公开(公告)号：US20230133892A1

公开(公告)日：2023-05-04

申请号：US17668639

申请日：2022-02-10

申请人： Cisco Technology, Inc.

发明人： Jan Kohout ,  Martin Kopp ,  Kyrylo Shcherbin ,  Jaroslav Hlavac ,  Cenek Skarda

IPC分类号： H04L9/40

摘要： Techniques for combining threat-related events associated with different modalities to provide a complete insight into cyber attack life cycles. The techniques may include receiving telemetry data associated with one or more modalities and detecting, based at least in part on the telemetry data, one or more abnormal events associated with security incidents. The one or more abnormal events may include at least a first abnormal event associated with a first modality and a second abnormal event associated with a second modality. The techniques may also include determining that an entity associated with the abnormal events is a same entity and, based at least in part on the entity comprising the same entity, determining that a correlation between the abnormal events is indicative of a security incident. Based at least in part on the correlation, an indication associated with the security incident may be output.

公开(公告)号：US10805377B2

公开(公告)日：2020-10-13

申请号：US15598541

申请日：2017-05-18

申请人： Cisco Technology, Inc.

发明人： Martin Grill ,  Jan Kohout ,  Martin Kopp

IPC分类号： H04L29/08 ,  H04W12/06 ,  H04W12/00 ,  H04L29/06 ,  H04L12/26

摘要： A computing device having connectivity to a network stores one or more existing device models, where each of the one or more existing device models is a representation of a different client device used by a first authenticated user to access the network. The computing device obtains a device sample, which comprises network traffic data that is captured during a period of time and which is generated by a particular client device associated with the authenticated user of the network. The computing device determines, based on one or more relational criteria, whether the device sample should be assigned to one of the one or more existing device models or to an additional device model that has not yet been created. The computing device then determines relative identity of the particular client device based on whether the device sample is assigned to one of the one or more device models or to an additional device model that has not yet been created.

公开(公告)号：US20200244672A1

公开(公告)日：2020-07-30

申请号：US16261682

申请日：2019-01-30

申请人： Cisco Technology, Inc.

发明人： Martin Grill ,  Lukas Bajer ,  Martin Kopp ,  Jan Kohout

IPC分类号： H04L29/06

摘要： In one embodiment, a device in a network obtains log data regarding replication of files stored on an endpoint client to a file replication service. The device tracks, based on the obtained logs, encryption changes to the files that convert the files from unencrypted files to encrypted files. The device determines that the tracked encryption changes to the files are indicative of a ransomware infection on the endpoint client. The device initiates a mitigation action regarding the ransomware infection.

公开(公告)号：US20200120004A1

公开(公告)日：2020-04-16

申请号：US16156020

申请日：2018-10-10

申请人： Cisco Technology, Inc.

发明人： Jan Kohout ,  Martin Grill ,  Martin Kopp ,  Lukas Bajer

IPC分类号： H04L12/26 ,  H04L12/851

摘要： In one embodiment, a traffic analysis service obtains telemetry data regarding network traffic associated with a device in a network. The traffic analysis service forms a histogram of frequencies of the traffic features from the telemetry data for the device. The traffic features are indicative of endpoints with which the device communicated. The traffic analysis service associates a device type with the device, by comparing the histogram of the traffic features from the telemetry data to histograms of traffic features associated with other devices. The traffic analysis service initiates, based on the device type associated with the device, an adjustment to treatment of the traffic associated with the device by the network.

公开(公告)号：US11985154B2

公开(公告)日：2024-05-14

申请号：US17668639

申请日：2022-02-10

申请人： Cisco Technology, Inc.

发明人： Jan Kohout ,  Martin Kopp ,  Kyrylo Shcherbin ,  Jaroslav Hlavac ,  Cenek Skarda

IPC分类号： H04L9/40

CPC分类号： H04L63/1425

摘要： Techniques for combining threat-related events associated with different modalities to provide a complete insight into cyber attack life cycles. The techniques may include receiving telemetry data associated with one or more modalities and detecting, based at least in part on the telemetry data, one or more abnormal events associated with security incidents. The one or more abnormal events may include at least a first abnormal event associated with a first modality and a second abnormal event associated with a second modality. The techniques may also include determining that an entity associated with the abnormal events is a same entity and, based at least in part on the entity comprising the same entity, determining that a correlation between the abnormal events is indicative of a security incident. Based at least in part on the correlation, an indication associated with the security incident may be output.

