Application monitoring prioritization

Information

  • Patent Grant
  • 11902122
  • Patent Number
    11,902,122
  • Date Filed
    Tuesday, September 27, 2022
    2 years ago
  • Date Issued
    Tuesday, February 13, 2024
    9 months ago
Abstract
An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.
Description
TECHNICAL FIELD

The present technology pertains to network security and more specifically establishing a priority ranking for an endpoint.


BACKGROUND

When an endpoint is compromised in a network, other endpoints may become compromised as well. It can be important to triage the other nodes and determine if they are also compromised or if they are at risk of being compromised in the future. In a datacenter, there can be a large number of endpoints and triaging each one can take a large amount of time. An endpoint at the tail end of the triage queue might become compromised while awaiting triage.





BRIEF DESCRIPTION OF THE FIGURES

In order to describe the manner in which the above-recited and other advantages and features of the disclosure can be obtained, a more particular description of the principles briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings. Understanding that these drawings depict only example embodiments of the disclosure and are not therefore to be considered to be limiting of its scope, the principles herein are described and explained with additional specificity and detail through the use of the accompanying drawings in which:



FIG. 1 illustrates an example network traffic monitoring system according to some example embodiments;



FIG. 2 illustrates an example network environment according to some example embodiments;



FIG. 3A, FIG. 3B, FIG. 3C, and FIG. 3D illustrate example network configurations;



FIG. 4 illustrates an example table depicting example business criticality rankings, secondary values, and priority rankings of various example applications;



FIG. 5 illustrates an example method according to some embodiments;



FIG. 6 illustrates and example method according to some embodiments; and



FIGS. 7A and 7B illustrate example system embodiments.





DESCRIPTION OF EXAMPLE EMBODIMENTS
Overview

An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.


Detailed Description

Various embodiments of the disclosure are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the disclosure.


The disclosed technology addresses the need in the art for determining a priority ranking for endpoints in a network.



FIG. 1 shows an example network traffic monitoring system 100 according to some example embodiments. Network traffic monitoring system 100 can include configuration and image manager 102, sensors 104, external data sources 106, collectors 108, analytics module 110, policy engine 112, and presentation module 116. These modules may be implemented as hardware and/or software components. Although FIG. 1 illustrates an example configuration of the various components of network traffic monitoring system 100, those of skill in the art will understand that the components of network traffic monitoring system 100 or any system described herein can be configured in a number of different ways and can include any other type and number of components. For example, sensors 104 and collectors 108 can belong to one hardware and/or software module or multiple separate modules. Other modules can also be combined into fewer components and/or further divided into more components.


Configuration and image manager 102 can provision and maintain sensors 104. In some example embodiments, sensors 104 can reside within virtual machine images, and configuration and image manager 102 can be the component that also provisions virtual machine images.


Configuration and image manager 102 can configure and manage sensors 104. When a new virtual machine (VM) is instantiated or when an existing VM is migrated, configuration and image manager 102 can provision and configure a new sensor on the physical server hosting the VM. In some example embodiments configuration and image manager 102 can monitor the health of sensors 104. For instance, configuration and image manager 102 may request status updates or initiate tests. In some example embodiments, configuration and image manager 102 can also manage and provision the virtual machines themselves.


In some example embodiments, configuration and image manager 102 can verify and validate sensors 104. For example, sensors 104 can be provisioned a unique ID that is created using a one-way hash function of its basic input/output system (BIOS) universally unique identifier (UUID) and a secret key stored on configuration and image manager 102. This UUID can be a large number that is difficult for an imposter sensor to guess. In some example embodiments, configuration and image manager 102 can keep sensors 104 up to date by installing new versions of their software and applying patches. Configuration and image manager 102 can obtain these updates automatically from a local source or the Internet.


Sensors 104 can reside on nodes of a data center network (e.g., virtual partition, hypervisor, physical server, switch, router, gateway, other network device, other electronic device, etc.). In general, a virtual partition may be an instance of a virtual machine (VM) (e.g., VM 104a), sandbox, container (e.g., container 104c), or any other isolated environment that can have software operating within it. The software may include an operating system and application software. For software running within a virtual partition, the virtual partition may appear to be a distinct physical server. In some example embodiments, a hypervisor (e.g., hypervisor 104b) may be a native or “bare metal” hypervisor that runs directly on hardware, but that may alternatively run under host software executing on hardware. Sensors 104 can monitor communications to and from the nodes and report on environmental data related to the nodes (e.g., node IDs, statuses, etc.). Sensors 104 can send their records over a high-speed connection to collectors 108 for storage. Sensors 104 can comprise a piece of software (e.g., running on a VM, container, virtual switch, hypervisor, physical server, or other device), an application-specific integrated circuit (ASIC) (e.g., a component of a switch, gateway, router, standalone packet monitor, or other network device including a packet capture (PCAP) module or similar technology), or an independent unit (e.g., a device connected to a network device's monitoring port or a device connected in series along a main trunk of a datacenter). It should be understood that various software and hardware configurations can be used as sensors 104. Sensors 104 can be lightweight, thereby minimally impeding normal traffic and compute resources in a datacenter. Sensors 104 can “sniff” packets being sent over its host network interface card (NIC) or individual processes can be configured to report traffic to sensors 104. This sensor structure allows for robust capture of granular (i.e., specific) network traffic data from each hop of data transmission.


As sensors 104 capture communications, they can continuously send network traffic and associated data to collectors 108. The network traffic data can relate to a packet, a collection of packets, a flow, a group of flows, etc. The associated data can include details such as the VM BIOS ID, sensor ID, associated process ID, associated process name, process user name, sensor private key, geo-location of a sensor, environmental details, etc. The network traffic data can include information describing the communication on all layers of the Open Systems Interconnection (OSI) model. For example, the network traffic data can include signal strength (if applicable), source/destination media access control (MAC) address, source/destination internet protocol (IP) address, protocol, port number, encryption data, requesting process, a sample packet, etc.


In some example embodiments, sensors 104 can preprocess network traffic data before sending to collectors 108. For example, sensors 104 can remove extraneous or duplicative data or they can create a summary of the data (e.g., latency, packets and bytes sent per flow, flagged abnormal activity, etc.). In some example embodiments, sensors 104 can be configured to only capture certain types of connection information and disregard the rest. Because it can be overwhelming for a system to capture every packet in a network, in some example embodiments, sensors 104 can be configured to capture only a representative sample of packets (e.g., every 1,000th packet or other suitable sample rate).


Sensors 104 can send network traffic data to one or multiple collectors 108. In some example embodiments, sensors 104 can be assigned to a primary collector and a secondary collector. In other example embodiments, sensors 104 are not assigned a collector, but can determine an optimal collector through a discovery process. Sensors 104 can change where they send their network traffic data if their environments change, such as if a certain collector experiences failure or if a sensor is migrated to a new location and becomes closer to a different collector. In some example embodiments, sensors 104 can send different types of network traffic data to different collectors. For example, sensors 104 can send network traffic data related to one type of process to one collector and network traffic data related to another type of process to another collector.


Collectors 108 can serve as a repository for the data recorded by sensors 104. In some example embodiments, collectors 108 can be directly connected to a top of rack switch. In other example embodiments, collectors 108 can be located near an end of row switch. Collectors 108 can be located on or off premises. It will be appreciated that the placement of collectors 108 can be optimized according to various priorities such as network capacity, cost, and system responsiveness. In some example embodiments, data storage of collectors 108 is located in an in-memory database, such as dashDB by International Business Machines. This approach benefits from rapid random access speeds that typically are required for analytics software. Alternatively, collectors 108 can utilize solid state drives, disk drives, magnetic tape drives, or a combination of the foregoing according to cost, responsiveness, and size requirements. Collectors 108 can utilize various database structures such as a normalized relational database or NoSQL database.


In some example embodiments, collectors 108 may only serve as network storage for network traffic monitoring system 100. In other example embodiments, collectors 108 can organize, summarize, and preprocess data. For example, collectors 108 can tabulate how often packets of certain sizes or types are transmitted from different nodes of a data center. Collectors 108 can also characterize the traffic flows going to and from various nodes. In some example embodiments, collectors 108 can match packets based on sequence numbers, thus identifying traffic flows and connection links. In some example embodiments, collectors 108 can flag anomalous data. Because it would be inefficient to retain all data indefinitely, in some example embodiments, collectors 108 can periodically replace detailed network traffic flow data and associated data (host data, process data, user data, etc.) with consolidated summaries. In this manner, collectors 108 can retain a complete dataset describing one period (e.g., the past minute or other suitable period of time), with a smaller dataset of another period (e.g., the previous 2-10 minutes or other suitable period of time), and progressively consolidate network traffic flow data and associated data of other periods of time (e.g., day, week, month, year, etc.). By organizing, summarizing, and preprocessing the network traffic flow data and associated data, collectors 108 can help network traffic monitoring system 100 scale efficiently. Although collectors 108 are generally referred to herein in the plurality, it will be appreciated that collectors 108 can be implemented using a single machine, especially for smaller datacenters.


In some example embodiments, collectors 108 can receive data from external data sources 106, such as security reports, white-lists (106a), IP watchlists (106b), whois data (106c), or out-of-band data, such as power status, temperature readings, etc.


In some example embodiments, network traffic monitoring system 100 can include a wide bandwidth connection between collectors 108 and analytics module 110. Analytics module 110 can include application dependency (ADM) module 160, reputation module 162, vulnerability module 164, malware detection module 166, etc., to accomplish various tasks with respect to the flow data and associated data collected by sensors 104 and stored in collectors 108. In some example embodiments, network traffic monitoring system 100 can automatically determine network topology. Using network traffic flow data and associated data captured by sensors 104, network traffic monitoring system 100 can determine the type of devices existing in the network (e.g., brand and model of switches, gateways, machines, etc.), physical locations (e.g., latitude and longitude, building, datacenter, room, row, rack, machine, etc.), interconnection type (e.g., 10 Gb Ethernet, fiber-optic, etc.), and network characteristics (e.g., bandwidth, latency, etc.). Automatically determining the network topology can assist with integration of network traffic monitoring system 100 within an already established datacenter. Furthermore, analytics module 110 can detect changes of network topology without the need of further configuration.


Analytics module 110 can determine dependencies of components within the network using ADM module 160. For example, if component A routinely sends data to component B but component B never sends data to component A, then analytics module 110 can determine that component B is dependent on component A, but A is likely not dependent on component B. If, however, component B also sends data to component A, then they are likely interdependent. These components can be processes, virtual machines, hypervisors, virtual local area networks (VLANs), etc. Once analytics module 110 has determined component dependencies, it can then form a component (“application”) dependency map. This map can be instructive when analytics module 110 attempts to determine a root cause of a failure (because failure of one component can cascade and cause failure of its dependent components). This map can also assist analytics module 110 when attempting to predict what will happen if a component is taken offline. Additionally, analytics module 110 can associate edges of an application dependency map with expected latency, bandwidth, etc. for that individual edge.


Analytics module 110 can establish patterns and norms for component behavior. For example, it can determine that certain processes (when functioning normally) will only send a certain amount of traffic to a certain VM using a small set of ports. Analytics module can establish these norms by analyzing individual components or by analyzing data coming from similar components (e.g., VMs with similar configurations). Similarly, analytics module 110 can determine expectations for network operations. For example, it can determine the expected latency between two components, the expected throughput of a component, response times of a component, typical packet sizes, traffic flow signatures, etc. In some example embodiments, analytics module 110 can combine its dependency map with pattern analysis to create reaction expectations. For example, if traffic increases with one component, other components may predictably increase traffic in response (or latency, compute time, etc.).


In some example embodiments, analytics module 110 can use machine learning techniques to identify security threats to a network using malware detection module 166. For example, malware detection module 166 can be provided with examples of network states corresponding to an attack and network states corresponding to normal operation. Malware detection module 166 can then analyze network traffic flow data and associated data to recognize when the network is under attack. In some example embodiments, the network can operate within a trusted environment for a time so that analytics module 110 can establish baseline normalcy. In some example embodiments, analytics module 110 can contain a database of norms and expectations for various components. This database can incorporate data from sources external to the network (e.g., external sources 106). Analytics module 110 can then create access policies for how components can interact using policy engine 112. In some example embodiments, policies can be established external to network traffic monitoring system 100 and policy engine 112 can detect the policies and incorporate them into analytics module 110. A network administrator can manually tweak the policies. Policies can dynamically change and be conditional on events. These policies can be enforced by the components depending on a network control scheme implemented by a network. Policy engine 112 can maintain these policies and receive user input to change the policies.


Policy engine 112 can configure analytics module 110 to establish or maintain network policies. For example, policy engine 112 may specify that certain machines should not intercommunicate or that certain ports are restricted. A network and security policy controller (not shown) can set the parameters of policy engine 112. In some example embodiments, policy engine 112 can be accessible via presentation module 116. In some example embodiments, policy engine 112 can include policy data 112. In some example embodiments, policy data 112 can include endpoint group (EPG) data 114, which can include the mapping of EPGs to IP addresses and/or MAC addresses. In some example embodiments, policy data 112 can include policies for handling data packets.


In some example embodiments, analytics module 110 can simulate changes in the network. For example, analytics module 110 can simulate what may result if a machine is taken offline, if a connection is severed, or if a new policy is implemented. This type of simulation can provide a network administrator with greater information on what policies to implement. In some example embodiments, the simulation may serve as a feedback loop for policies. For example, there can be a policy that if certain policies would affect certain services (as predicted by the simulation) those policies should not be implemented. Analytics module 110 can use simulations to discover vulnerabilities in the datacenter. In some example embodiments, analytics module 110 can determine which services and components will be affected by a change in policy. Analytics module 110 can then take necessary actions to prepare those services and components for the change. For example, it can send a notification to administrators of those services and components, it can initiate a migration of the components, it can shut the components down, etc.


In some example embodiments, analytics module 110 can supplement its analysis by initiating synthetic traffic flows and synthetic attacks on the datacenter. These artificial actions can assist analytics module 110 in gathering data to enhance its model. In some example embodiments, these synthetic flows and synthetic attacks are used to verify the integrity of sensors 104, collectors 108, and analytics module 110. Over time, components may occasionally exhibit anomalous behavior. Analytics module 110 can analyze the frequency and severity of the anomalous behavior to determine a reputation score for the component using reputation module 162. Analytics module 110 can use the reputation score of a component to selectively enforce policies. For example, if a component has a high reputation score, the component may be assigned a more permissive policy or more permissive policies; while if the component frequently violates (or attempts to violate) its relevant policy or policies, its reputation score may be lowered and the component may be subject to a stricter policy or stricter policies. Reputation module 162 can correlate observed reputation score with characteristics of a component. For example, a particular virtual machine with a particular configuration may be more prone to misconfiguration and receive a lower reputation score. When a new component is placed in the network, analytics module 110 can assign a starting reputation score similar to the scores of similarly configured components. The expected reputation score for a given component configuration can be sourced outside of the datacenter. A network administrator can be presented with expected reputation scores for various components before installation, thus assisting the network administrator in choosing components and configurations that will result in high reputation scores.


