公开(公告)号：US10567247B2

公开(公告)日：2020-02-18

申请号：US15145630

申请日：2016-05-03

Applicant: Cisco Technology, Inc.

Inventor： Ashutosh Kulshreshtha ,  Supreeth Hosur Nagesh Rao ,  Navindra Yadav ,  Anubhav Gupta ,  Sunil Kumar Gupta ,  Varun Sagar Malhorta ,  Shashidhar Gandham

IPC: G06F17/00 ,  H04L29/06 ,  H04L12/26 ,  G06F9/455 ,  G06N20/00 ,  G06F16/29 ,  G06F16/248 ,  G06F16/28 ,  G06F16/9535 ,  G06F16/2457 ,  G06F21/55 ,  G06F21/56 ,  H04L12/851 ,  H04L12/24 ,  H04W84/18 ,  H04L29/08 ,  G06F21/53 ,  H04L12/723 ,  G06F3/0484 ,  H04L1/24 ,  H04W72/08 ,  H04L9/08 ,  H04L9/32 ,  H04J3/06 ,  H04J3/14 ,  H04L29/12 ,  H04L12/813 ,  H04L12/823 ,  H04L12/801 ,  H04L12/741 ,  H04L12/833 ,  H04L12/721 ,  G06F3/0482 ,  G06T11/20 ,  H04L12/841 ,  H04L12/725 ,  H04L12/715 ,  G06F16/16 ,  G06F16/17 ,  G06F16/11 ,  G06F16/13 ,  G06N99/00 ,  G06F16/174 ,  G06F16/23

Abstract: An example method can include receiving a traffic report from a sensor and using the traffic report to detect intra-datacenter flows. These intra-datacenter flows can then be compared with a description of historical flows. The description of historical flows can identify characteristics of normal and malicious flows. Based on the comparison, the flows can be classified and tagged as normal, malicious, or anomalous. If the flows are tagged as malicious or anomalous, corrective action can be taken with respect to the flows. A description of the flows can then be added to the description of historical flows.

公开(公告)号：US20200052984A1

公开(公告)日：2020-02-13

申请号：US16658621

申请日：2019-10-21

Applicant: Cisco Technology, Inc.

Inventor： Khawar Deen ,  Navindra Yadav ,  Anubhav Gupta ,  Shashidhar Gandham ,  Rohit Chandra Prasad ,  Abhishek Ranjan Singh ,  Shih-Chun Chang

IPC: H04L12/26 ,  G06F16/174 ,  G06F16/23 ,  G06N99/00 ,  G06F16/17 ,  G06F16/13 ,  G06F16/11 ,  G06F16/16 ,  H04L12/715 ,  H04L12/725 ,  H04L29/08 ,  H04L29/06 ,  H04L12/841 ,  G06T11/20 ,  G06F3/0482 ,  H04L12/721 ,  H04L12/833 ,  H04L12/24 ,  H04L12/851 ,  H04L12/741 ,  H04L12/801 ,  H04L12/823 ,  H04L12/813 ,  H04L29/12 ,  H04J3/14 ,  H04J3/06 ,  H04L9/32 ,  H04L9/08 ,  H04W72/08 ,  H04L1/24 ,  G06F3/0484 ,  H04L12/723 ,  G06F21/53 ,  H04W84/18 ,  G06F21/56 ,  G06F21/55 ,  G06F16/2457 ,  G06F16/9535 ,  G06F16/28 ,  G06F16/248 ,  G06F16/29 ,  G06N20/00 ,  G06F9/455

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

公开(公告)号：US10547544B2

公开(公告)日：2020-01-28

申请号：US15855703

申请日：2017-12-27

Applicant: Cisco Technology, Inc.

Inventor： Thomas James Edsall ,  Navindra Yadav ,  Francisco M. Matus ,  Kit Chiu Chu ,  Michael R. Smith ,  Sameer Merchant ,  Krishna Doddapaneni ,  Satyam Sinha

IPC: H04L12/741 ,  H04L12/46 ,  H04L12/721 ,  H04L12/933 ,  G06F9/455

Abstract: Disclosed herein are methods of forwarding packets on a network, such as a leaf-spine network having leaf devices and spine devices. The methods may include receiving a packet at an ingress leaf device, and determining based, at least in part, on a header of the packet whether the packet is to be transmitted to a spine device. The methods may further include ascertaining based, at least in part, on a header of the packet whether to perform encapsulation on the packet, encapsulating the packet according to a result of the ascertaining, and then transmitting the packet to a spine device according to a result of the determining. Also disclosed herein are network apparatuses which include a processor and a memory, at least one of the processor or the memory being configured to perform some or all of the foregoing described methods.

公开(公告)号：US10536357B2

公开(公告)日：2020-01-14

申请号：US15040829

申请日：2016-02-10

Applicant: Cisco Technology, Inc.