公开(公告)号：US20240031328A1

公开(公告)日：2024-01-25

申请号：US18110138

申请日：2023-02-15

申请人： Cisco Technology, Inc.

发明人： Kyrylo Shcherbin ,  Jan Stercl ,  Jan Kohout ,  Martin Kopp

IPC分类号： H04L61/4594

CPC分类号： H04L61/4594

摘要： This disclosure describes techniques for matching entities across a computing network using data from different telemetries. The techniques include receiving telemetry data of the computing network, the telemetry data including identifying information corresponding to an entity, associated information of the computing network, and/or timestamps. The techniques also include establishing one or more time windows based at least in part on the timestamps. A particular time window may be determined to correspond to the associated information. The techniques may include attributing the associated information to the entity. In some cases, an address book may be maintained, including mappings of the identifying information, the associated information, and/or time windows.

公开(公告)号：US20210152526A1

公开(公告)日：2021-05-20

申请号：US16686364

申请日：2019-11-18

申请人： Cisco Technology, Inc.

发明人： Jan Kohout ,  Martin Kopp ,  Jan Brabec ,  Lukas Bajer

IPC分类号： H04L29/06 ,  H04L12/26

摘要： In one embodiment, a traffic analysis service obtains telemetry data regarding encrypted traffic associated with a particular device in the network, wherein the telemetry data comprises Transport Layer Security (TLS) features of the traffic. The service determines, based on the TLS features from the obtained telemetry data, a set of one or more TLS fingerprints for the traffic associated with the particular device. The service calculates a measure of similarity between the set of one or more TLS fingerprints for the traffic associated with the particular device and a set of one or more TLS fingerprints of traffic associated with a second device. The service determines, based on the measure of similarity, that the particular device and the second device were operated by the same user.

公开(公告)号：US20190319976A1

公开(公告)日：2019-10-17

申请号：US16447150

申请日：2019-06-20

申请人： Cisco Technology, Inc.

发明人： Martin Kopp ,  Martin Grill ,  Jan Kohout

IPC分类号： H04L29/06 ,  H04L9/32

摘要： In one embodiment, a device in a network receives traffic information regarding one or more secure sessions in the network. The device associates the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information. The device makes a self-signed certificate determination for an endpoint domain of a particular secure session based on whether the particular secure session is associated with certificate validation check traffic. The device causes the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.

公开(公告)号：US10375097B2

公开(公告)日：2019-08-06

申请号：US15386006

申请日：2016-12-21

申请人： Cisco Technology, Inc.

发明人： Martin Kopp ,  Martin Grill ,  Jan Kohout

IPC分类号： H04L29/06 ,  H04L9/32

摘要： In one embodiment, a device in a network receives traffic information regarding one or more secure sessions in the network. The device associates the one or more secure sessions with corresponding certificate validation check traffic indicated by the received traffic information. The device makes a self-signed certificate determination for an endpoint domain of a particular secure session based on whether the particular secure session is associated with certificate validation check traffic. The device causes the self-signed certificate determination for the endpoint domain to be used as input to a malware detector.

公开(公告)号：US20180337831A1

公开(公告)日：2018-11-22

申请号：US15598541

申请日：2017-05-18

申请人： Cisco Technology, Inc.

发明人： Martin Grill ,  Jan Kohout ,  Martin Kopp

IPC分类号： H04L12/24 ,  H04L29/08 ,  H04L12/26

CPC分类号： H04L67/02 ,  H04L43/065 ,  H04L63/1425 ,  H04L67/303 ,  H04W12/0027 ,  H04W12/06

摘要： A computing device having connectivity to a network stores one or more existing device models, where each of the one or more existing device models is a representation of a different client device used by a first authenticated user to access the network. The computing device obtains a device sample, which comprises network traffic data that is captured during a period of time and which is generated by a particular client device associated with the authenticated user of the network. The computing device determines, based on one or more relational criteria, whether the device sample should be assigned to one of the one or more existing device models or to an additional device model that has not yet been created. The computing device then determines relative identity of the particular client device based on whether the device sample is assigned to one of the one or more device models or to an additional device model that has not yet been created.