Some anomalous behavior can be indicative of a misconfigured component or a malicious attack. Certain attacks may be easy to detect if they originate outside of the datacenter, but can prove difficult to detect and isolate if they originate from within the datacenter. One such attack could be a distributed denial of service (DDOS) where a component or group of components attempt to overwhelm another component with spurious transmissions and requests. Detecting an attack or other anomalous network traffic can be accomplished by comparing the expected network conditions with actual network conditions. For example, if a traffic flow varies from its historical signature (packet size, transport control protocol header options, etc.) it may be an attack.


In some cases, a traffic flow and associated data may be expected to be reported by a sensor, but the sensor may fail to report it. This situation could be an indication that the sensor has failed or become compromised. By comparing the network traffic flow data and associated data from multiple sensors 104 spread throughout the datacenter, analytics module 110 can determine if a certain sensor is failing to report a particular traffic flow.


Presentation module 116 can include serving layer 118, authentication module 120, web front end 122, public alert module 124, and third party tools 126. In some example embodiments, presentation module 116 can provide an external interface for network monitoring system 100. Using presentation module 116, a network administrator, external software, etc. can receive data pertaining to network monitoring system 100 via a webpage, application programming interface (API), audiovisual queues, etc. In some example embodiments, presentation module 116 can preprocess and/or summarize data for external presentation. In some example embodiments, presentation module 116 can generate a webpage. As analytics module 110 processes network traffic flow data and associated data and generates analytic data, the analytic data may not be in a human-readable form or it may be too large for an administrator to navigate. Presentation module 116 can take the analytic data generated by analytics module 110 and further summarize, filter, and organize the analytic data as well as create intuitive presentations of the analytic data.


Serving layer 118 can be the interface between presentation module 116 and analytics module 110. As analytics module 110 generates reports, predictions, and conclusions, serving layer 118 can summarize, filter, and organize the information that comes from analytics module 110. In some example embodiments, serving layer 118 can also request raw data from a sensor or collector.


Web frontend 122 can connect with serving layer 118 to present the data from serving layer 118 in a webpage. For example, web frontend 122 can present the data in bar charts, core charts, tree maps, acyclic dependency maps, line graphs, tables, etc. Web frontend 122 can be configured to allow a user to “drill down” on information sets to get a filtered data representation specific to the item the user wishes to drill down to. For example, individual traffic flows, components, etc. Web frontend 122 can also be configured to allow a user to filter by search. This search filter can use natural language processing to analyze the user's input. There can be options to view data relative to the current second, minute, hour, day, etc. Web frontend 122 can allow a network administrator to view traffic flows, application dependency maps, network topology, etc.


In some example embodiments, web frontend 122 may be solely configured to present information. In other example embodiments, web frontend 122 can receive inputs from a network administrator to configure network traffic monitoring system 100 or components of the datacenter. These instructions can be passed through serving layer 118 to be sent to configuration and image manager 102 or policy engine 112. Authentication module 120 can verify the identity and privileges of users. In some example embodiments, authentication module 120 can grant network administrators different rights from other users according to established policies.


Public alert module 124 can identify network conditions that satisfy specified criteria and push alerts to third party tools 126. Public alert module 124 can use analytic data generated or accessible through analytics module 110. One example of third party tools 126 is a security information and event management system (STEM). Third party tools 126 may retrieve information from serving layer 118 through an API and present the information according to the SIEM's user interfaces.



FIG. 2 illustrates an example network environment 200 according to some example embodiments. It should be understood that, for the network environment 100 and any environment discussed herein, there can be additional or fewer nodes, devices, links, networks, or components in similar or alternative configurations. Example embodiments with different numbers and/or types of clients, networks, nodes, cloud components, servers, software components, devices, virtual or physical resources, configurations, topologies, services, appliances, deployments, or network devices are also contemplated herein. Further, network environment 200 can include any number or type of resources, which can be accessed and utilized by clients or tenants. The illustrations and examples provided herein are for clarity and simplicity.


Network environment 200 can include network fabric 212, layer 2 (L2) network 206, layer 3 (L3) network 208, endpoints 210a, 210b, . . . , and 210d (collectively, “204”). Network fabric 212 can include spine switches 202a, 202b, . . . , 202n (collectively, “202”) connected to leaf switches 204a, 204b, 204c, . . . , 204n (collectively, “204”). Spine switches 202 can connect to leaf switches 204 in network fabric 212. Leaf switches 204 can include access ports (or non-fabric ports) and fabric ports. Fabric ports can provide uplinks to spine switches 202, while access ports can provide connectivity for devices, hosts, endpoints, VMs, or other electronic devices (e.g., endpoints 204), internal networks (e.g., L2 network 206), or external networks (e.g., L3 network 208).


Leaf switches 204 can reside at the edge of network fabric 212, and can thus represent the physical network edge. In some cases, leaf switches 204 can be top-of-rack switches configured according to a top-of-rack architecture. In other cases, leaf switches 204 can be aggregation switches in any particular topology, such as end-of-row or middle-of-row topologies. Leaf switches 204 can also represent aggregation switches, for example.


Network connectivity in network fabric 212 can flow through leaf switches 204. Here, leaf switches 204 can provide servers, resources, VMs, or other electronic devices (e.g., endpoints 210), internal networks (e.g., L2 network 206), or external networks (e.g., L3 network 208), access to network fabric 212, and can connect leaf switches 204 to each other. In some example embodiments, leaf switches 204 can connect endpoint groups (EPGs) to network fabric 212, internal networks (e.g., L2 network 206), and/or any external networks (e.g., L3 network 208). EPGs can be used in network environment 200 for mapping applications to the network. In particular, EPGs can use a grouping of application endpoints in the network to apply connectivity and policy to the group of applications. EPGs can act as a container for buckets or collections of applications, or application components, and tiers for implementing forwarding and policy logic. EPGs also allow separation of network policy, security, and forwarding from addressing by instead using logical application boundaries. For example, each EPG can connect to network fabric 212 via leaf switches 204.


Endpoints 210 can connect to network fabric 212 via leaf switches 204. For example, endpoints 210a and 210b can connect directly to leaf switch 204a, which can connect endpoints 210a and 210b to network fabric 212 and/or any other one of leaf switches 204. Endpoints 210c and 210d can connect to leaf switch 204b via L2 network 206. Endpoints 210c and 210d and L2 network 206 are examples of LANs. LANs can connect nodes over dedicated private communications links located in the same general physical location, such as a building or campus.


Wide area network (WAN) 212 can connect to leaf switches 204c or 204d via L3 network 208. WANs can connect geographically dispersed nodes over long-distance communications links, such as common carrier telephone lines, optical lightpaths, synchronous optical networks (SONET), or synchronous digital hierarchy (SDH) links. LANs and WANs can include layer 2 (L2) and/or layer 3 (L3) networks and endpoints.


The Internet is an example of a WAN that connects disparate networks throughout the world, providing global communication between nodes on various networks. The nodes typically communicate over the network by exchanging discrete frames or packets of data according to predefined protocols, such as the Transmission Control Protocol/Internet Protocol (TCP/IP). In this context, a protocol can refer to a set of rules defining how the nodes interact with each other. Computer networks may be further interconnected by an intermediate network node, such as a router, to extend the effective size of each network. Endpoints 210 can include any communication device or component, such as a computer, server, hypervisor, virtual machine, container, process (e.g., running on a virtual machine), switch, router, gateway, host, device, external network, etc. In some example embodiments, endpoints 210 can include a server, hypervisor, process, or switch configured with virtual tunnel endpoint (VTEP) functionality which connects an overlay network with network fabric 212. The overlay network may allow virtual networks to be created and layered over a physical network infrastructure. Overlay network protocols, such as Virtual Extensible LAN (VXLAN), Network Virtualization using Generic Routing Encapsulation (NVGRE), Network Virtualization Overlays (NVO3), and Stateless Transport Tunneling (STT), can provide a traffic encapsulation scheme which allows network traffic to be carried across L2 and L3 networks over a logical tunnel. Such logical tunnels can be originated and terminated through VTEPs. The overlay network can host physical devices, such as servers, applications, endpoint groups, virtual segments, virtual workloads, etc. In addition, endpoints 210 can host virtual workload(s), clusters, and applications or services, which can connect with network fabric 212 or any other device or network, including an internal or external network. For example, endpoints 210 can host, or connect to, a cluster of load balancers or an EPG of various applications.


Network environment 200 can also integrate a network traffic monitoring system, such as the one shown in FIG. 1. For example, as shown in FIG. 2, the network traffic monitoring system can include sensors 104a, 104b, . . . , 104n (collectively, “104”), collectors 108a, 108b, . . . 108n (collectively, “108”), and analytics module 110. In some example embodiments, spine switches 202 do not have sensors 104. Analytics module 110 can receive and process network traffic and associated data collected by collectors 108 and detected by sensors 104 placed on nodes located throughout network environment 200. In some example embodiments, analytics module 110 can be implemented in an active-standby model to ensure high availability, with a first analytics module functioning in a primary role and a second analytics module functioning in a secondary role. If the first analytics module fails, the second analytics module can take over control. Although analytics module 110 is shown to be a standalone network appliance in FIG. 2, it will be appreciated that analytics module 110 can also be implemented as a VM image that can be distributed onto a VM, a cluster of VMs, a software as a service (SaaS), or other suitable distribution model in various other example embodiments. In some example embodiments, sensors 104 can run on endpoints 210, leaf switches 204, spine switches 202, in-between network elements (e.g., sensor 104h), etc. In some example embodiments, leaf switches 204 can each have an associated collector 108. For example, if leaf switch 204 is a top of rack switch then each rack can contain an assigned collector 108.


Although network fabric 212 is illustrated and described herein as an example leaf-spine architecture, one of ordinary skill in the art will readily recognize that the subject technology can be implemented based on any network topology, including any data center or cloud network fabric. Indeed, other architectures, designs, infrastructures, and variations are contemplated herein. For example, the principles disclosed herein are applicable to topologies including three-tier (including core, aggregation, and access levels), fat tree, mesh, bus, hub and spoke, etc. It should be understood that sensors and collectors can be placed throughout the network as appropriate according to various architectures.



FIG. 3A, FIG. 3B, FIG. 3C, and FIG. 3D represent example network configurations of network environment 200. Various endpoints 302a-302m (collectively or individually, “endpoint 302”) can run services within the network. Endpoint 302 can be similar to endpoint 210. Endpoint 302 can be associated with an application (e.g., mail server, web server, security application, voice over IP, storage host, etc.). Endpoint 302 can be a network switch, router, firewall, etc. Endpoint 302 can comprise a virtual machine, bare metal hardware, container, etc. Endpoint 302 can run on a virtual machine, bare metal hardware, container, etc.


In FIGS. 3A-3D, compromised endpoint 302a can represent an endpoint 302 that has been compromised or misconfigured. For example, a sensor 104 associated with endpoint 302a might have stopped reporting, reported irregular traffic or behavior, or otherwise indicated that endpoint 302a is compromised. Compromised endpoint 302a might be running a virus, worm, other unauthorized programs, misconfigured programs, etc. Network monitoring system 100 can identify compromised endpoint 302 using the principles herein disclosed.


When an endpoint 302 becomes compromised, there is a risk that it was compromised from another endpoint 302 on network 300, that it has or will compromise other endpoints 302, or the entity which compromised it might compromise other endpoints 302. It can be useful to perform triage with other endpoints 302 to determine their risk to the same causes that compromised endpoint 302a as well as implement defensive and remedial procedures. Triage, as used herein can entail ascertaining the present state of the endpoint 302, determining actions to be performed, and performing those actions. For example, network monitoring system 100 can block communications to another endpoint 302 that has a likelihood of becoming compromised, including blocking communications from compromised endpoint 302a to a vulnerable endpoint 302. Because not all endpoints 302 can be triaged at once, a prioritization scheme can be used to queue up analyzing and protecting endpoints 302. For example, endpoints 302 can be assigned a priority ranking and can be analyzed in according to their priority ranking. The priority ranking can be established using a variety of criteria such as distance, critically (e.g., business criticality), network connectivity, redundancy, vulnerability, similarity to compromised endpoint 302a, etc. A combination of criteria can also be utilized. It should be understood that the connections depicted in FIGS. 3A-3D can represent direct connections or indirect connections (e.g., those that require an intermediary).


In FIG. 3A, endpoint 302b is a distance of 2 away from compromised endpoint 302a while endpoint 302c is a distance of 7 away from compromised endpoint 302a. Distance can refer to the latency between two endpoints 302, the bandwidth between two endpoints 302, the number of hops in a path connecting two endpoints 302, the geographical distance between two endpoints 302, the redundancy in the connections between the two endpoints 320, etc. Distance can be calculated using any combination of the foregoing.


Network monitoring system 100 can determine the distances between two endpoints 302. For example, sensor 104 on an endpoint 302 can ping another endpoint 302 and, based on the response, can determine the latency between the two endpoints 302. Other techniques are contemplated for determining distances between endpoints 302. In some embodiments, a lower distance can result in a higher priority ranking for an endpoint 302. An endpoint 302 with a higher priority ranking can be triaged before an endpoint 302 with a lower priority ranking. It should be understood that “higher” and “lower” rankings and values as used herein can mean of greater importance or lesser priority as appropriate.


In FIG. 3B, compromised endpoint 302a is connected to web server endpoint 302d, voice over internet protocol (VOIP) endpoint 302e, and security endpoint 302f. Other endpoints associated with other applications are contemplated that can be run on an endpoint 302. For example, an endpoint can run an application for data storage, telecommunications, closed circuit television, data processing, finance, point-of-sale terminals, tech-support, video on demand, etc. In some embodiments, certain applications are especially critical to the business that owns or uses them. Endpoints 302 that are business critical can be those that would cause serious damage to the particular business should they have any problems. For example, a social network may consider web server endpoint 302d to be critical for the business whereas a telecommunications provider may consider VOIP endpoint 302e to be more critical to their business than web server endpoint 302d.


In some embodiments, business criticality can be provided by an administrator. For example, an administrator can indicate a business criticality ranking for a variety of endpoint classifications. Endpoints can be classified similar to the foregoing (e.g., “telecommunications”, “data storage”, etc.). Additionally or alternatively, business criticality can be determined based on an analysis of network 300 provided by network monitoring system 100. For example, network monitoring system 100 can determine that many communications and interactions depend on a classification of endpoint 302. Similarly, network monitoring system 100 can create an application dependency map which can inform criticality rankings.


An endpoint 302 with a higher business criticality ranking can be prioritized over other endpoints 302. For example, the business criticality ranking can inform a priority ranking.


