专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US11277337B2 Systems and methods for routing network traffic using labels 有权
公开(公告)号：US11277337B2
公开(公告)日：2022-03-15
申请号：US16750139
申请日：2020-01-23
申请人： Cisco Technology Inc.
发明人： Hendrikus G. P. Bosch , Stefan Olofsson , Ijsbrand Wijnands , Anubhav Gupta , Jeffrey Napper , Sape Jurriën Mullender
IPC分类号： H04L12/723 , H04L12/755 , H04L12/717 , H04L29/12 , H04L29/06 , H04L29/08 , H04L12/741 , H04L12/725 , H04L45/50 , H04L45/021 , H04L67/63 , H04L61/4511 , H04L45/42
摘要： In one embodiment, a method includes detecting a request to route traffic to a service associated with an application. The method also includes identifying an application identifier associated with the application and selecting, using the application identifier, a label from a plurality of labels included in a routing table. The label includes one or more routes. The method further includes routing the traffic to the service associated with the application using the label.

2. 发明申请

US20220038353A1 TECHNOLOGIES FOR ANNOTATING PROCESS AND USER INFORMATION FOR NETWORK FLOWS 有权
公开(公告)号：US20220038353A1
公开(公告)日：2022-02-03
申请号：US17503097
申请日：2021-10-15
申请人： Cisco Technology, Inc.
发明人： Navindra Yadav , Abhishek Ranjan Singh , Anubhav Gupta , Shashidhar Gandham , Jackson Ngoc Ki Pang , Shih-Chun Chang , Hai Trong Vu
IPC分类号： H04L12/26 , H04L29/06 , G06F9/455 , G06N20/00 , G06F21/55 , G06F21/56 , G06F16/28 , G06F16/2457 , G06F16/248 , G06F16/29 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06F16/174 , G06F16/23 , G06F16/9535 , G06N99/00 , H04L9/32 , H04L12/24 , H04L12/715 , H04L12/723 , H04L29/08 , H04L12/851 , H04W84/18 , G06F21/53 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725
摘要： Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

3. 发明授权

US10862776B2 System and method of spoof detection 有权
公开(公告)号：US10862776B2
公开(公告)日：2020-12-08
申请号：US15171666
申请日：2016-06-02
申请人： Cisco Technology, Inc.
发明人： Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC分类号： H04L12/26 , H04L29/06 , G06F21/56 , H04L12/833 , G06F9/455 , G06N20/00 , G06F21/55 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06F21/53 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , G06F16/23 , G06F16/28 , G06F16/2457 , G06F16/248 , G06F16/29 , H04L12/723
摘要： Managing a network environment to identify spoofed packets is disclosed. A method includes analyzing, via a first capture agent, packets processed by a first environment in a network associated with a first host, and analyzing, via a second capture agent, packets processed by a second environment in the network associated with a second host. The method includes collecting the first data and the second data at a collector and generating a topological map of the network and a history of network activity associated with the first environment and the second environment. The method includes extracting network data from a packet and comparing the extracted network data with stored network data in the database. When the comparison indicates that the extracted network data does not match the stored network data (i.e., the reported source does not match an expected source for the packet), determining that the packet is a spoofed packet.

4. 发明授权

US10454793B2 System and method of detecting whether a source of a packet flow transmits packets which bypass an operating system stack 有权
公开(公告)号：US10454793B2
公开(公告)日：2019-10-22
申请号：US15171879
申请日：2016-06-02
申请人： Cisco Technology, Inc.
发明人： Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC分类号： G06F17/00 , G06F15/16 , G06F9/00 , H04L12/26 , H04L29/06 , G06F9/455 , G06N20/00 , G06F16/29 , G06F16/248 , G06F16/28 , G06F16/9535 , G06F16/2457 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06N99/00 , G06F16/174 , G06F16/23
摘要： A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

5. 发明授权

US10439904B2 System and method of determining malicious processes 有权
公开(公告)号：US10439904B2
公开(公告)日：2019-10-08
申请号：US15171707
申请日：2016-06-02
申请人： Cisco Technology, Inc.
发明人： Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC分类号： G06F11/00 , H04L12/26 , H04L29/06 , G06F9/455 , G06N20/00 , G06F16/29 , G06F16/248 , G06F16/28 , G06F16/9535 , G06F16/2457 , H04L12/851 , H04L12/24 , H04W84/18 , H04L29/08 , G06F21/53 , H04L12/723 , G06F3/0484 , H04L1/24 , H04W72/08 , H04L9/08 , H04L9/32 , H04J3/06 , H04J3/14 , H04L29/12 , H04L12/813 , H04L12/823 , H04L12/801 , H04L12/741 , H04L12/833 , H04L12/721 , G06F3/0482 , G06T11/20 , H04L12/841 , H04L12/725 , H04L12/715 , G06F21/55 , G06F21/56 , G06F16/16 , G06F16/17 , G06F16/11 , G06F16/13 , G06N99/00 , G06F16/174 , G06F16/23
摘要： Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. A method includes determining a lineage for a process within the network and then evaluating, through knowledge of the lineage, the source of the command that initiated the process. The method includes capturing data from a plurality of capture agents at different layers of a network, each capture agent of the plurality of capture agents configured to observe network activity at a particular location in the network, developing, based on the data, a lineage for a process associated with the network activity and, based on the lineage, identifying an anomaly within the network.

