如收集器。