In FIG. 3C, compromised endpoint 302a is connected directly to endpoint 302g and 302h. Endpoint 302h is connected to endpoint 302i and endpoint 302j. If an endpoint 302 serves as a hub for interconnecting multiple endpoints 302 it can have a higher priority ranking. For example, because endpoint 302h is connected to endpoints 302a, 302i, and 302j, it can have a higher priority ranking in comparison to endpoint 302g which is only connected to endpoint 302a. The more endpoints 302 that an endpoint 302 is connected to, the greater its priority ranking can be. In some embodiments, the priority ranking of an endpoint 302 is only increased based on the number of directly connected endpoints 302 it has; alternatively, the priority ranking can increase based on the number of indirectly connected endpoints 302. The priority ranking can be higher based on a distance-weighting of the number of connected endpoints 302, the distance being calculated as discussed above. The priority ranking can be higher based on the number of endpoints 302 that an endpoint 302 “protects” from compromised endpoint 302a. Protecting an endpoint can mean that communications from a protected endpoint 302 must go through this endpoint if they are to reach compromised endpoint 302a.


In FIG. 3D, compromised endpoint 402a is connected to Endpoint A 302k, Endpoint B 302L, and Endpoint B 302m. Endpoint B can be redundantly provided on endpoints 302L and 302m. Redundancy can contribute to a decrease in the priority ranking of an endpoint 302 while a lack of redundancy can contribute to an increase in the priority ranking of an endpoint 302. Thus, in example network 300d, Endpoint A 302k can have a higher priority ranking. Redundancy can mean simultaneous operation where both redundant endpoints 302 are active. Redundancy can mean where one endpoint 302 is a backup of another endpoint 302 in case one endpoint 302 suffers a failure. Redundancy can mean how recent a backup has been made of an endpoint 302. For example, an endpoint 302 that was recently backed up can have a higher redundancy than an endpoint 302 that was backed up a long time ago.



FIG. 4 shows example table 400 showing example business criticality rankings, secondary values, and priority rankings of various example applications (e.g., endpoints 302). A system (e.g., networking monitoring system 100) can use a table, database, or any other data structure similar to table 400 in order to determine priority rankings for endpoints. For example, the priority ranking can be a combination (such as a summation, weighted summation, average, maximum, etc.) of the business criticality ranking and the secondary value. The secondary value can be another factor (e.g., distance, redundancy, vulnerability, etc.) or a combination of factors. For example, a ranking or value for distance can be averaged with a ranking or value for redundancy for the application for the secondary value.


In some embodiments, a system doing triage on a network can attempt to identify and mitigate vulnerabilities. It can begin by assigning business criticality rankings to endpoints 302. In some embodiments, this might result in two endpoints 302 having the same criticality ranking. Arbitrarily deciding which endpoint 302 to triage first is possible; however applying an extra calculation to determine an ordering of the “tied” endpoints can be better. The system can then look to secondary values to tie-break. In table 400 for example, both “finance” and “security” have the same business criticality ranking, but “finance” can be considered of greater priority after considering secondary values (a value of 1 whereas “security” has a secondary value of 2).


In some embodiments, secondary values includes business criticality ranking and, instead of business criticality ranking being the primary consideration, another metric can be utilize (e.g., distance). For example, a system can determine the distance of an endpoint 302 from compromised endpoint 302a and use business criticality ranking as a tie-breaking secondary value.



FIG. 5 shows an example method 500 according to some embodiments. A system (e.g., network monitoring system 100) performing example method 500 can begin and detect a compromised endpoint (step 501). Compromised endpoint 302a can be an endpoint 302 that is running unauthorized code (e.g., a virus, trojan, worm, script, etc.), an endpoint 302 that is misconfigured, an endpoint 302 that is not authorized to be on the network, an endpoint 302 that is associated with a malicious entity (e.g., a user that has been labelled as malicious), an endpoint 302 that has been disconnected, or an endpoint 302 that otherwise is not performing optimally. Detecting compromised endpoint 302a can include analyzing flow data from various sensors 104 including a sensor 104 associated with compromised endpoint 302a.


After compromised endpoint 302a is detected, other endpoints 302 can be triaged to determine whether they have problems or might soon have problems associated with compromised endpoint 302a. For example, a virus that is installed on compromised endpoint 302a might spread to connected endpoints 302. Another example is that a vulnerability on compromised endpoint 302a (that caused it to be compromised) might be present on other endpoints 302. Timeliness in triage can be important because systems that rely on compromised endpoint 302a might crash or have problems as a result of compromised endpoint 302a not behaving regularly. Timeliness can also be important because the unwanted software installed on compromised endpoint 302a might quickly spread throughout the datacenter, it can be important to determine if other endpoints 302 are compromised as well.


The system can continue and determine a criticality ranking for a first endpoint in a datacenter (step 502). Step 502 can include a network administrator labelling the first endpoint with a criticality ranking. A label can be assigned to the first endpoint (e.g., “telecommunications”) and a ranking can be derived from that label. In some embodiments, this includes referring to a prioritization list of labels. Criticality can be specific to the business of the datacenter. For example, an internet provider can have telecommunications endpoints receive a higher criticality ranking. As should be evident in this description, the term “ranking” does not necessarily require exclusivity; i.e., multiple endpoints 302 can receive identical rankings.


The system can then determine a secondary value for the first endpoint (step 504). This can include determining values (or rankings) associated with various criteria (e.g., distance, redundancy, vulnerability, etc.) and then combining multiple values (if there are multiple). Combining can include creating an average, a weighted average, a summation, etc.


The system can then determine a priority ranking for the first endpoint based on the criticality ranking for the first endpoint and the secondary value for the first endpoint (step 506). This can be generated by combining the criticality ranking and secondary value. For example, the criticality ranking can be an integer component while and the secondary value can be a decimal component of the priority ranking. The priority ranking can be a value (e.g., 9.5), a position in a queue, a relative ordering of endpoints (e.g., the first endpoint has a higher priority than a second endpoint), a group of endpoints (e.g., a first group of endpoints can be triaged first, followed by a second group), etc. In some embodiments, the priority ranking is designed to be exclusive or nearly exclusive to avoid “ties” where two endpoints would have the same priority ranking.


In some embodiments, machine learning can be utilized to inform any of the criticality ranking, the secondary value, and the priority ranking. For example, a system can monitor scenarios where compromised node 302a becomes compromised and then test various priority rankings and attempt to minimize problems for other endpoints 302 by varying the priority ranking. In some embodiments, the system can run simulations of compromised endpoint 302a becoming compromised and have the machine learning program learn based on the simulations.


The system can then determine a criticality ranking for a second endpoint in a datacenter (step 508). It can then determine a secondary value for the second endpoint (step 510). It can then determine a priority ranking for the second endpoint based on the criticality ranking for the second endpoint and the secondary value for the second endpoint (step 512). Steps 508, 510, and 512 can be similar to steps 502, 504, and 506, respectively but for the second endpoint 302.


The system can then compare the priority ranking for the first endpoint and the priority ranking for the second endpoint (step 514). In some embodiments, the endpoint 302 with the higher priority ranking is triaged first.


In some embodiments, the system performing example method 500 can determine a criticality ranking for the first endpoint (step 502) and the second endpoint (step 508). After determining the respective criticality rankings, the system can determine that they are identical. In order to “break the tie”, the system can then analyze the respective secondary values (steps 504 and 508). For example, it can determine the respective distances, and perform triage on the endpoint 302 that is fewer hops away from compromised node 302a. Depending on how the secondary values are calculated, it is contemplated that there can be a tie even after comparing secondary values. The system can then determine tertiary values of the respective endpoints. Tertiary values can be calculated using some of the criteria not analyzed when calculating secondary values.


If the first endpoint has a higher priority, the system can perform triage on the first endpoint (step 516). If the second endpoint has a higher priority, the system can perform triage on the second endpoint (step 518). The endpoint 302 that is not triaged at first (in steps 516 or 518) can be triaged later. For example, the system can perform triage on the second endpoint in step 518 and then perform triage on the first endpoint.


Triage can mean creating a backup of the endpoint 302, adding redundancy to the endpoint 302 (e.g., duplicating the endpoint 302), scanning the endpoint 302 for viruses, having an administrator review the endpoint 302, applying stricter security settings for the endpoint 302, limiting the traffic to the endpoint 302, retrieving data from endpoint 302, retrieving data from a sensor 104 associated with the endpoint 302, analyzing data from a sensor 104 associated with the endpoint 302, analyzing the endpoint 302 for vulnerabilities (especially the vulnerabilities that compromised node 302a), changing an associated endpoint group for the endpoint 302, shutting down the endpoint 302, moving the endpoint 302 (e.g., if the endpoint 302 is a virtual machine or container, migrating it to another machine), etc.



FIG. 6 represents an example method 600 according to some embodiments. The example method can be performed by a system such as traffic monitoring system 100. The system can begin and determine that an infected endpoint has been compromised (step 602). For example, it can determine that an endpoint is misconfigured, hacked, insecure, running malicious code, etc. The system can then determine a criticality ranking for a first endpoint (step 604). It can then determine a criticality ranking for a second endpoint (step 606). The criticality rankings can be according to business criticality, that is, how much the business that runs the endpoints is dependent on these endpoints.


The system can then compare the criticality ranking for the first endpoint and the criticality ranking for the second endpoint (step 608). If there is a tie, meaning that the criticality rankings are the same or substantially the same. The system can determine a secondary value for the first endpoint (step 610). The system can then determine a secondary value for the second endpoint (step 612). The secondary value can be any combination of: an endpoint's distance to the compromised endpoint, the endpoint's similarity to the compromised endpoint (including vulnerability similarities), the endpoint's redundancy, etc.


The system can then compare the secondary value for the first endpoint with the secondary value for the second endpoint (step 614). In some embodiments, the secondary values are calculated in order to prevent a tie. If there is a tie, tertiary values (based on possible secondary criteria that were not used to determine the secondary criteria) can be determined.


If the criticality ranking for the first endpoint is higher (at step 608) or if the secondary value for the first endpoint is higher (at step 614), the system can triage the first endpoint (step 616). The system can then triage the second endpoint (step 618).


If the criticality ranking for the second endpoint is higher (at step 608) or if the secondary value for the second endpoint is higher (at step 614), the system can triage the second endpoint (step 620). The system can then triage the first endpoint (step 622).


Any of the steps in example method 600 can be accomplished with the assistance of sensors installed within the related datacenter, including the infected endpoint, the first endpoint, and the second endpoint.



FIG. 7A and FIG. 7B illustrate example system embodiments. The more appropriate embodiment will be apparent to those of ordinary skill in the art when practicing the present technology. Persons of ordinary skill in the art will also readily appreciate that other system embodiments are possible.



FIG. 7A illustrates a conventional system bus computing system architecture 700 wherein the components of the system are in electrical communication with each other using a bus 705. Example system 700 includes a processing unit (CPU or processor) 710 and a system bus 705 that couples various system components including the system memory 715, such as read only memory (ROM) 770 and random access memory (RAM) 775, to the processor 710. The system 700 can include a cache of high-speed memory connected directly with, in close proximity to, or integrated as part of the processor 710. The system 700 can copy data from the memory 715 and/or the storage device 730 to the cache 712 for quick access by the processor 710. In this way, the cache can provide a performance boost that avoids processor 710 delays while waiting for data. These and other modules can control or be configured to control the processor 710 to perform various actions. Other system memory 715 may be available for use as well. The memory 715 can include multiple different types of memory with different performance characteristics. The processor 710 can include any general purpose processor and a hardware module or software module, such as module 1737, module 7734, and module 3736 stored in storage device 730, configured to control the processor 910 as well as a special-purpose processor where software instructions are incorporated into the actual processor design. The processor 710 may essentially be a completely self-contained computing system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.


To enable user interaction with the computing device 700, an input device 745 can represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech and so forth. An output device 735 can also be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems can enable a user to provide multiple types of input to communicate with the computing device 700. The communications interface 740 can generally govern and manage the user input and system output. There is no restriction on operating on any particular hardware arrangement and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.


Storage device 730 is a non-volatile memory and can be a hard disk or other types of computer readable media which can store data that are accessible by a computer, such as magnetic cassettes, flash memory cards, solid state memory devices, digital versatile disks, cartridges, random access memories (RAMs) 775, read only memory (ROM) 770, and hybrids thereof.


The storage device 730 can include software modules 737, 734, 736 for controlling the processor 710. Other hardware or software modules are contemplated. The storage device 730 can be connected to the system bus 705. In one aspect, a hardware module that performs a particular function can include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as the processor 710, bus 705, display 735, and so forth, to carry out the function.



FIG. 7B illustrates an example computer system 750 having a chipset architecture that can be used in executing the described method and generating and displaying a graphical user interface (GUI). Computer system 750 is an example of computer hardware, software, and firmware that can be used to implement the disclosed technology. System 750 can include a processor 755, representative of any number of physically and/or logically distinct resources capable of executing software, firmware, and hardware configured to perform identified computations. Processor 755 can communicate with a chipset 760 that can control input to and output from processor 755. In this example, chipset 760 outputs information to output 765, such as a display, and can read and write information to storage device 770, which can include magnetic media, and solid state media, for example. Chipset 760 can also read data from and write data to RAM 775. A bridge 780 for interfacing with a variety of user interface components 785 can be provided for interfacing with chipset 760. Such user interface components 785 can include a keyboard, a microphone, touch detection and processing circuitry, a pointing device, such as a mouse, and so on. In general, inputs to system 750 can come from any of a variety of sources, machine generated and/or human generated.


Chipset 760 can also interface with one or more communication interfaces 790 that can have different physical interfaces. Such communication interfaces can include interfaces for wired and wireless local area networks, for broadband wireless networks, as well as personal area networks. Some applications of the methods for generating, displaying, and using the GUI disclosed herein can include receiving ordered datasets over the physical interface or be generated by the machine itself by processor 755 analyzing data stored in storage 770 or 775. Further, the machine can receive inputs from a user via user interface components 785 and execute appropriate functions, such as browsing functions by interpreting these inputs using processor 755.


It can be appreciated that example systems 700 and 750 can have more than one processor 710 or be part of a group or cluster of computing devices networked together to provide greater processing capability.


For clarity of explanation, in some instances the present technology may be presented as including individual functional blocks including functional blocks comprising devices, device components, steps or routines in a method embodied in software, or combinations of hardware and software.


In some embodiments the computer-readable storage devices, mediums, and memories can include a cable or wireless signal containing a bit stream and the like. However, when mentioned, non-transitory computer-readable storage media expressly exclude media such as energy, carrier signals, electromagnetic waves, and signals per se.


Methods according to the above-described examples can be implemented using computer-executable instructions that are stored or otherwise available from computer readable media. Such instructions can comprise, for example, instructions and data which cause or otherwise configure a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Portions of computer resources used can be accessible over a network. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, firmware, or source code. Examples of computer-readable media that may be used to store instructions, information used, and/or information created during methods according to described examples include magnetic or optical disks, flash memory, USB devices provided with non-volatile memory, networked storage devices, and so on.


