-
1.
公开(公告)号:US11968102B2
公开(公告)日:2024-04-23
申请号:US15171618
申请日:2016-06-02
Applicant: Cisco Technology, Inc.
Inventor: Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC: G06F15/16 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/455 , G06F16/11 , G06F16/13 , G06F16/16 , G06F16/17 , G06F16/174 , G06F16/23 , G06F16/2457 , G06F16/248 , G06F16/28 , G06F16/29 , G06F16/9535 , G06F21/53 , G06F21/55 , G06F21/56 , G06N20/00 , G06N99/00 , G06T11/20 , H04J3/06 , H04J3/14 , H04L1/24 , H04L9/08 , H04L9/32 , H04L9/40 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/026 , H04L43/04 , H04L43/045 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0852 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/00 , H04L45/302 , H04L45/50 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/5007 , H04L67/01 , H04L67/10 , H04L67/1001 , H04L67/12 , H04L67/51 , H04L67/75 , H04L69/16 , H04L69/22 , H04W72/54 , H04W84/18 , H04L67/50
CPC classification number: H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F16/122 , G06F16/137 , G06F16/162 , G06F16/17 , G06F16/173 , G06F16/174 , G06F16/1744 , G06F16/1748 , G06F16/2322 , G06F16/235 , G06F16/2365 , G06F16/24578 , G06F16/248 , G06F16/285 , G06F16/288 , G06F16/29 , G06F16/9535 , G06F21/53 , G06F21/552 , G06F21/556 , G06F21/566 , G06N20/00 , G06N99/00 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/026 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/5007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/01 , H04L67/10 , H04L67/1001 , H04L67/12 , H04L67/51 , H04L67/75 , H04L69/16 , H04L69/22 , H04W72/54 , H04W84/18 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , H04L67/535
Abstract: A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.
-
公开(公告)号:US11528283B2
公开(公告)日:2022-12-13
申请号:US16899190
申请日:2020-06-11
Applicant: Cisco Technology, Inc.
Inventor: Navindra Yadav , Abhishek Ranjan Singh , Shashidhar Gandham , Ellen Christine Scheib , Omid Madani , Ali Parandehgheibi , Jackson Ngoc Ki Pang , Vimalkumar Jeyakumar , Michael Standish Watts , Hoang Viet Nguyen , Khawar Deen , Rohit Chandra Prasad , Sunil Kumar Gupta , Supreeth Hosur Nagesh Rao , Anubhav Gupta , Ashutosh Kulshreshtha , Roberto Fernando Spadaro , Hai Trong Vu , Varun Sagar Malhotra , Shih-Chun Chang , Bharathwaj Sankara Viswanathan , Fnu Rachita Agasthy , Duane Thomas Barlow
IPC: H04L29/06 , H04L12/26 , H04L9/40 , H04L43/04 , H04L43/0894 , H04L43/062
Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.
-
公开(公告)号:US11368378B2
公开(公告)日:2022-06-21
申请号:US16725945
申请日:2019-12-23
Applicant: Cisco Technology, Inc.
Inventor: Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra
IPC: H04L12/26 , H04L29/06 , G06F16/28 , G06F16/2457 , G06F16/248 , G06F16/29 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06F16/174 , G06F16/23 , G06F9/455 , G06N20/00 , G06N99/00 , H04L9/32 , H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F16/9535 , G06F21/53 , G06F21/55 , G06T11/20 , H04J3/06 , H04J3/14 , H04L1/24 , H04L9/08 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/026 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0852 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/302 , H04L45/00 , H04L45/50 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/5007 , H04L9/40 , H04L67/10 , H04L67/1001 , H04L67/12 , H04L67/51 , H04L67/75 , H04L67/01 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18 , H04L12/24 , H04L67/50
Abstract: Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.
-
公开(公告)号:US10320630B2
公开(公告)日:2019-06-11
申请号:US15171855
申请日:2016-06-02
Applicant: Cisco Technology, Inc.
Inventor: Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra
IPC: H04L12/26 , H04L29/06 , G06F9/455 , G06N20/00 , G06F16/29 , G06F16/248 , G06F16/28 , G06F16/9535 , G06F16/2457 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06N99/00 , G06F16/174 , G06F16/23
Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.
-
公开(公告)号:US10181987B2
公开(公告)日:2019-01-15
申请号:US15171807
申请日:2016-06-02
Applicant: Cisco Technology, Inc.