Inventor： Khawar Deen ,  Navindra Yadav ,  Anubhav Gupta ,  Shashidhar Gandham ,  Rohit Chandra Prasad ,  Abhishek Ranjan Singh ,  Shih-Chun Chang

IPC: H04L12/26 ,  H04L29/06 ,  G06F9/455 ,  G06N20/00 ,  G06F16/29 ,  G06F16/248 ,  G06F16/28 ,  G06F16/9535 ,  G06F16/2457 ,  G06F21/55 ,  G06F21/56 ,  H04L12/851 ,  H04L12/24 ,  H04W84/18 ,  H04L29/08 ,  G06F21/53 ,  H04L12/723 ,  G06F3/0484 ,  H04L1/24 ,  H04W72/08 ,  H04L9/08 ,  H04L9/32 ,  H04J3/06 ,  H04J3/14 ,  H04L29/12 ,  H04L12/813 ,  H04L12/823 ,  H04L12/801 ,  H04L12/741 ,  H04L12/833 ,  H04L12/721 ,  G06F3/0482 ,  G06T11/20 ,  H04L12/841 ,  H04L12/725 ,  H04L12/715 ,  G06F16/16 ,  G06F16/17 ,  G06F16/11 ,  G06F16/13 ,  G06N99/00 ,  G06F16/174 ,  G06F16/23

Abstract: Systems, methods, and non-transitory computer-readable storage media for synchronizing timestamps of a sensor report to the clock of a device. In one embodiment, the device receives a report from a sensor of a node. The report can include a network activity of the node captured by the sensor and a first timestamp relative to the clock of the node. The device can then determine a second timestamp relative to the clock of the collector indicating receipt of the report by the device and from the sensor at the node. The device can also determine a delta between the first timestamp and the second timestamp, and a communication latency associated with a communication channel between the device and the sensor. Next, the device can adjust the delta based on the communication latency, and generate a third timestamp based on the adjusted delta.

公开(公告)号：US20190260653A1

公开(公告)日：2019-08-22

申请号：US16403797

申请日：2019-05-06

Applicant: Cisco Technology, Inc.

Inventor： Navindra Yadav ,  Supreeth Hosur Nagesh Rao ,  Ashutosh Kulshreshtha ,  Omid Madani ,  Jackson Ngoc Ki Pang ,  Khawar Deen ,  Ellen Ellen Scheib

IPC: H04L12/26 ,  G06N20/00 ,  G06F16/29 ,  G06F16/2457 ,  G06F16/9535 ,  G06F16/28 ,  G06F16/248 ,  G06F21/56 ,  G06F21/55 ,  H04L29/06 ,  H04L12/813 ,  H04L9/32 ,  H04L9/08 ,  H04L12/721 ,  G06F21/53 ,  H04L12/24 ,  H04L12/851 ,  H04L12/725 ,  H04L12/823 ,  H04L29/12 ,  H04J3/14 ,  H04J3/06 ,  H04W72/08 ,  H04L1/24 ,  H04L29/08 ,  G06F3/0484 ,  H04L12/723 ,  H04L12/833 ,  H04L12/741 ,  H04L12/801 ,  H04W84/18 ,  H04L12/715 ,  H04L12/841 ,  G06T11/20 ,  G06F3/0482 ,  G06F16/11 ,  G06F16/17 ,  G06F16/13 ,  G06N99/00 ,  G06F16/16 ,  G06F16/23 ,  G06F16/174 ,  G06F9/455

Abstract: An example method can include monitoring a network to identify flows between nodes in the network. Once flows have been identified, the flows can be tagged and labelled according to the type of traffic they represent. If a flow represents malicious or otherwise undesirable traffic, it can be tagged accordingly. A request can then be made for a reputation score of an entity which can identify one or more nodes of the network.

公开(公告)号：US20190230011A1

公开(公告)日：2019-07-25

申请号：US15982806

申请日：2018-05-17

Applicant: Cisco Technology, Inc.

Inventor： Shashi Gandham ,  Navindra Yadav ,  Janardhanan Radhakrishnan ,  Hoang-Nam Nguyen ,  Umesh Paul Mahindra ,  Sunil Gupta ,  Praneeth Vallem ,  Supreeth Rao ,  Darshan Shrinath Purandare ,  Xuan Zou ,  Akshay Srirangam ,  Jothi Prakash Prabakaran

IPC: H04L12/26 ,  H04L29/06

Abstract: Aspects of the subject technology relate to a system configured to receive, from a stream processing service, a first network snapshot segment. The first network snapshot segment is associated with metadata that is used to determine that at least one additional network snapshot segment associated with the output stream has not been previously received. The system is configured to request, from the stream processing service, the at least one additional network snapshot segment and generate a first network snapshot by compiling the first network snapshot segment and the at least one additional network snapshot segment.

公开(公告)号：US10326673B2

公开(公告)日：2019-06-18

申请号：US15984826

申请日：2018-05-21

Applicant: Cisco Technology, Inc.