Devices implementing methods according to these disclosures can comprise hardware, firmware and/or software, and can take any of a variety of form factors. Typical examples of such form factors include laptops, smart phones, small form factor personal computers, personal digital assistants, rackmount devices, standalone devices, and so on. Functionality described herein also can be embodied in peripherals or add-in cards. Such functionality can also be implemented on a circuit board among different chips or different processes executing in a single device, by way of further example.


The instructions, media for conveying such instructions, computing resources for executing them, and other structures for supporting such computing resources are means for providing the functions described in these disclosures.


Although a variety of examples and other information was used to explain aspects within the scope of the appended claims, no limitation of the claims should be implied based on particular features or arrangements in such examples, as one of ordinary skill would be able to use these examples to derive a wide variety of implementations. Further and although some subject matter may have been described in language specific to examples of structural features and/or method steps, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to these described features or acts. For example, such functionality can be distributed differently or performed in components other than those identified herein. Rather, the described features and steps are disclosed as examples of components of systems and methods within the scope of the appended claims. Moreover, claim language reciting “at least one of” a set indicates that one member of the set or multiple members of the set satisfy the claim.

Claims
  • 1. A computer-implemented method comprising: determining a first ranking of a first endpoint, the first ranking based in part on a first reputation score based on a behavior of the first endpoint;determining a second ranking of a second endpoint, the second ranking based in part on a second reputation score based on a behavior of the second endpoint;comparing the first ranking and the second ranking by selectively prioritizing the first reputation score and the second reputation score based on a policy governing the first endpoint and the second endpoint, wherein the policy determines one or more dependencies for how the first endpoint and the second endpoint interact with each other within a network based on one or more conditional events;in response to the second ranking being greater than the first ranking based on lowering the second reputation score based on the behavior of the second endpoint violating the policy, triaging the second endpoint; andin response to the first reputation score and the second reputation score being equal, executing a tie-breaker process including: determining, based on the first ranking of the first endpoint and the second ranking of the second endpoint, that one of the first endpoint and the second endpoint is a higher priority endpoint; andtriaging the higher priority endpoint to mitigate endpoint damage.
  • 2. The computer-implemented method of claim 1, further comprising: detecting that the second endpoint is a compromised endpoint.
  • 3. The computer-implemented method of claim 2, wherein the detecting of the compromised endpoint includes analyzing flow data from a plurality of sensors associated with the compromised endpoint.
  • 4. The computer-implemented method of claim 2, wherein the comprised endpoint is either misconfigured, hacked, insecure or running malicious or unauthorized code.
  • 5. The computer-implemented method of claim 1, further comprising: labeling the first endpoint with the first ranking from a prioritization list of labels.
  • 6. The computer-implemented method of claim 1, wherein the first and second rankings are based on one or more criteria including distance, redundancy, or vulnerability.
  • 7. The computer-implemented method of claim 1, wherein determining the first and second rankings are performed via machine learning.
  • 8. At least one non-transitory computer-readable medium having computer readable instructions that, when executed by at least one processor, cause the at least one processor to: determine a first ranking of a first endpoint, the first ranking based in part on a first reputation score based on a behavior of the first endpoint;determine a second ranking of a second endpoint, the second ranking based in part on a second reputation score based on a behavior of the second endpoint;compare the first ranking and the second ranking by selectively prioritizing the first reputation score and the second reputation score based on a policy governing the first endpoint and the second endpoint, wherein the policy determines one or more dependencies for how the first endpoint and the second endpoint interact with each other within a network based on one or more conditional events;in response to the second ranking being greater than the first ranking based on lowering the second reputation score based on the behavior of the second endpoint violating the policy, triage the second endpoint; andin response to the first reputation score and the second reputation score being equal, executing a tie-breaker process including: determine, based on the first ranking of the first endpoint and the second ranking of the second endpoint, that one of the first endpoint and the second endpoint is a higher priority endpoint; andtriage the higher priority endpoint to mitigate endpoint damage.
  • 9. The at least one non-transitory computer-readable medium of claim 8, further comprising instructions which when executed by the at least one processor, causes the at least one processor to: detect that the second endpoint is a compromised endpoint.
  • 10. The at least one non-transitory computer-readable medium of claim 9, wherein the detecting of the compromised endpoint includes analyzing flow data from a plurality of sensors associated with the compromised endpoint.
  • 11. The at least one non-transitory computer-readable medium of claim 9, wherein the comprised endpoint is either misconfigured, hacked, insecure or running malicious or unauthorized code.
  • 12. The at least one non-transitory computer-readable medium of claim 8, further comprising instructions which when executed by the at least one processor, causes the at least one processor to: label the first endpoint with the first ranking from a prioritization list of labels.
  • 13. The at least one non-transitory computer-readable medium of claim 8, wherein the first and second rankings are based on one or more criteria including distance, redundancy, or vulnerability.
  • 14. The at least one non-transitory computer-readable medium of claim 8, wherein determining the first and second rankings are performed via machine learning.
  • 15. A system comprising: at least one processor;at least one memory including instructions that when executed by the at least one processor, cause the system to:determine a first ranking of a first endpoint, the first ranking based in part on a first reputation score based on a behavior of the first endpoint;determine a second ranking of a second endpoint, the second ranking based in part on a second reputation score based on a behavior of the second endpoint;compare the first ranking and the second ranking by selectively prioritizing the first reputation score and the second reputation score based on a policy governing the first endpoint and the second endpoint, wherein the policy determines one or more dependencies for how the first endpoint and the second endpoint interact with each other within a network based on one or more conditional events;in response to the second ranking being greater than the first ranking based on lowering the second reputation score based on the behavior of the second endpoint violating the policy, triage the second endpoint; andin response to the first reputation score and the second reputation score being equal, executing a tie-breaker process including: determine, based on the first ranking of the first endpoint and the second ranking of the second endpoint, that one of the first endpoint and the second endpoint is a higher priority endpoint; andtriage the higher priority endpoint to mitigate endpoint damage.
  • 16. The system of claim 15, further comprising instructions which when executed by the at least one processor, causes the system to: detect that the second endpoint is a compromised endpoint.
  • 17. The system of claim 16, wherein the detecting of the compromised endpoint includes analyzing flow data from a plurality of sensors associated with the compromised endpoint.
  • 18. The system of claim 16, wherein the comprised endpoint is either misconfigured, hacked, insecure or running malicious or unauthorized code.
  • 19. The system of claim 15, further comprising instructions which when executed by the at least one processor, causes the system to: label the first endpoint with the first ranking from a prioritization list of labels.
  • 20. The system of claim 15, wherein the first and second rankings are based on one or more criteria including distance, redundancy, or vulnerability.
RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No. 16/867,791, filed on May 6, 2020, which in turn, is a continuation of U.S. patent application Ser. No. 15/173,477 filed on Jun. 3, 2016, which claims the benefit of U.S. Provisional Patent Application Ser. No. 62/171,899 filed on Jun. 5, 2015, the contents of which are incorporated by reference in their entireties.