6. 发明申请

US20190215253A1 TECHNOLOGIES FOR ANNOTATING PROCESS AND USER INFORMATION FOR NETWORK FLOWS 审中-公开
公开(公告)号：US20190215253A1
公开(公告)日：2019-07-11
申请号：US16237187
申请日：2018-12-31
申请人： Cisco Technology, Inc.
发明人： Navindra Yadav , Abhishek Ranjan Singh , Anubhav Gupta , Shashidhar Gandham , Jackson Ngoc Ki Pang , Shih-Chun Chang , Hai Trong Vu
IPC分类号： H04L12/26 , G06N20/00 , G06F16/29 , G06F16/2457 , G06F16/9535 , G06F16/28 , G06F16/248 , G06F21/56 , G06F21/55 , H04L29/06 , H04L12/813 , H04L9/32 , H04L9/08 , H04L12/721 , G06F21/53 , H04L12/24 , H04L12/851 , H04L12/725 , H04L12/823 , H04L29/12 , H04J3/14 , H04J3/06 , H04W72/08 , H04L1/24 , H04L29/08 , G06F3/0484 , H04L12/723 , H04L12/833 , H04L12/741 , H04L12/801 , H04W84/18 , H04L12/715 , H04L12/841 , G06T11/20 , G06F3/0482 , G06F16/11 , G06F16/17 , G06F16/13 , G06N99/00 , G06F16/16 , G06F16/23 , G06F16/174 , G06F9/455
CPC分类号： H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F16/122 , G06F16/137 , G06F16/162 , G06F16/17 , G06F16/173 , G06F16/174 , G06F16/1744 , G06F16/1748 , G06F16/2322 , G06F16/235 , G06F16/2365 , G06F16/24578 , G06F16/248 , G06F16/285 , G06F16/288 , G06F16/29 , G06F16/9535 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N20/00 , G06N99/00 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18
摘要： Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

7. 发明授权

US10142353B2 System for monitoring and managing datacenters 有权
公开(公告)号：US10142353B2
公开(公告)日：2018-11-27
申请号：US15134100
申请日：2016-04-20
申请人： Cisco Technology, Inc.
发明人： Navindra Yadav , Abhishek Ranjan Singh , Shashidhar Gandham , Ellen Christine Scheib , Omid Madani , Ali Parandehgheibi , Jackson Ngoc Ki Pang , Vimalkumar Jeyakumar , Michael Standish Watts , Hoang Viet Nguyen , Khawar Deen , Rohit Chandra Prasad , Sunil Kumar Gupta , Supreeth Hosur Nagesh Rao , Anubhav Gupta , Ashutosh Kulshreshtha , Roberto Fernando Spadaro , Hai Trong Vu , Varun Sagar Malhotra , Shih-Chun Chang , Bharathwaj Sankara Viswanathan , Fnu Rachita Agasthy , Duane Thomas Barlow
IPC分类号： H04L29/06 , H04L12/26
摘要： An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

8. 发明申请

US20160359879A1 SYSTEM AND METHOD OF DETECTING HIDDEN PROCESSES BY ANALYZING PACKET FLOWS 审中-公开
标题翻译：通过分析包装流动检测隐藏过程的系统和方法
公开(公告)号：US20160359879A1
公开(公告)日：2016-12-08
申请号：US15171930
申请日：2016-06-02
申请人： Cisco Technology, Inc.
发明人： Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC分类号： H04L29/06
CPC分类号： H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F16/122 , G06F16/137 , G06F16/162 , G06F16/17 , G06F16/173 , G06F16/174 , G06F16/1744 , G06F16/1748 , G06F16/2322 , G06F16/235 , G06F16/2365 , G06F16/24578 , G06F16/248 , G06F16/285 , G06F16/288 , G06F16/29 , G06F16/9535 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N20/00 , G06N99/00 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18
摘要： A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed outside of the first host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that a hidden process exists and corrective action can be taken.
摘要翻译：一种方法包括使用部署在第一主机处的第一捕获代理捕获与来自第一主机的第一分组流相关联的第一数据，以产生第一流数据，从第二主捕获与第一主机起源的第二分组流相关联的第二数据部署在第一主机之外的捕获代理产生第二流数据并比较第一流数据和第二流数据以产生差异。当差异高于阈值时，该方法包括确定存在隐藏过程并且可以采取校正动作。