Inventor: Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra
IPC: G06F15/173 , H04L12/26 , H04L29/06 , G06F9/455 , G06F17/30 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06N99/00 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56
Abstract: Systems, methods, and computer-readable media for collector high availability. In some embodiments, a system receives, from a first collector device, a first data report generated by a capturing agent deployed on a host system in a network. The system can also receive, from a second collector device, a second data report generated by the capturing agent deployed on the host system. The first and second data reports can include traffic data captured at the host system by the capturing agent during a period of time. The system can determine that the first data report and the second data report are both associated with the capturing agent, and identify duplicate data contained in the first data report and the second data report. The system can then deduplicate the first and second data reports to yield a deduplicated data report.
-
6.
公开(公告)号:US20160359708A1
公开(公告)日:2016-12-08
申请号:US15171855
申请日:2016-06-02
Applicant: Cisco Technology, Inc.
Inventor: Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra
CPC classification number: H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F17/30241 , G06F17/3053 , G06F17/30554 , G06F17/30598 , G06F17/30604 , G06F17/30867 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N99/005 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18
Abstract: Systems, methods, and computer-readable media for hierarchichal sharding of flows from sensors to collectors. A first collector can receive a first portion of a network flow from a first capturing agent and determine that a second portion of the network flow was not received from the first capturing agent. The first collector can then send the first portion of the network flow to a second collector. A third collector can receive the second portion of the network flow from a second capturing agent and determine that the third collector did not receive the first portion of the network flow. The third collector can then send the second portion of the network flow to the second collector. The second collector can then aggregate the first portion and second portion of the network flow to yield the entire portion of the network flow.
Abstract translation: 用于从传感器到收集器的流层分层划分的系统,方法和计算机可读介质。 第一收集器可以接收来自第一捕获代理的网络流的第一部分,并且确定网络流的第二部分未被从第一捕获代理接收。 然后,第一收集器可以将网络流的第一部分发送到第二收集器。 第三收集器可以从第二捕获代理接收网络流的第二部分,并且确定第三收集器没有接收网络流的第一部分。 然后,第三收集器可以将网络流的第二部分发送到第二收集器。 然后,第二收集器可以聚合网络流的第一部分和第二部分以产生网络流的整个部分。
-
公开(公告)号:US20160359699A1
公开(公告)日:2016-12-08
申请号:US15171836
申请日:2016-06-02
Applicant: Cisco Technology, Inc.
Inventor: Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Navindra Yadav , Khawar Deen , Varun Sagar Malhotra
IPC: H04L12/26 , H04L12/851 , H04L12/741
Abstract: Systems, methods, and computer-readable media for identifying bogon addresses. A system can obtain an indication of address spaces in a network. The indication can be based on route advertisements transmitted by routers associated with the network. The system can receive a report generated by a capturing agent deployed on a host. The report can identify a flow captured by the capturing agent at the host. The system can identify a network address associated with the flow and, based on the indication of address spaces, the system can determine whether the network address is within the address spaces in the network. When the network address is not within the address spaces in the network, the system can determine that the network address is a bogon address. When the network address is within the address spaces in the network, the system can determine that the network address is not a bogon address.
Abstract translation: 用于识别浮标地址的系统,方法和计算机可读介质。 系统可以获得网络中地址空间的指示。 该指示可以基于与网络相关联的路由器发送的路由通告。 系统可以接收由主机部署的捕获代理生成的报告。 报告可以识别主机捕获代理捕获的流量。 系统可以识别与流相关联的网络地址,并且基于地址空间的指示,系统可以确定网络地址是否在网络中的地址空间内。 当网络地址不在网络中的地址空间内时,系统可以确定网络地址是一个浮标地址。 当网络地址在网络中的地址空间内时,系统可以确定网络地址不是一个浮标地址。
-
公开(公告)号:US20240179153A1
公开(公告)日:2024-05-30
申请号:US18436185
申请日:2024-02-08
Applicant: Cisco Technology, Inc.