US Referenced Citations (1074)
Number Name Date Kind
5086385 Launey et al. Feb 1992 A
5319754 Meinecke et al. Jun 1994 A
5400246 Wilson et al. Mar 1995 A
5436909 Dev et al. Jul 1995 A
5555416 Owens et al. Sep 1996 A
5726644 Jednacz et al. Mar 1998 A
5742803 Igarashi et al. Apr 1998 A
5742829 Davis Apr 1998 A
5751914 Coley et al. May 1998 A
5794047 Meier Aug 1998 A
5822731 Schultz Oct 1998 A
5831848 Rielly et al. Nov 1998 A
5903545 Sabourin et al. May 1999 A
6012096 Link et al. Jan 2000 A
6026362 Kim et al. Feb 2000 A
6085243 Fletcher et al. Jul 2000 A
6115462 Servi et al. Sep 2000 A
6141595 Gloudeman et al. Oct 2000 A
6144962 Weinberg et al. Nov 2000 A
6204850 Green Mar 2001 B1
6215898 Woodfill et al. Apr 2001 B1
6230312 Hunt May 2001 B1
6239699 Ronnen May 2001 B1
6247058 Miller et al. Jun 2001 B1
6249241 Jordan et al. Jun 2001 B1
6279035 Brown et al. Aug 2001 B1
6295527 McCormack et al. Sep 2001 B1
6307837 Ichikawa et al. Oct 2001 B1
6330562 Boden et al. Dec 2001 B1
6338131 Dillon Jan 2002 B1
6351843 Berkley et al. Feb 2002 B1
6353775 Nichols Mar 2002 B1
6381735 Hunt Apr 2002 B1
6499137 Hunt Dec 2002 B1
6525658 Streetman et al. Feb 2003 B2
6546420 Lemler et al. Apr 2003 B1
6546553 Hunt Apr 2003 B1
6597663 Rekhter Jul 2003 B1
6611896 Mason, Jr. et al. Aug 2003 B1
6629123 Hunt Sep 2003 B1
6654750 Adams et al. Nov 2003 B1
6718414 Doggett Apr 2004 B1
6728779 Griffin et al. Apr 2004 B1
6751663 Farrell et al. Jun 2004 B1
6774899 Ryall et al. Aug 2004 B1
6801878 Hintz et al. Oct 2004 B1
6816461 Scrandis et al. Nov 2004 B1
6847993 Novaes et al. Jan 2005 B1
6848106 Hipp Jan 2005 B1
6925490 Novaes et al. Aug 2005 B1
6958998 Shorey Oct 2005 B2
6965861 Dailey et al. Nov 2005 B1
6983323 Cantrell et al. Jan 2006 B2
6996808 Niewiadomski et al. Feb 2006 B1
6996817 Birum et al. Feb 2006 B2
6999452 Drummond-Murray et al. Feb 2006 B1
7024468 Meyer et al. Apr 2006 B1
7089583 Mehra et al. Aug 2006 B2
7096368 Kouznetsov et al. Aug 2006 B2
7111055 Falkner Sep 2006 B2
7120934 Ishikawa Oct 2006 B2
7133923 MeLampy et al. Nov 2006 B2
7162643 Sankaran et al. Jan 2007 B1
7167483 Sharma et al. Jan 2007 B1
7181769 Keanini et al. Feb 2007 B1
7185103 Jain Feb 2007 B1
7194664 Fung et al. Mar 2007 B1
7203740 Putzolu Apr 2007 B1
7263689 Dwards et al. Aug 2007 B1
7296288 Hill et al. Nov 2007 B1
7302487 Ylonen et al. Nov 2007 B2
7327735 Robotham et al. Feb 2008 B2
7331060 Ricciulli Feb 2008 B1
7337206 Wen et al. Feb 2008 B1
7349761 Cruse Mar 2008 B1
7353507 Gazdik et al. Apr 2008 B2
7353511 Ziese Apr 2008 B1
7356679 Le et al. Apr 2008 B1
7360072 Soltis et al. Apr 2008 B1
7370092 Aderton et al. May 2008 B2
7395195 Suenbuel et al. Jul 2008 B2
7444404 Wetherall et al. Oct 2008 B2
7453879 Lo Nov 2008 B1
7454486 Kaler et al. Nov 2008 B2
7466681 Ashwood-Smith et al. Dec 2008 B2
7467205 Dempster et al. Dec 2008 B1
7496040 Seo Feb 2009 B2
7496575 Buccella et al. Feb 2009 B2
7496661 Morford et al. Feb 2009 B1
7523465 Aamodt et al. Apr 2009 B2
7523493 Liang et al. Apr 2009 B2
7530105 Gilbert et al. May 2009 B2
7539770 Meier May 2009 B2
7568107 Rathi et al. Jul 2009 B1
7571478 Munson et al. Aug 2009 B2
7606203 Shabtay et al. Oct 2009 B1
7610330 Quinn et al. Oct 2009 B1
7633942 Bearden et al. Dec 2009 B2
7644438 Dash et al. Jan 2010 B1
7676570 Levy et al. Mar 2010 B2
7681131 Quarterman et al. Mar 2010 B1
7693947 Judge et al. Apr 2010 B2
7742406 Muppala Jun 2010 B1
7742413 Bugenhagen Jun 2010 B1
7743242 Oberhaus et al. Jun 2010 B2
7752307 Takara Jul 2010 B2
7774498 Kraemer et al. Aug 2010 B1
7783457 Cunningham Aug 2010 B2
7787480 Mehta et al. Aug 2010 B1
7788477 Huang et al. Aug 2010 B1
7808897 Mehta et al. Oct 2010 B1
7813822 Hoffberg Oct 2010 B1
7840618 Zhang et al. Nov 2010 B2
7844696 Labovitz et al. Nov 2010 B2
7844744 Abercrombie et al. Nov 2010 B2
7864707 Dimitropoulos et al. Jan 2011 B2
7870204 LeVasseur et al. Jan 2011 B2
7873025 Patel et al. Jan 2011 B2
7873074 Boland Jan 2011 B1
7874001 Beck et al. Jan 2011 B2
7885197 Metzler Feb 2011 B2
7895649 Brook et al. Feb 2011 B1
7904420 Ianni Mar 2011 B2
7930752 Hertzog et al. Apr 2011 B2
7934248 Yehuda et al. Apr 2011 B1
7957934 Greifeneder Jun 2011 B2
7961637 McBeath Jun 2011 B2
7970946 Djabarov et al. Jun 2011 B1
7975035 Popescu et al. Jul 2011 B2
7990847 Leroy et al. Aug 2011 B1
8001610 Chickering et al. Aug 2011 B1
8005935 Pradhan et al. Aug 2011 B2
8040232 Oh et al. Oct 2011 B2
8040822 Proulz et al. Oct 2011 B2
8040832 Nishio et al. Oct 2011 B2
8056134 Ogilvie Nov 2011 B1
8115617 Thubert et al. Feb 2012 B2
8135657 Kapoor et al. Mar 2012 B2
8135847 Pujol et al. Mar 2012 B2
8156430 Newman Apr 2012 B2
8160063 Maltz et al. Apr 2012 B2
8179809 Eppstein et al. May 2012 B1
8181248 Oh et al. May 2012 B2
8181253 Zaitsev et al. May 2012 B1
8185343 Fitzgerald et al. May 2012 B1
8185824 Mitchell et al. May 2012 B1
8239365 Salman Aug 2012 B2
8239915 Satish et al. Aug 2012 B1
8250657 Nachenberg et al. Aug 2012 B1
8255972 Azagury et al. Aug 2012 B2
8266697 Coffman Sep 2012 B2
8272875 Jurmain Sep 2012 B1
8280683 Finkler Oct 2012 B2
8281397 Vaidyanathan et al. Oct 2012 B2
8291495 Burns et al. Oct 2012 B1
8296847 Mendonca et al. Oct 2012 B2
8311973 Zadeh Nov 2012 B1
8312540 Kahn et al. Nov 2012 B1
8339959 Moisand et al. Dec 2012 B1
8356007 Larson et al. Jan 2013 B2
8365005 Bengtson et al. Jan 2013 B2
8365286 Poston Jan 2013 B2
8370407 Devarajan et al. Feb 2013 B1
8381289 Pereira et al. Feb 2013 B1
8391270 Van Der Stok et al. Mar 2013 B2
8407164 Malik et al. Mar 2013 B2
8407798 Lotem et al. Mar 2013 B1
8413235 Chen et al. Apr 2013 B1
8442073 Skubacz et al. May 2013 B2
8451731 Lee et al. May 2013 B1
8462212 Kundu et al. Jun 2013 B1
8463860 Guruswamy et al. Jun 2013 B1
8489765 Vasseur et al. Jul 2013 B2
8494985 Keralapura et al. Jul 2013 B1
8499348 Rubin Jul 2013 B1
8516590 Ranadive et al. Aug 2013 B1
8527977 Cheng et al. Sep 2013 B1
8549635 Muttik et al. Oct 2013 B2
8565109 Poovendran Oct 2013 B1
8570861 Brandwine et al. Oct 2013 B1
8572600 Chung et al. Oct 2013 B2
8572734 McConnell et al. Oct 2013 B2
8572735 Ghosh et al. Oct 2013 B2
8572739 Cruz et al. Oct 2013 B1
8578491 McNamee et al. Nov 2013 B2
8588081 Salam et al. Nov 2013 B2
8595709 Rao et al. Nov 2013 B2
8600726 Varshney et al. Dec 2013 B1
8612530 Sapovalovs et al. Dec 2013 B1
8613084 Dalcher Dec 2013 B2
8615803 Dacier et al. Dec 2013 B2
8630316 Haba Jan 2014 B2
8631464 Belakhdar et al. Jan 2014 B2
8640086 Bonev et al. Jan 2014 B2
8656493 Capalik Feb 2014 B2
8661544 Yen et al. Feb 2014 B2
8677487 Balupari et al. Mar 2014 B2
8683389 Bar-Yam et al. Mar 2014 B1
8689172 Amaral et al. Apr 2014 B2
8706914 Duchesneau Apr 2014 B2
8713676 Pandrangi et al. Apr 2014 B2
8719452 Ding et al. May 2014 B1
8719835 Kanso et al. May 2014 B2
8750287 Bui et al. Jun 2014 B2
8752042 Ratica Jun 2014 B2
8752179 Zaitsev Jun 2014 B2
8755396 Sindhu et al. Jun 2014 B2
8762951 Kosche et al. Jun 2014 B1
8769084 Westerfeld et al. Jul 2014 B2
8775577 Alford et al. Jul 2014 B1
8776180 Kumar et al. Jul 2014 B2
8779921 Curtiss Jul 2014 B1
8793255 Bilinski et al. Jul 2014 B1
8805946 Glommen Aug 2014 B1
8812448 Anderson et al. Aug 2014 B1
8812725 Kulkarni Aug 2014 B2
8813236 Saha et al. Aug 2014 B1
8825848 Dotan et al. Sep 2014 B1
8832013 Adams Sep 2014 B1
8832103 Isaacson et al. Sep 2014 B2
8832461 Saroiu et al. Sep 2014 B2
8849926 Marzencki et al. Sep 2014 B2
8881258 Paul et al. Nov 2014 B2
8887238 Howard et al. Nov 2014 B2
8887285 Jordan et al. Nov 2014 B2
8904520 Nachenberg et al. Dec 2014 B1
8908685 Patel et al. Dec 2014 B2
8914497 Xiao et al. Dec 2014 B1
8924941 Krajec et al. Dec 2014 B2
8931043 Cooper et al. Jan 2015 B2
8954546 Krajec Feb 2015 B2
8954610 Berke et al. Feb 2015 B2
8955124 Kim et al. Feb 2015 B2
8966021 Allen Feb 2015 B1
8966625 Zuk et al. Feb 2015 B1
8973147 Pearcy et al. Mar 2015 B2
8984331 Quinn Mar 2015 B2
8990386 He et al. Mar 2015 B2
8996695 Anderson et al. Mar 2015 B2
8997063 Krajec et al. Mar 2015 B2
8997227 Mhatre et al. Mar 2015 B1
9014047 Alcala et al. Apr 2015 B2
9015716 Fletcher Apr 2015 B2
9043905 Allen et al. May 2015 B1
9071575 Lemaster et al. Jun 2015 B2
9088598 Zhang et al. Jul 2015 B1
9104543 Cavanagh et al. Aug 2015 B1
9110905 Polley et al. Aug 2015 B2
9117075 Yeh Aug 2015 B1
9130836 Kapadia et al. Sep 2015 B2
9135145 Voccio et al. Sep 2015 B2
9141912 Shircliff et al. Sep 2015 B2
9141914 Viswanathan Sep 2015 B2
9146820 Alfadhly et al. Sep 2015 B2
9152789 Natarajan et al. Oct 2015 B2
9158720 Shirlen et al. Oct 2015 B2
9160764 Stiansen et al. Oct 2015 B2
9170917 Kumar et al. Oct 2015 B2
9178906 Chen et al. Nov 2015 B1
9179058 Zeira et al. Nov 2015 B1
9185127 Neou et al. Nov 2015 B2
9191042 Yan Nov 2015 B2
9191400 Ptasinski et al. Nov 2015 B1
9191402 Yan Nov 2015 B2
9197654 Ben-Shalom et al. Nov 2015 B2
9225793 Dutta et al. Dec 2015 B2
9237111 Banavalikar et al. Jan 2016 B2
9246702 Sharma et al. Jan 2016 B1
9246773 Degioanni Jan 2016 B2
9252915 Bakken Feb 2016 B1
9253042 Lumezanu et al. Feb 2016 B2
9253206 Fleischman Feb 2016 B1
9258217 Duffield et al. Feb 2016 B2
9276829 Castro et al. Mar 2016 B2
9281940 Matsuda et al. Mar 2016 B2
9286047 Avramov et al. Mar 2016 B1
9292415 Seto et al. Mar 2016 B2
9294486 Chiang et al. Mar 2016 B1
9294498 Yampolskiy et al. Mar 2016 B1
9300689 Tsuchitoi Mar 2016 B2
9317574 Brisebois et al. Apr 2016 B1
9319384 Yan et al. Apr 2016 B2
9369435 Short et al. Jun 2016 B2
9369479 Lin Jun 2016 B2
9378068 Anantharam et al. Jun 2016 B2
9396327 Shimomura et al. Jun 2016 B2
9385917 Khanna et al. Jul 2016 B1
9397902 Dragon et al. Jul 2016 B2
9405903 Xie et al. Aug 2016 B1
9417985 Baars et al. Aug 2016 B2
9418222 Rivera et al. Aug 2016 B1
9426068 Dunbar et al. Aug 2016 B2
9454324 Madhavapeddi Sep 2016 B1
9462013 Boss et al. Oct 2016 B1
9465696 McNeil et al. Oct 2016 B2
9483334 Walsh Nov 2016 B2
9487222 Palmer et al. Nov 2016 B2
9501744 Brisebois et al. Nov 2016 B1
9531589 Clemm et al. Dec 2016 B2
9536084 Lukacs et al. Jan 2017 B1
9552221 Pora Jan 2017 B1
9563517 Natanzon et al. Feb 2017 B1
9575869 Pechanec et al. Feb 2017 B2
9575874 Gautallin et al. Feb 2017 B2
9576240 Jeong et al. Feb 2017 B2
9582669 Shen et al. Feb 2017 B1
9596196 Hills Mar 2017 B1
9602536 Brown, Jr. et al. Mar 2017 B1
9621413 Lee Apr 2017 B1
9621575 Jalan et al. Apr 2017 B1
9634915 Bley Apr 2017 B2
9645892 Patwardhan May 2017 B1
9658942 Bhat et al. May 2017 B2
9665474 Li et al. May 2017 B2
9678803 Suit Jun 2017 B2
9684453 Holt et al. Jun 2017 B2
9686233 Paxton Jun 2017 B2
9697033 Koponen et al. Jul 2017 B2
9727394 Xun et al. Aug 2017 B2
9729568 Lefebvre et al. Aug 2017 B2
9733973 Prasad et al. Aug 2017 B2
9736041 Lumezanu et al. Aug 2017 B2
9749145 Banavalikar et al. Aug 2017 B2
9800608 Korsunsky et al. Oct 2017 B2
9804830 Raman et al. Oct 2017 B2
9804951 Liu et al. Oct 2017 B2
9813307 Walsh et al. Nov 2017 B2
9813324 Nampelly et al. Nov 2017 B2
9813516 Wang Nov 2017 B2
9825911 Brandwine Nov 2017 B1
9836183 Love et al. Dec 2017 B1
9857825 Johnson et al. Jan 2018 B1
9858621 Konrardy et al. Jan 2018 B1
9860208 Ettema et al. Jan 2018 B1
9904584 Konig et al. Feb 2018 B2
9916232 Voccio et al. Mar 2018 B2
9916538 Zadeh et al. Mar 2018 B2
9935851 Gandham et al. Apr 2018 B2
9967158 Pang et al. May 2018 B2
9979615 Kulshreshtha et al. May 2018 B2
9996529 McCandless et al. Jun 2018 B2
10002187 McCandless et al. Jun 2018 B2
10009240 Rao Jun 2018 B2
10116531 Attar et al. Oct 2018 B2
10142353 Yadav et al. Nov 2018 B2
10171319 Yadav et al. Jan 2019 B2
10243862 Cafarelli et al. Mar 2019 B2
10394692 Liu et al. Aug 2019 B2
10447551 Zhang et al. Oct 2019 B1
10454793 Deen et al. Oct 2019 B2
10454999 Eder Oct 2019 B2
10476982 Tarre et al. Nov 2019 B2
10516586 Gandham et al. Dec 2019 B2
10652225 Koved et al. May 2020 B2
10686804 Yadav et al. Jun 2020 B2
10749890 Aloisio Aug 2020 B1
10944683 Roskind Mar 2021 B1
11368378 Gandham et al. Jun 2022 B2
11516098 Spadaro et al. Nov 2022 B2
11528283 Yadav et al. Dec 2022 B2
11556808 Kim et al. Jan 2023 B1