9. 发明申请

US20160359711A1 LATE DATA DETECTION IN DATA CENTER 审中-公开
标题翻译：数据中心的最新数据检测
公开(公告)号：US20160359711A1
公开(公告)日：2016-12-08
申请号：US15040829
申请日：2016-02-10
申请人： Cisco Technology, Inc.
发明人： Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC分类号： H04L12/26 , H04J3/06 , H04J3/14 , H04L29/08
摘要： Systems, methods, and non-transitory computer-readable storage media for synchronizing timestamps of a sensor report to the clock of a device. In one embodiment, the device receives a report from a sensor of a node. The report can include a network activity of the node captured by the sensor and a first timestamp relative to the clock of the node. The device can then determine a second timestamp relative to the clock of the collector indicating receipt of the report by the device and from the sensor at the node. The device can also determine a delta between the first timestamp and the second timestamp, and a communication latency associated with a communication channel between the device and the sensor. Next, the device can adjust the delta based on the communication latency, and generate a third timestamp based on the adjusted delta.
摘要翻译：用于将传感器报告的时间戳与设备的时钟同步的系统，方法和非暂时的计算机可读存储介质。在一个实施例中，设备从节点的传感器接收报告。报告可以包括由传感器捕获的节点的网络活动和相对于节点的时钟的第一时间戳。然后，设备可以确定相对于收集器的时钟的第二时间戳，指示由设备和节点处的传感器接收报告。设备还可以确定第一时间戳和第二时间戳之间的增量，以及与设备和传感器之间的通信信道相关联的通信等待时间。接下来，设备可以基于通信延迟来调整增量，并且基于经调整的增量生成第三时间戳。

10. 发明申请

US20160359698A1 SYSTEM AND METHOD OF DETECTING PACKET LOSS IN A DISTRIBUTED SENSOR-COLLECTOR ARCHITECTURE 审中-公开
标题翻译：在分布式传感器收集架构中检测分组丢失的系统和方法
公开(公告)号：US20160359698A1
公开(公告)日：2016-12-08
申请号：US15171618
申请日：2016-06-02
申请人： Cisco Technology, Inc.
发明人： Khawar Deen , Navindra Yadav , Anubhav Gupta , Shashidhar Gandham , Rohit Chandra Prasad , Abhishek Ranjan Singh , Shih-Chun Chang
IPC分类号： H04L12/26
CPC分类号： H04L43/045 , G06F3/0482 , G06F3/04842 , G06F3/04847 , G06F9/45558 , G06F16/122 , G06F16/137 , G06F16/162 , G06F16/17 , G06F16/173 , G06F16/174 , G06F16/1744 , G06F16/1748 , G06F16/2322 , G06F16/235 , G06F16/2365 , G06F16/24578 , G06F16/248 , G06F16/285 , G06F16/288 , G06F16/29 , G06F16/9535 , G06F21/53 , G06F21/552 , G06F21/566 , G06F2009/4557 , G06F2009/45587 , G06F2009/45591 , G06F2009/45595 , G06F2221/033 , G06F2221/2101 , G06F2221/2105 , G06F2221/2111 , G06F2221/2115 , G06F2221/2145 , G06N20/00 , G06N99/00 , G06T11/206 , H04J3/0661 , H04J3/14 , H04L1/242 , H04L9/0866 , H04L9/3239 , H04L9/3242 , H04L41/046 , H04L41/0668 , H04L41/0803 , H04L41/0806 , H04L41/0816 , H04L41/0893 , H04L41/12 , H04L41/16 , H04L41/22 , H04L43/02 , H04L43/04 , H04L43/062 , H04L43/08 , H04L43/0805 , H04L43/0811 , H04L43/0829 , H04L43/0841 , H04L43/0858 , H04L43/0864 , H04L43/0876 , H04L43/0882 , H04L43/0888 , H04L43/10 , H04L43/106 , H04L43/12 , H04L43/16 , H04L45/306 , H04L45/38 , H04L45/46 , H04L45/507 , H04L45/66 , H04L45/74 , H04L47/11 , H04L47/20 , H04L47/2441 , H04L47/2483 , H04L47/28 , H04L47/31 , H04L47/32 , H04L61/2007 , H04L63/0227 , H04L63/0263 , H04L63/06 , H04L63/0876 , H04L63/1408 , H04L63/1416 , H04L63/1425 , H04L63/1433 , H04L63/1441 , H04L63/145 , H04L63/1458 , H04L63/1466 , H04L63/16 , H04L63/20 , H04L67/10 , H04L67/1002 , H04L67/12 , H04L67/16 , H04L67/22 , H04L67/36 , H04L67/42 , H04L69/16 , H04L69/22 , H04W72/08 , H04W84/18
摘要： A method includes analyzing, via a first capturing agent, packets processed in a first environment associated with a first host to yield first data. The method includes analyzing, via a second capturing agent, packets processed by a second environment associated with a second host to yield second data, collecting the first data and the second data at a collector to yield aggregated data, transmitting the aggregated data to an analysis engine which analyzes the aggregated data to yield an analysis. Based on the analysis, the method includes identifying first packet loss at the first environment and second packet loss at the second environment.
摘要翻译：一种方法包括经由第一捕获代理分析在与第一主机相关联的第一环境中处理的分组以产生第一数据。该方法包括经由第二捕获代理分析由与第二主机相关联的第二环境处理的分组以产生第二数据，在收集器处收集第一数据和第二数据以产生聚合数据，将聚合数据发送到分析引擎，分析聚合数据以产生分析。基于分析，该方法包括识别在第一环境下的第一分组丢失和在第二环境下的第二分组丢失。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式