Inventor: Navindra Yadav , Abhishek Ranjan Singh , Shashidhar Gandham , Ellen Christine Scheib , Omid Madani , Ali Parandehgheibi , Jackson Ngoc Ki Pang , Vimalkumar Jeyakumar , Michael Standish Watts , Hoang Viet Nguyen , Khawar Deen , Rohit Chandra Prasad , Sunil Kumar Gupta , Supreeth Hosur Nagesh Rao , Anubhav Gupta , Ashutosh Kulshreshtha , Roberto Fernando Spadaro , Hai Trong Vu , Varun Sagar Malhotra , Shih-Chun Chang , Bharathwaj Sankara Viswanathan , Fnu Rachita Agasthy , Duane Thomas Barlow
IPC: H04L9/40 , H04L43/04 , H04L43/062 , H04L43/0894
CPC classification number: H04L63/1408 , H04L43/04 , H04L43/0894 , H04L63/02 , H04L63/1425 , H04L43/062
Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.
-
公开(公告)号:US11601349B2
公开(公告)日:2023-03-07
申请号:US16846117
申请日:2020-04-10
Applicant: Cisco Technology, Inc.
Inventor: Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC: H04L29/06 , H04L43/045 , H04L9/40 , G06F9/455 , G06N20/00 , G06F21/55 , G06F21/56 , G06F16/28 , G06F16/2457 , G06F16/248 , G06F16/29 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06F16/174 , G06F16/23 , G06F16/9535 , G06N99/00 , H04L9/32 , H04L41/0668 , H04L43/0805 , H04L43/0811 , H04L43/0852 , H04L43/106 , H04L45/00 , H04L45/50 , H04L67/12 , H04L43/026 , H04L61/5007 , H04L67/01 , H04L67/51 , H04L67/75 , H04L67/1001 , H04L43/062 , H04L43/10 , H04L47/2441 , H04L41/0893 , H04L43/08 , H04L43/04 , H04W84/18 , H04L67/10 , H04L41/046 , H04L43/0876 , H04L41/12 , H04L41/16 , H04L41/0816 , G06F21/53 , H04L41/22 , G06F3/04842 , G06F3/04847 , H04L41/0803 , H04L43/0829 , H04L43/16 , H04L1/24 , H04W72/08 , H04L9/08 , H04J3/06 , H04J3/14 , H04L47/20 , H04L47/32 , H04L43/0864 , H04L47/11 , H04L69/22 , H04L45/74 , H04L47/2483 , H04L43/0882 , H04L41/0806 , H04L43/0888 , H04L43/12 , H04L47/31 , G06F3/0482 , G06T11/20 , H04L43/02 , H04L47/28 , H04L69/16 , H04L45/302 , H04L67/50
Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed outside of the first host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that a hidden process exists and corrective action can be taken.
-
公开(公告)号:US11431592B2
公开(公告)日:2022-08-30
申请号:US16658621
申请日:2019-10-21
Applicant: Cisco Technology, Inc.
Inventor: Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC: G06F17/00 , G06F15/16 , G06F9/00 , H04L43/045 , H04L9/40 , G06F9/455 , G06N20/00 , G06F21/55 , G06F21/56 , G06F16/28 , G06F16/2457 , G06F16/248 , G06F16/29 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06F16/174 , G06F16/23 , G06F16/9535 , G06N99/00 , H04L9/32 , H04L41/0668 , H04L43/0805 , H04L43/0811 , H04L43/0852 , H04L43/106 , H04L45/00 , H04L45/50 , H04L67/12 , H04L67/01 , H04L43/026 , H04L43/062 , H04L43/10 , H04L47/2441 , H04L41/0893 , H04L43/08 , H04L43/04 , H04W84/18 , H04L67/10 , H04L67/51 , H04L41/046 , H04L43/0876 , H04L41/12 , H04L41/16 , H04L41/0816 , G06F21/53 , H04L41/22 , G06F3/04842 , G06F3/04847 , H04L41/0803 , H04L67/75 , H04L43/0829 , H04L43/16 , H04L1/24 , H04W72/08 , H04L9/08 , H04J3/06 , H04J3/14 , H04L61/5007 , H04L47/20 , H04L47/32 , H04L43/0864 , H04L47/11 , H04L69/22 , H04L45/74 , H04L47/2483 , H04L43/0882 , H04L41/0806 , H04L43/0888 , H04L43/12 , H04L47/31 , G06F3/0482 , G06T11/20 , H04L43/02 , H04L47/28 , H04L69/16 , H04L67/1001 , H04L45/302 , H04L67/50
Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.
-
-
-
-
-
-
-
-
-