20010028646 Arts et al. Oct 2001 A1
20020023210 Tuomenoksa et al. Feb 2002 A1
20020053033 Cooper et al. May 2002 A1
20020083175 Afek et al. Jun 2002 A1
20020097687 Meiri et al. Jul 2002 A1
20020103793 Koller et al. Aug 2002 A1
20020107857 Teraslinna Aug 2002 A1
20020107875 Seliger et al. Aug 2002 A1
20020141343 Bays Oct 2002 A1
20020184393 Leddy et al. Dec 2002 A1
20020196292 Itoh et al. Dec 2002 A1
20030005145 Bullard Jan 2003 A1
20030016627 MeLampy et al. Jan 2003 A1
20030023600 Nagamura et al. Jan 2003 A1
20030023601 Fortier, Jr. et al. Jan 2003 A1
20030046388 Milliken Mar 2003 A1
20030065986 Fraenkel et al. Apr 2003 A1
20030072269 Teruhi et al. Apr 2003 A1
20030084158 Saito et al. May 2003 A1
20030086425 Bearden et al. May 2003 A1
20030097439 Strayer et al. May 2003 A1
20030105976 Copeland, III Jun 2003 A1
20030126242 Chang Jul 2003 A1
20030133443 Klinker et al. Jul 2003 A1
20030145232 Poletto et al. Jul 2003 A1
20030149888 Yadav Aug 2003 A1
20030151513 Hermann et al. Aug 2003 A1
20030154399 Zuk et al. Aug 2003 A1
20030177208 Harvey, IV Sep 2003 A1
20030206205 Kawahara et al. Nov 2003 A1
20040019676 Watsuki et al. Jan 2004 A1
20040030776 Cantrell et al. Feb 2004 A1
20040036478 Logvinov et al. Feb 2004 A1
20040046787 Henry et al. Mar 2004 A1
20040049698 Ott et al. Mar 2004 A1
20040054680 Kelley et al. Mar 2004 A1
20040111679 Subasic et al. Jun 2004 A1
20040133640 Yeager et al. Jul 2004 A1
20040133690 Chauffour et al. Jul 2004 A1
20040137908 Sinivaara et al. Jul 2004 A1
20040167921 Carson et al. Aug 2004 A1
20040205536 Newman et al. Oct 2004 A1
20040213221 Civanlar et al. Oct 2004 A1
20040218532 Khirman Nov 2004 A1
20040220984 Dudfield et al. Nov 2004 A1
20040243533 Dempster et al. Dec 2004 A1
20040255050 Takehiro et al. Dec 2004 A1
20040268149 Aaron Dec 2004 A1
20050028154 Smith et al. Feb 2005 A1
20050039104 Shah et al. Feb 2005 A1
20050060403 Bernstein et al. Mar 2005 A1
20050063377 Bryant et al. Mar 2005 A1
20050068907 Garg et al. Mar 2005 A1
20050083933 Fine et al. Apr 2005 A1
20050104885 Jager et al. May 2005 A1
20050108331 Osterman May 2005 A1
20050122325 Twait Jun 2005 A1
20050138157 Jung et al. Jun 2005 A1
20050154625 Chua Jul 2005 A1
20050166066 Ahuja et al. Jul 2005 A1
20050177829 Vishwanath Aug 2005 A1
20050177871 Roesch et al. Aug 2005 A1
20050182681 Bruskotte et al. Aug 2005 A1
20050185621 Sivakumar et al. Aug 2005 A1
20050198247 Perry et al. Sep 2005 A1
20050198371 Smith et al. Sep 2005 A1
20050198629 Vishwanath Sep 2005 A1
20050207376 Ashwood-Smith et al. Sep 2005 A1
20050210331 Connelly et al. Sep 2005 A1
20050210533 Copeland et al. Sep 2005 A1
20050228885 Winfield et al. Oct 2005 A1
20050237948 Wan et al. Oct 2005 A1
20050257244 Joly et al. Nov 2005 A1
20050289244 Sahu et al. Dec 2005 A1
20060004758 Teng et al. Jan 2006 A1
20060026669 Zakas Feb 2006 A1
20060048218 Lingafelt et al. Mar 2006 A1
20060058218 Lingafelt et al. Mar 2006 A1
20060075396 Surasinghe Apr 2006 A1
20060077909 Saleh et al. Apr 2006 A1
20060080733 Khosmood et al. Apr 2006 A1
20060089985 Poletto Apr 2006 A1
20060095968 Portolani et al. May 2006 A1
20060098625 King et al. May 2006 A1
20060101516 Sudaharan et al. May 2006 A1
20060106550 Morin et al. May 2006 A1
20060143432 Rothman et al. Jun 2006 A1
20060156408 Himberger Jul 2006 A1
20060158266 Yonekawa et al. Jul 2006 A1
20060158354 Aberg et al. Jul 2006 A1
20060159032 Ukrainetz et al. Jul 2006 A1
20060173912 Lindvall et al. Aug 2006 A1
20060195448 Newport Aug 2006 A1
20060212556 Yacoby et al. Sep 2006 A1
20060224398 Lakshman et al. Oct 2006 A1
20060253566 Stassinopoulos et al. Nov 2006 A1
20060265713 Depro et al. Nov 2006 A1
20060272018 Fouant Nov 2006 A1
20060274659 Ouderkirk Dec 2006 A1
20060280179 Meier Dec 2006 A1
20060294219 Ogawa et al. Dec 2006 A1
20070010898 Hosek et al. Jan 2007 A1
20070014275 Bettink et al. Jan 2007 A1
20070019618 Shaffer et al. Jan 2007 A1
20070025306 Cox et al. Feb 2007 A1
20070044147 Choi et al. Feb 2007 A1
20070067756 Garza Mar 2007 A1
20070074288 Chang et al. Mar 2007 A1
20070097976 Wood et al. May 2007 A1
20070118654 Jamkhedkar et al. May 2007 A1
20070124376 Greenwell May 2007 A1
20070127491 Verzijp et al. Jun 2007 A1
20070140131 Malloy et al. Jun 2007 A1
20070150568 Ruiz Jun 2007 A1
20070162420 Ou et al. Jul 2007 A1
20070169179 Narad Jul 2007 A1
20070177626 Kotelba Aug 2007 A1
20070180526 Copeland Aug 2007 A1
20070195729 Li et al. Aug 2007 A1
20070195794 Fujita et al. Aug 2007 A1
20070195797 Patel et al. Aug 2007 A1
20070199060 Touboul Aug 2007 A1
20070201474 Sobe Aug 2007 A1
20070211637 Mitchell Sep 2007 A1
20070214348 Danielsen Sep 2007 A1
20070223388 Arad et al. Sep 2007 A1
20070230415 Malik Oct 2007 A1
20070232265 Park et al. Oct 2007 A1
20070250640 Wells Oct 2007 A1
20070250930 Aziz et al. Oct 2007 A1
20070280108 Sakurai Dec 2007 A1
20070300061 Kim et al. Dec 2007 A1
20080002697 Anantharamaiah et al. Jan 2008 A1
20080013532 Garner et al. Jan 2008 A1
20080017619 Yamakawa et al. Jan 2008 A1
20080022385 Crowell et al. Jan 2008 A1
20080028389 Genty et al. Jan 2008 A1
20080040088 Vankov et al. Feb 2008 A1
20080046708 Fitzgerald et al. Feb 2008 A1
20080049633 Edwards et al. Feb 2008 A1
20080052387 Heinz et al. Feb 2008 A1
20080056124 Nanda et al. Mar 2008 A1
20080066009 Gardner et al. Mar 2008 A1
20080082662 Danliker et al. Apr 2008 A1
20080101234 Nakil et al. May 2008 A1
20080120350 Grabowski et al. May 2008 A1
20080126534 Mueller et al. May 2008 A1
20080141246 Kuck et al. Jun 2008 A1
20080155245 Lipscombe et al. Jun 2008 A1
20080181100 Yang et al. Jul 2008 A1
20080185621 Yi et al. Aug 2008 A1
20080201109 Zill et al. Aug 2008 A1
20080208367 Koehler et al. Aug 2008 A1
20080222352 Booth et al. Sep 2008 A1
20080232358 Baker et al. Sep 2008 A1
20080247539 Huang et al. Oct 2008 A1
20080250122 Zsigmond et al. Oct 2008 A1
20080250128 Sargent Oct 2008 A1
20080262990 Kapoor et al. Oct 2008 A1
20080270199 Chess et al. Oct 2008 A1
20080282347 Dadhia et al. Nov 2008 A1
20080295163 Kang Nov 2008 A1
20080298271 Morinaga et al. Dec 2008 A1
20080301755 Sinha et al. Dec 2008 A1
20080301765 Nicol et al. Dec 2008 A1
20080320592 Suit et al. Dec 2008 A1
20090019026 Valdes-Perez et al. Jan 2009 A1
20090059934 Aggarwal et al. Mar 2009 A1
20090064332 Porras et al. Mar 2009 A1
20090077097 Lacapra et al. Mar 2009 A1
20090077543 Siskind et al. Mar 2009 A1
20090077666 Chen et al. Mar 2009 A1
20090106646 Mollicone et al. Apr 2009 A1
20090109849 Wood et al. Apr 2009 A1
20090133126 Jang et al. May 2009 A1
20090138590 Lee et al. May 2009 A1
20090158432 Zheng et al. Jun 2009 A1
20090177484 Davis et al. Jul 2009 A1
20090180393 Nakamura Jul 2009 A1
20090192847 Lipkin et al. Jul 2009 A1
20090193495 McAfee et al. Jul 2009 A1
20090241170 Kumar et al. Sep 2009 A1
20090249302 Xu et al. Oct 2009 A1
20090252181 Desanti Oct 2009 A1
20090260083 Szeto et al. Oct 2009 A1
20090271412 Lacapra et al. Oct 2009 A1
20090292795 Ford et al. Nov 2009 A1
20090296593 Prescott Dec 2009 A1
20090300180 Dehaan et al. Dec 2009 A1
20090307753 Dupont et al. Dec 2009 A1
20090310485 Averi et al. Dec 2009 A1
20090313373 Hanna et al. Dec 2009 A1
20090313698 Wahl Dec 2009 A1
20090319912 Serr et al. Dec 2009 A1
20090323543 Shimakura Dec 2009 A1
20090328219 Narayanaswamy Dec 2009 A1
20100005288 Rao et al. Jan 2010 A1
20100005478 Helfman et al. Jan 2010 A1
20100042716 Farajidana et al. Feb 2010 A1
20100049839 Parker et al. Feb 2010 A1
20100054241 Shah et al. Mar 2010 A1
20100070647 Irino et al. Mar 2010 A1
20100077445 Schneider et al. Mar 2010 A1
20100095293 O'Neill et al. Apr 2010 A1
20100095367 Narayanaswamy Apr 2010 A1
20100095377 Krywaniuk Apr 2010 A1
20100138526 DeHaan et al. Jun 2010 A1
20100138810 Komatsu et al. Jun 2010 A1
20100148940 Gelvin et al. Jun 2010 A1
20100153316 Duffield et al. Jun 2010 A1
20100153696 Beachem et al. Jun 2010 A1
20100157809 Duffield et al. Jun 2010 A1
20100161817 Xiao et al. Jun 2010 A1
20100174813 Hildreth et al. Jul 2010 A1
20100180016 Bugwadia et al. Jul 2010 A1
20100188989 Wing et al. Jul 2010 A1
20100188995 Raleigh Jul 2010 A1
20100194741 Finocchio Aug 2010 A1
20100220584 DeHaan et al. Sep 2010 A1
20100226373 Rowell et al. Sep 2010 A1
20100235514 Beachem Sep 2010 A1
20100235879 Burnside et al. Sep 2010 A1
20100235915 Memon et al. Sep 2010 A1
20100246432 Zhang et al. Sep 2010 A1
20100287266 Astai et al. Sep 2010 A1
20100303240 Beachem Nov 2010 A1
20100306180 Johnson et al. Dec 2010 A1
20100317420 Hoffberg Dec 2010 A1
20100319060 Aiken et al. Dec 2010 A1
20110004935 Moffie et al. Jan 2011 A1
20110010585 Bugenhagen et al. Jan 2011 A1
20110022641 Werth et al. Jan 2011 A1
20110055381 Narasimhan et al. Mar 2011 A1
20110055382 Narasimhan Mar 2011 A1
20110055388 Yumerefendi et al. Mar 2011 A1
20110066719 Miryanov et al. Mar 2011 A1
20110069685 Tofighbakhsh Mar 2011 A1
20110072119 Bronstein et al. Mar 2011 A1
20110083124 Moskal et al. Apr 2011 A1
20110083125 Komatsu et al. Apr 2011 A1
20110085556 Breslin et al. Apr 2011 A1
20110103259 Aybay et al. May 2011 A1
20110107074 Chan et al. May 2011 A1
20110107331 Evans et al. May 2011 A1
20110125894 Anderson et al. May 2011 A1
20110126136 Abella et al. May 2011 A1
20110126275 Anderson et al. May 2011 A1
20110145885 Rivers et al. Jun 2011 A1
20110153039 Gvelesiani et al. Jun 2011 A1
20110153811 Jeong et al. Jun 2011 A1
20110158088 Lofstrand et al. Jun 2011 A1
20110158112 Finn et al. Jun 2011 A1
20110158410 Falk et al. Jun 2011 A1
20110167435 Fang Jul 2011 A1
20110170860 Smith et al. Jul 2011 A1
20110173490 Narayanaswamy et al. Jul 2011 A1
20110185423 Sallam Jul 2011 A1
20110191465 Hofstaedter et al. Aug 2011 A1
20110196957 Ayachitula et al. Aug 2011 A1
20110202655 Sharma et al. Aug 2011 A1
20110202761 Sarela et al. Aug 2011 A1
20110214174 Herzog et al. Sep 2011 A1
20110225207 Subramanian et al. Sep 2011 A1
20110228696 Agarwal et al. Sep 2011 A1
20110231510 Korsunsky et al. Sep 2011 A1
20110238793 Bedare et al. Sep 2011 A1
20110239194 Braude Sep 2011 A1
20110246663 Melsen et al. Oct 2011 A1
20110267952 Ko et al. Nov 2011 A1
20110276951 Jain Nov 2011 A1
20110277034 Hanson Nov 2011 A1
20110283266 Gallagher et al. Nov 2011 A1
20110283277 Castillo et al. Nov 2011 A1
20110289122 Grube et al. Nov 2011 A1
20110289301 Allen et al. Nov 2011 A1
20110302295 Westerfeld et al. Dec 2011 A1
20110302652 Westerfeld Dec 2011 A1
20110310892 DiMambro Dec 2011 A1
20110314148 Petersen et al. Dec 2011 A1
20110317982 Xu et al. Dec 2011 A1
20120005542 Petersen et al. Jan 2012 A1
20120011153 Buchanan et al. Jan 2012 A1
20120017262 Kapoor et al. Jan 2012 A1
20120047394 Jain et al. Feb 2012 A1
20120075999 Ko et al. Mar 2012 A1
20120079592 Pandrangi Mar 2012 A1
20120089664 Igelka Apr 2012 A1
20120096394 Balko et al. Apr 2012 A1
20120102361 Sass et al. Apr 2012 A1
20120102543 Kohli et al. Apr 2012 A1
20120102545 Carter, III et al. Apr 2012 A1
20120110188 Van Biljon et al. May 2012 A1
20120117226 Tanaka et al. May 2012 A1
20120117642 Lin et al. May 2012 A1
20120136996 Seo et al. May 2012 A1
20120137278 Draper et al. May 2012 A1
20120137361 Yi et al. May 2012 A1
20120140626 Anand et al. Jun 2012 A1
20120144030 Narasimhan Jun 2012 A1
20120167057 Schmich et al. Jun 2012 A1
20120195198 Regan Aug 2012 A1
20120197856 Banka et al. Aug 2012 A1
20120198541 Reeves Aug 2012 A1
20120216271 Cooper et al. Aug 2012 A1
20120216282 Pappu et al. Aug 2012 A1
20120218989 Tanabe et al. Aug 2012 A1
20120219004 Balus et al. Aug 2012 A1
20120233348 Winters Sep 2012 A1
20120233473 Vasseur et al. Sep 2012 A1
20120240185 Kapoor et al. Sep 2012 A1
20120240232 Azuma Sep 2012 A1
20120246303 Petersen et al. Sep 2012 A1
20120254109 Shukla et al. Oct 2012 A1
20120255875 Vicente et al. Oct 2012 A1
20120260135 Beck et al. Oct 2012 A1
20120260227 Shukla et al. Oct 2012 A1
20120268405 Ferren et al. Oct 2012 A1
20120278021 Lin et al. Nov 2012 A1
20120281700 Koganti et al. Nov 2012 A1
20120287815 Attar Nov 2012 A1
20120300628 Prescott et al. Nov 2012 A1