Inventor： Ashutosh Kulshreshtha ,  Hai Trong Vu ,  Michael Standish Watts ,  Jackson Ngoc Ki Pang ,  Navindra Yadav ,  Khawar Deen

IPC: H04L12/26 ,  H04L29/06 ,  G06F9/455 ,  G06N20/00 ,  G06F16/29 ,  G06F16/248 ,  G06F16/28 ,  G06F16/9535 ,  G06F16/2457 ,  H04L12/851 ,  H04L12/24 ,  H04W84/18 ,  H04L29/08 ,  G06F21/53 ,  H04L12/723 ,  G06F3/0484 ,  H04L1/24 ,  H04W72/08 ,  H04L9/08 ,  H04L9/32 ,  H04J3/06 ,  H04J3/14 ,  H04L29/12 ,  H04L12/813 ,  H04L12/823 ,  H04L12/801 ,  H04L12/741 ,  H04L12/833 ,  H04L12/721 ,  G06F3/0482 ,  G06T11/20 ,  H04L12/841 ,  H04L12/725 ,  H04L12/715 ,  G06F21/55 ,  G06F21/56 ,  G06F16/16 ,  G06F16/17 ,  G06F16/11 ,  G06F16/13 ,  G06N99/00

Abstract: In one embodiment, a monitoring device (or module) monitors messages exchanged between nodes in a communication network. The monitoring device further determines, based on time stamp data associated with each message, one or more latency distributions of paired response times between the nodes, and determines a node topology consistent with each of the one or more latency distributions of paired response times between the nodes. In some embodiments, the monitoring device also generates a graph of the node topology showing one or more communication links between the nodes, and annotates each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the latency distributions.

公开(公告)号：US20190182132A1

公开(公告)日：2019-06-13

申请号：US16280894

申请日：2019-02-20

Applicant: Cisco Technology, Inc.

Inventor： Sunil Kumar Gupta ,  Navindra Yadav ,  Michael Standish Watts ,  Ali Parandehgheibi ,  Shashidhar Gandham ,  Ashutosh Kulshreshtha ,  Khawar Deen

IPC: H04L12/26 ,  G06F16/29 ,  G06F16/2457 ,  G06F16/9535 ,  G06F16/28 ,  G06F16/248 ,  G06N20/00 ,  G06F21/56 ,  G06F21/55 ,  H04L29/06 ,  H04L12/813 ,  H04L9/32 ,  H04L9/08 ,  H04L12/721 ,  G06F21/53 ,  H04L12/24 ,  H04L12/851 ,  H04L12/725 ,  H04L12/823 ,  H04L29/12 ,  H04J3/14 ,  H04J3/06 ,  H04W72/08 ,  H04L1/24 ,  H04L29/08 ,  G06F3/0484 ,  H04L12/723 ,  H04L12/833 ,  H04L12/741 ,  H04L12/801 ,  H04W84/18 ,  H04L12/715 ,  H04L12/841 ,  G06T11/20 ,  G06F3/0482 ,  G06F16/11 ,  G06F16/17 ,  G06F16/13 ,  G06N99/00 ,  G06F16/16 ,  G06F16/23 ,  G06F16/174 ,  G06F9/455

Abstract: A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

公开(公告)号：US20190182101A1

公开(公告)日：2019-06-13

申请号：US15834865

申请日：2017-12-07

Applicant: Cisco Technology, Inc.

Inventor： Ashutosh Kulshreshtha ,  Andy Sloane ,  Navindra Yadav ,  Oliver Kempe ,  Uday Krishnaswamy Chettiar ,  Vimal Jeyakumar

IPC: H04L12/24

CPC classification number: H04L41/0631 ,  H04L41/0622 ,  H04L41/069 ,  H04L41/22 ,  H04L41/5009

Abstract: The disclosed technology relates to log file processing techniques for root cause analysis of a network fabric. A system may be configured to identify a feature of interest in a log file and calculating an abnormal level for the feature of interest. The system is further configured to detect that a performance event has occurred during a time period, determine whether the feature of interest is at the abnormal level during the time period, and identify a correlation between the feature of interest and the performance event based on the determining.

公开(公告)号：US20190173777A1

公开(公告)日：2019-06-06

申请号：US16268409

申请日：2019-02-05

Applicant: Cisco Technology, Inc.

Inventor： Kit Chiu Chu ,  Thomas J. Edsall ,  Navindra Yadav ,  Francisco M. Matus ,  Krishna Doddapaneni ,  Satyam Sinha

IPC: H04L12/703 ,  H04L12/26 ,  H04L12/18 ,  H04L12/755 ,  H04L12/46 ,  H04L12/707 ,  H04L12/753 ,  H04L12/743 ,  H04L12/741 ,  H04L29/12 ,  H04L12/931 ,  H04L12/24 ,  H04L12/723 ,  H04L12/709 ,  H04L29/08 ,  H04L12/58 ,  H04L29/06 ,  H04L12/751

Abstract: Aspects of the subject disclosure relate to methods for detecting a link failure between the first network device and a destination node, receiving a data packet addressed to the destination node, and rewriting encapsulation information of the first data packet. Subsequent to rewriting the encapsulation information of the first data packet, the first data packet is forwarded to a second network device (e.g., using updated address information in the packet header), wherein the second network device is paired with the first network device in the virtual port channel. In certain aspects, systems and computer readable media are also provided.