20130003538 Greenburg et al. Jan 2013 A1
20130003733 Venkatesan et al. Jan 2013 A1
20130006935 Grisby Jan 2013 A1
20130007435 Bayani Jan 2013 A1
20130019008 Jorgenson et al. Jan 2013 A1
20130038358 Cook et al. Feb 2013 A1
20130041934 Annamalaisami et al. Feb 2013 A1
20130054682 Malik et al. Feb 2013 A1
20130055145 Antony et al. Feb 2013 A1
20130055373 Beacham et al. Feb 2013 A1
20130064096 Degioanni et al. Mar 2013 A1
20130080375 Viswanathan et al. Mar 2013 A1
20130085889 Fitting et al. Apr 2013 A1
20130086272 Chen et al. Apr 2013 A1
20130094372 Boot Apr 2013 A1
20130097706 Titonis et al. Apr 2013 A1
20130103827 Dunlap et al. Apr 2013 A1
20130107709 Campbell et al. May 2013 A1
20130114598 Schrum et al. May 2013 A1
20130117748 Cooper et al. May 2013 A1
20130122854 Agarwal et al. May 2013 A1
20130124807 Nielsen et al. May 2013 A1
20130125107 Bandakka et al. May 2013 A1
20130145099 Liu et al. Jun 2013 A1
20130148663 Xiong Jun 2013 A1
20130159999 Chiueh et al. Jun 2013 A1
20130160128 Dolan-Gavitt et al. Jun 2013 A1
20130166730 Wilkinson Jun 2013 A1
20130173784 Wang et al. Jul 2013 A1
20130173787 Wang et al. Jul 2013 A1
20130174256 Powers Jul 2013 A1
20130179487 Lubetzky et al. Jul 2013 A1
20130179879 Zhang et al. Jul 2013 A1
20130198509 Buruganahalli et al. Aug 2013 A1
20130198517 Mazzarella Aug 2013 A1
20130198839 Wei et al. Aug 2013 A1
20130201986 Sajassi et al. Aug 2013 A1
20130205137 Farrugia et al. Aug 2013 A1
20130205293 Levijarvi et al. Aug 2013 A1
20130219161 Fontignie et al. Aug 2013 A1
20130219263 Abrahami Aug 2013 A1
20130219500 Lukas et al. Aug 2013 A1
20130232498 Mangtani et al. Sep 2013 A1
20130238665 Sequin Sep 2013 A1
20130242999 Kamble et al. Sep 2013 A1
20130246925 Ahuja et al. Sep 2013 A1
20130247201 Alperovitch et al. Sep 2013 A1
20130254879 Chesla et al. Sep 2013 A1
20130268994 Cooper et al. Oct 2013 A1
20130275579 Hernandez et al. Oct 2013 A1
20130283240 Krajec et al. Oct 2013 A1
20130283281 Krajec et al. Oct 2013 A1
20130283374 Zisapel et al. Oct 2013 A1
20130290521 Labovitz Oct 2013 A1
20130297771 Osterloh et al. Nov 2013 A1
20130298244 Kumar et al. Nov 2013 A1
20130301472 Allan Nov 2013 A1
20130304900 Trabelsi et al. Nov 2013 A1
20130305369 Karta et al. Nov 2013 A1
20130308468 Cowie Nov 2013 A1
20130312097 Turnbull Nov 2013 A1
20130326623 Kruglick Dec 2013 A1
20130326625 Anderson et al. Dec 2013 A1
20130332773 Yuan et al. Dec 2013 A1
20130333029 Chesla et al. Dec 2013 A1
20130335219 Malkowski Dec 2013 A1
20130336164 Yang et al. Dec 2013 A1
20130343207 Cook et al. Dec 2013 A1
20130346054 Mumtaz Dec 2013 A1
20130346736 Cook et al. Dec 2013 A1
20130347103 Veteikis et al. Dec 2013 A1
20140006610 Formby et al. Jan 2014 A1
20140006871 Lakshmanan et al. Jan 2014 A1
20140009338 Lin et al. Jan 2014 A1
20140012562 Chang et al. Jan 2014 A1
20140012814 Bercovici et al. Jan 2014 A1
20140019972 Yahalom et al. Jan 2014 A1
20140020099 Vaidyanathan et al. Jan 2014 A1
20140031005 Sumcad et al. Jan 2014 A1
20140036688 Stassinopoulos et al. Feb 2014 A1
20140040343 Nickolov et al. Feb 2014 A1
20140047185 Perterson et al. Feb 2014 A1
20140047274 Lumezanu et al. Feb 2014 A1
20140047372 Gnezdov et al. Feb 2014 A1
20140050222 Lynar et al. Feb 2014 A1
20140053226 Fadiad et al. Feb 2014 A1
20140056318 Hansson et al. Feb 2014 A1
20140059200 Nguyen et al. Feb 2014 A1
20140074946 Dirstine et al. Mar 2014 A1
20140075048 Yuksel et al. Mar 2014 A1
20140075336 Curtis et al. Mar 2014 A1
20140081596 Agrawal et al. Mar 2014 A1
20140089494 Dasari et al. Mar 2014 A1
20140092884 Murphy et al. Apr 2014 A1
20140096058 Molesky et al. Apr 2014 A1
20140105029 Jain et al. Apr 2014 A1
20140108665 Arora et al. Apr 2014 A1
20140115219 Ajanovic et al. Apr 2014 A1
20140115403 Rhee et al. Apr 2014 A1
20140115654 Rogers et al. Apr 2014 A1
20140122656 Baldwin et al. May 2014 A1
20140129942 Rathod May 2014 A1
20140136680 Joshi et al. May 2014 A1
20140137109 Sharma et al. May 2014 A1
20140137180 Lukacs et al. May 2014 A1
20140140213 Raleigh et al. May 2014 A1
20140140244 Kapadia et al. May 2014 A1
20140141524 Keith May 2014 A1
20140143825 Behrendt et al. May 2014 A1
20140149490 Luxenberg et al. May 2014 A1
20140156814 Barabash et al. Jun 2014 A1
20140156861 Cruz-Aguilar et al. Jun 2014 A1
20140164607 Bai et al. Jun 2014 A1
20140165200 Singla Jun 2014 A1
20140165207 Engel et al. Jun 2014 A1
20140173623 Chang et al. Jun 2014 A1
20140173723 Singla et al. Jun 2014 A1
20140192639 Smirnov Jul 2014 A1
20140201717 Mascaro et al. Jul 2014 A1
20140201838 Varsanyi et al. Jul 2014 A1
20140208296 Dang et al. Jul 2014 A1
20140210616 Ramachandran Jul 2014 A1
20140215443 Voccio et al. Jul 2014 A1
20140215573 Cepuran Jul 2014 A1
20140215621 Xaypanya et al. Jul 2014 A1
20140224784 Kohler Aug 2014 A1
20140225603 Auguste et al. Aug 2014 A1
20140230062 Kumaran Aug 2014 A1
20140233387 Zheng et al. Aug 2014 A1
20140208049 Basavaiah et al. Sep 2014 A1
20140247206 Grokop et al. Sep 2014 A1
20140258310 Wong et al. Sep 2014 A1
20140269777 Rothstein et al. Sep 2014 A1
20140280892 Reynolds et al. Sep 2014 A1
20140280908 Rothstein et al. Sep 2014 A1
20140281030 Cui et al. Sep 2014 A1
20140286174 Iizuka et al. Sep 2014 A1
20140286354 Van De Poel et al. Sep 2014 A1
20140289418 Cohen et al. Sep 2014 A1
20140289854 Mahvi Sep 2014 A1
20140297357 Zeng et al. Oct 2014 A1
20140298461 Hohndel et al. Oct 2014 A1
20140301213 Khanal et al. Oct 2014 A1
20140307686 Su et al. Oct 2014 A1
20140317278 Kersch et al. Oct 2014 A1
20140317737 Shin et al. Oct 2014 A1
20140321290 Jin et al. Oct 2014 A1
20140330616 Lyras Nov 2014 A1
20140331048 Casas-Sanchez et al. Nov 2014 A1
20140331276 Frascadore et al. Nov 2014 A1
20140331280 Porras et al. Nov 2014 A1
20140331304 Wong Nov 2014 A1
20140344438 Chen et al. Nov 2014 A1
20140348182 Chandra et al. Nov 2014 A1
20140351203 Kunnatur et al. Nov 2014 A1
20140351415 Harrigan et al. Nov 2014 A1
20140359695 Chari et al. Dec 2014 A1
20140376379 Fredette et al. Dec 2014 A1
20150006689 Szilagyi et al. Jan 2015 A1
20150006714 Jain Jan 2015 A1
20150007317 Jain Jan 2015 A1
20150009840 Pruthi et al. Jan 2015 A1
20150019140 Downey et al. Jan 2015 A1
20150019569 Parker et al. Jan 2015 A1
20150023170 Kakadia et al. Jan 2015 A1
20150026794 Zuk et al. Jan 2015 A1
20150026809 Altman et al. Jan 2015 A1
20150033305 Shear et al. Jan 2015 A1
20150036480 Huang et al. Feb 2015 A1
20150036533 Sodhi et al. Feb 2015 A1
20150039751 Harrigan et al. Feb 2015 A1
20150039757 Petersen et al. Feb 2015 A1
20150043351 Ohkawa et al. Feb 2015 A1
20150046882 Menyhart et al. Feb 2015 A1
20150047032 Hannis et al. Feb 2015 A1
20150052441 Degioanni Feb 2015 A1
20150058976 Carney et al. Feb 2015 A1
20150067143 Babakhan et al. Mar 2015 A1
20150067786 Fiske Mar 2015 A1
20150082151 Liang et al. Mar 2015 A1
20150082430 Sridhara et al. Mar 2015 A1
20150085665 Kompella et al. Mar 2015 A1
20150089614 Mathew et al. Mar 2015 A1
20150095332 Beisiegel et al. Apr 2015 A1
20150112933 Satapathy Apr 2015 A1
20150113063 Liu et al. Apr 2015 A1
20150113133 Srinivas et al. Apr 2015 A1
20150117624 Rosenshine Apr 2015 A1
20150124608 Agarwal et al. May 2015 A1
20150124652 Dhamapurikar et al. May 2015 A1
20150128133 Pohlmann May 2015 A1
20150128205 Mahaffey et al. May 2015 A1
20150128246 Feghali et al. May 2015 A1
20150134801 Walley et al. May 2015 A1
20150138993 Forster et al. May 2015 A1
20150142962 Srinivas et al. May 2015 A1
20150147973 Williams et al. May 2015 A1
20150156118 Madani et al. Jun 2015 A1
20150170213 O'Malley Jun 2015 A1
20150195291 Zuk et al. Jul 2015 A1
20150199254 Vesepogu et al. Jul 2015 A1
20150222516 Deval et al. Aug 2015 A1
20150222939 Gallant et al. Aug 2015 A1
20150227396 Nimmagadda et al. Aug 2015 A1
20150227598 Hahn et al. Aug 2015 A1
20150244617 Nakil et al. Aug 2015 A1
20150244739 Ben-Shalom et al. Aug 2015 A1
20150249622 Phillips et al. Sep 2015 A1
20150254330 Chan et al. Sep 2015 A1
20150256413 Du et al. Sep 2015 A1
20150256555 Choi et al. Sep 2015 A1
20150256587 Walker et al. Sep 2015 A1
20150261842 Huang et al. Sep 2015 A1
20150261886 Wu et al. Sep 2015 A1
20150261887 Joukov Sep 2015 A1
20150271008 Jain et al. Sep 2015 A1
20150271255 Mackay et al. Sep 2015 A1
20150278273 Wigington et al. Oct 2015 A1
20150281116 Ko et al. Oct 2015 A1
20150281277 May et al. Oct 2015 A1
20150294212 Fein Oct 2015 A1
20150295945 Canzanese, Jr. et al. Oct 2015 A1
20150304346 Kim Oct 2015 A1
20150312233 Graham, III et al. Oct 2015 A1
20150356297 Yang et al. Oct 2015 A1
20150336016 Chaturvedi Nov 2015 A1
20150341376 Nandy et al. Nov 2015 A1
20150341379 Lefebvre et al. Nov 2015 A1
20150341383 Reddy et al. Nov 2015 A1
20150347554 Vasantham et al. Dec 2015 A1
20150358287 Caputo, II et al. Dec 2015 A1
20150358352 Cjasom et al. Dec 2015 A1
20150379278 Thota et al. Dec 2015 A1
20150381409 Margalit et al. Dec 2015 A1
20160006753 McDaid et al. Jan 2016 A1
20160019030 Shukla et al. Jan 2016 A1
20160020959 Rahaman Jan 2016 A1
20160021131 Heilig Jan 2016 A1
20160026552 Holden et al. Jan 2016 A1
20160028605 Gil et al. Jan 2016 A1
20160030683 Taylor et al. Feb 2016 A1
20160034560 Setayesh et al. Feb 2016 A1
20160036636 Erickson et al. Feb 2016 A1
20160036833 Ardeli et al. Feb 2016 A1
20160036837 Jain et al. Feb 2016 A1
20160036838 Jain et al. Feb 2016 A1
20160050128 Schaible et al. Feb 2016 A1
20160050132 Zhang Feb 2016 A1
20160072638 Amer et al. Mar 2016 A1
20160072815 Rieke et al. Mar 2016 A1
20160080414 Kolton et al. Mar 2016 A1
20160087861 Kuan et al. Mar 2016 A1
20160094394 Sharma et al. Mar 2016 A1
20160094529 Mityagin Mar 2016 A1
20160094994 Kirkby et al. Mar 2016 A1
20160103692 Guntaka et al. Apr 2016 A1
20160105333 Lenglet et al. Apr 2016 A1
20160105350 Greifeneder et al. Apr 2016 A1
20160112269 Singh et al. Apr 2016 A1
20160112270 Danait et al. Apr 2016 A1
20160112284 Pon et al. Apr 2016 A1
20160119234 Valencia Lopez et al. Apr 2016 A1
20160127395 Underwood et al. May 2016 A1
20160147585 Konig et al. May 2016 A1
20160148251 Thomas et al. May 2016 A1
20160150060 Meng et al. May 2016 A1
20160162308 Chen et al. Jun 2016 A1
20160162312 Doherty et al. Jun 2016 A1
20160173446 Nantel Jun 2016 A1
20160173535 Barabash et al. Jun 2016 A1
20160183093 Vaughn et al. Jun 2016 A1
20160191362 Hwang et al. Jun 2016 A1
20160191466 Pernicha Jun 2016 A1
20160191469 Zatko et al. Jun 2016 A1
20160191476 Schutz et al. Jun 2016 A1
20160205002 Rieke et al. Jul 2016 A1
20160216994 Sefidcon et al. Jul 2016 A1
20160217022 Velipasaoglu et al. Jul 2016 A1
20160218933 Porras et al. Jul 2016 A1
20160234083 Ahn et al. Aug 2016 A1
20160248794 Cam Aug 2016 A1
20160255082 Rathod Sep 2016 A1
20160269424 Chandola et al. Sep 2016 A1
20160269442 Shieh Sep 2016 A1
20160269482 Jamjoom et al. Sep 2016 A1
20160277272 Peach et al. Sep 2016 A1
20160277435 Salajegheh et al. Sep 2016 A1
20160283307 Takeshima et al. Sep 2016 A1
20160285730 Ohkawa et al. Sep 2016 A1
20160292065 Thangamani et al. Oct 2016 A1
20160294691 Joshi Oct 2016 A1
20160306550 Liu et al. Oct 2016 A1
20160308908 Kirby et al. Oct 2016 A1
20160321452 Richardson et al. Nov 2016 A1
20160321455 Deng et al. Nov 2016 A1
20160330097 Kim et al. Nov 2016 A1
20160337204 Dubey et al. Nov 2016 A1
20160357424 Pang et al. Dec 2016 A1
20160357546 Chang et al. Dec 2016 A1
20160357587 Yadav et al. Dec 2016 A1
20160357957 Deen et al. Dec 2016 A1
20160359592 Kulshreshtha et al. Dec 2016 A1
20160359628 Singh et al. Dec 2016 A1
20160359658 Yadav et al. Dec 2016 A1
20160359673 Gupta et al. Dec 2016 A1
20160359677 Kulshreshtha et al. Dec 2016 A1
20160359678 Madani et al. Dec 2016 A1
20160359679 Parandehgheibi et al. Dec 2016 A1
20160359680 Parandehgheibi et al. Dec 2016 A1
20160359686 Parandehgheibi et al. Dec 2016 A1
20160359695 Yadav et al. Dec 2016 A1
20160359696 Yadav et al. Dec 2016 A1
20160359697 Scheib et al. Dec 2016 A1
20160359698 Deen et al. Dec 2016 A1
20160359699 Gandham et al. Dec 2016 A1
20160359700 Pang et al. Dec 2016 A1
20160359701 Pang et al. Dec 2016 A1
20160359703 Gandham et al. Dec 2016 A1
20160359704 Gandham et al. Dec 2016 A1
20160359705 Parasdehgheibi et al. Dec 2016 A1
20160359708 Gandham et al. Dec 2016 A1
20160359709 Deen et al. Dec 2016 A1
20160359711 Deen et al. Dec 2016 A1
20160359712 Alizadeh Attar et al. Dec 2016 A1
20160359740 Parasdehgheibi et al. Dec 2016 A1
20160359759 Singh et al. Dec 2016 A1
20160359872 Yadav et al. Dec 2016 A1
20160359877 Kulshreshtha et al. Dec 2016 A1
20160359878 Prasad et al. Dec 2016 A1
20160359879 Deen et al. Dec 2016 A1
20160359880 Pang et al. Dec 2016 A1
20160359881 Yadav et al. Dec 2016 A1
20160359888 Gupta et al. Dec 2016 A1
20160359889 Yadav et al. Dec 2016 A1
20160359890 Deen et al. Dec 2016 A1
20160359891 Pang et al. Dec 2016 A1
20160359897 Yadav et al. Dec 2016 A1
20160359905 Touboul et al. Dec 2016 A1
20160359912 Gupta et al. Dec 2016 A1
20160359913 Gupta et al. Dec 2016 A1
20160359914 Deen et al. Dec 2016 A1
20160359915 Gupta et al. Dec 2016 A1
20160359917 Rao et al. Dec 2016 A1
20160373481 Sultan et al. Dec 2016 A1
20160380865 Dubal et al. Dec 2016 A1
20160380869 Shen et al. Dec 2016 A1
20165035787 Yadav et al. Dec 2016
20170006141 Bhadra Jan 2017 A1
20170024453 Raja et al. Jan 2017 A1
20170032122 Thakar et al. Feb 2017 A1
20170032310 Mimnaugh Feb 2017 A1
20170034018 Parasdehgheibi et al. Feb 2017 A1
20170048121 Hobbs et al. Feb 2017 A1
20170054643 Fraser Feb 2017 A1
20170059353 Madine et al. Mar 2017 A1
20170070582 Desai et al. Mar 2017 A1
20170075710 Prasad et al. Mar 2017 A1
20170085483 Mihaly et al. Mar 2017 A1
20170091204 Minwalla et al. Mar 2017 A1
20170093910 Gukal et al. Mar 2017 A1
20170118244 Bai et al. Apr 2017 A1
20170163502 Macneil et al. Jun 2017 A1
20170187733 Ahn et al. Jun 2017 A1
20170201448 Deval et al. Jul 2017 A1
20170208487 Ratakonda et al. Jul 2017 A1
20170214708 Gukal et al. Jul 2017 A1
20170222909 Sadana et al. Aug 2017 A1
20170223052 Stutz Aug 2017 A1
20170250880 Akens et al. Aug 2017 A1
20170250951 Wang et al. Aug 2017 A1
20170257424 Neogi et al. Sep 2017 A1
20170284839 Ojala Oct 2017 A1
20170289067 Lu et al. Oct 2017 A1
20170295141 Thubert et al. Oct 2017 A1
20170302691 Singh et al. Oct 2017 A1
20170324518 Meng et al. Nov 2017 A1
20170331747 Singh et al. Nov 2017 A1
20170346736 Chander et al. Nov 2017 A1
20170364380 Frye, Jr. et al. Dec 2017 A1
20180005427 Marvie et al. Jan 2018 A1
20180006911 Dickey Jan 2018 A1
20180007115 Nedeltchev et al. Jan 2018 A1
20180013670 Kapadia et al. Jan 2018 A1
20180032905 Abercrombie Feb 2018 A1
20180098123 Larson et al. Apr 2018 A1
20180145906 Yadav et al. May 2018 A1
20180191617 Caulfield et al. Jul 2018 A1
20200225110 Knauss et al. Jul 2020 A1
20200273040 Novick et al. Aug 2020 A1
20200279055 Nambiar et al. Sep 2020 A1
20200396129 Tedaldi et al. Dec 2020 A1
20220141103 Gandham et al. May 2022 A1
Foreign Referenced Citations (46)
Number Date Country
1486555 Mar 2004 CN
101093452 Dec 2007 CN
101465763 Jun 2009 CN
101667935 Mar 2010 CN
101770551 Jul 2010 CN
102142009 Aug 2011 CN
102204170 Sep 2011 CN
102521537 Jun 2012 CN
103023970 Apr 2013 CN
103699664 Apr 2014 CN
103716137 Apr 2014 CN
104065518 Sep 2014 CN
107196807 Sep 2017 CN
0811942 Dec 1997 EP
1039690 Sep 2000 EP
1069741 Jan 2001 EP
1076848 Jul 2002 EP
1383261 Jan 2004 EP
1450511 Aug 2004 EP
2045974 Apr 2008 EP
2043320 Apr 2009 EP
2427022 Mar 2012 EP
2723034 Apr 2014 EP
2860912 Apr 2015 EP
2887595 Jun 2015 EP
3069241 Aug 2018 EP
3793166 Mar 2021 EP
2009016906 Jan 2009 JP
1394338 May 2014 KR
0145370 Jun 2001 WO
2006045793 May 2006 WO
2007014314 Feb 2007 WO
2007042171 Apr 2007 WO
2007070711 Jun 2007 WO
2008069439 Jun 2008 WO
2010048693 May 2010 WO
2010059972 May 2010 WO
2012139288 Oct 2012 WO
2013030830 Mar 2013 WO
2013126759 Aug 2013 WO
2014127008 Aug 2014 WO
2015042171 Mar 2015 WO
2015099778 Jul 2015 WO
2015118454 Aug 2015 WO
2016004075 Jan 2016 WO
2016019523 Feb 2016 WO
Non-Patent Literature Citations (152)
Entry
Thomas Sandholm; MapReduce Optimization Using Regulated Dynamic Prioritization; ACM; 2009; pp. 299-310.
Heckman, Sarah, et al., “On Establishing a Benchmark for Evaluating Static Analysis Alert Prioritization and Classification Techniques,” IEEE 2008, pp. 1-10.
Cisco Systems, Inc., “White Paper—New Cisco Technologies Help Customers Achieve Regulatory Compliance,” 1992-2008.
Cisco Systems, Inc., “A Cisco Guide to Defending Against Distributed Denial of Service Attacks,” May 3, 2016, 34 pages.
Cisco Technology, Inc., “Cisco Lock-and-Key: Dynamic Access Lists,” http://www/cisco.com/c/en/us/support/docs/security-vpn/lock-key/7604-13.html; Updated Jul. 12, 2006, 16 pages.
Di Lorenzo, Guisy, et al., “EXSED: An Intelligent Tool for Exploration of Social Events Dynamics from Augmented Trajectories,” Mobile Data Management (MDM), pp. 323-330, Jun. 3-6, 2013.
Feinstein, Laura, et al., “Statistical Approaches to DDoS Attack Detection and Response,” Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX'03), Apr. 2003, 12 pages.
George, Ashley, et al., “NetPal: A Dynamic Network Administration Knowledge Base,” 2008, pp. 1-14.
Goldsteen, Abigail, et al., “A Tool for Monitoring and Maintaining System Trustworthiness at Run Time,” REFSQ (2015), pp. 142-147.
Hamadi, S., et al., “Fast Path Acceleration for Open vSwitch in Overlay Networks,” Global Information Infrastructure and Networking Symposium (GIIS), Montreal, QC, pp. 1-5, Sep. 15-19, 2014.
Hewlett-Packard, “Effective use of reputation intelligence in a security operations center,” Jul. 2013, 6 pages.
Hideshima, Yusuke, et al., “STARMINE: A Visualization System for Cyber Attacks,” https://www.researchgate,net/publication/221536306, Feb. 2006, 9 pages.
InternetPerils, Inc., “Control Your Internet Business Risk,” 2003-2015, https://www.internetperils.com.
Janoff, Christian, et al., “Cisco Compliance Solution for HIPAA Security Rule Design and Implementation Guide,” Cisco Systems, Inc., Updated Nov. 14, 2015, part 1 of 2, 350 pages.
Janoff, Christian, et al., “Cisco Compliance Solution for HIPAA Security Rule Design and Implementation Guide,” Cisco Systems, Inc., Updated Nov. 14, 2015, part 2 of 2, 588 pages.
Kerrison, Adam, et al., “Four Steps to Faster, Better Application Dependency Mapping—Laying the Foundation for Effective Business Service Models,” BMCSoftware, 2011.
Kraemer, Brian, “Get to know your data center with CMDB,” TechTarget, April 5, 2006, http://searchdatacenter.techtarget.com/news/118820/Get-to-know-your-data-center-with-CMDB.
Lab SKU, “VMare Hands-on Labs—HOL_SDC-1301” Version: 20140321-160709, 2013; http://docs.hol.vmware.com/HOL-2013/holsdc-1301_html_en/ (part 1 of 2).
Lab SKU, “VMare Hands-on Labs—HOL_SDC-1301” Version: 20140321-160709, 2013; http://docs.hol.vmware.com/HOL-2013/holsdc-1301_html_en/ (part 2 of 2).
Lachance, Michael, “Dirty Little Secrets of Application Dependency Mapping,” Dec. 26, 2007.
Landman, Yoav, et al., “Dependency Analyzer,” Feb. 14, 2008, http://jfrog.com/confluence/display/DA/Home.
Lee, Sihyung, Reducing Complexity of Large-Scale Network Configuration Management,: Ph.D. Dissertation, Carniege Mellon University, 2010.
Li, Ang, et al., “Fast Anomaly Detection for Large Data Centers,” Global Telecommunications Conference (GLOBECOM 2010) Dec. 2010, 6 pages.
Li, Bingbong, et al., “A Supervised Machine Learning Approach to Classify Host Roles On Line Using sFlow,” in Proceedings of the first edition workshop on high performance and programmable networking, 2013, ACM, New York, NY, USA, pp. 53-60.
Liu, Ting, et al., “Impala: A Middleware System for Managing Autonomic, Parallel Sensor Systems,” In Proceedings of the Ninth ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming (PPoPP'03), ACM, New York, NY, USA, Jun. 11-13, 2003, pp. 107-118.
Lu, Zhonghai, et al., “Cluster-based Simulated Annealing for Mapping cores onto 2D Mesh Networks on Chip,” Design and Diagnostics of Electronic Circuits and Systems, pp. 1, 6, Apr. 16-18, 2008.
Matteson, Ryan, “Depmap: Dependency Mapping of Applications Using Operating System Events: a Thesis,” Master's Thesis, California Polytechnic State University, Dec. 2010.
Natarajan, Arun, et al., “NSDMiner: Automated Discovery of Network Service Dependencies,” Institute of Electrical and Electronics Engineers INFOCOM, Feb. 2012, 9 pages.
Navaz, A.S. Syed, et al., “Entropy based Anomaly Detection System to Prevent DDoS Attacks in Cloud,” International Journal of Computer Applications (0975-8887), vol. 62, No. 15, Jan. 2013, pp. 42-47.
Neverfail, “Neverfail IT Continuity Architect,” 2015, https://web.archive.org/web/2015090809456/http://www.neverfailgroup.com/products/it-continuity-architect.
Nilsson, Dennis K., et al., “Key Management and Secure Software Updates in Wireless Process Control Environments,” In Proceedings of the First ACM Conference on Wireless Network Security (WiSec'08), ACM, New York, NY, USA, Mar. 31-Apr. 2, 2008, pp. 100-108.
Nunnally, Troy, et al., “P3D: A Parallel 3D Coordinate Visualization for Advanced Network Scans,” IEEE 2013, Jun. 9-13, 2013, 6 pages.
O'donnell, Glenn, et al., “The CMDB Imperative: How to Realize the Dream and Avoid the Nightmares,” Prentice hall, Feb. 19, 2009.
Ohta, Kohei, et al.,“Detection, Defense, and Tracking of Internet—Wide Illegal Access in a Distributed Manner,” 2000, pp. 1-16.
Pathway Systems International Inc., “What is Blueprints?” 2010-2016, http://pathwaysystems.com/blueprints-about/.
Pathway Systems International Inc., “How Blueprints does Integration,” Apr. 15, 2014, 9 pages, http://pathwaysystems.com/company-biog/.
Popa. Lucian, et al., “Macroscope: End-Point Approac to Networked Application Dependency discovery,” coNEXT'09, Dec. 1-4, 2009, Rome, Italy, 12 pages.
Prasad, K. Munivara, et al., “An Efficient Detection of Flooding Attacks to Internet Threat Monitors (ITM) using Entropy Variations under Low Traffic,” Computing Communication & Networking Technologies (ICCCNT'12), Jul. 26-28, 2012, 11 pages.
Sachan, Mrinmaya, et al., “Solving Electrical Networks to Incorporate Supervision in Random Walks,” May 13-17, 2013, pp. 109-110.
Sammarco, Matteo, et al., “Trace Selection for Improved WLAN Monitoring,” Aug. 16, 2013, pp. 9-14.
Shneiderman, Ben, et al., “Network Visualization by Semantic Substrates,” Visualization and Computer Graphics, vol. 12, No. 5, pp. 733-740, Sep.-Oct. 2006.
Wang, Ru, et al., “Learning directed acyclic graphs via bootstarp aggregating,” 2014, 47 pages, http://arxiv,org/abs/1406.2098.
Wang, Yongjun, et al., “A Network Gene-Baed Framework for Detecting Advance Persistent Threats,” Nov. 2014, 7 pages.
Woodberg, Brad, “Snippet from Juniper SRX Series,” Jun. 17, 2013, 1 page, O'Reilly Media, Inc.
Zhang, Yue, et al., “CANTINA: A Content-Based Approach to Detecting Phishing Web Sites,” May 8-12, 2007, pp. 639-648.
Al-Fuqaha, Ala, et al., “Internet of Things: A Survey on Enabling Technologies, Protocols, and Applications,” IEEE Communication Surveys & Tutorials. vol. 17, No. 4, Nov. 18, 2015, pp. 2347-2376.
Brocade Communications Systems, Inc., “Chapter 5—Configuring Virtual LANS (VLANs),” Jun. 2009, 38 pages.
Cisco Systems, Inc., “Cisco, Nexus 3000 Series NX-OS Release Notes, RElease 5.0(3)U3(1),” Feb. 29, 201, Part No. OL-26631-01, 16 pages.
Cisco Systems, Inc., “Cisco—VPN Client User Guide for Windows,” Release 4.6, Aug. 2004, 148 pages.
Cisco Systems, Inc., “Cisco 4710 Application Control Engine Appliance Hardware Installation Guide,” Nov. 2007, 66 pages.
Cisco Systems, Inc., “Cisco Date Center Network Architecture and Solutions Overview,” Feb. 2006, 19 pages.
Cisco Systems, Inc., “Cisco IOS Configuration Fundamentals Configuration Guide: Using Autoinstall and Setup,” Release 12.2, first published Apr. 2001, last updated Sep. 2003, 32 pages.
Ananthanarayanan R., et al., “Photon: Fault-tolerant and Scalable Joining of Continuous Data Streams,” Proceedings of the ACM SIGMOD International Conference on Management of Data, New York, USA, Jun. 22-27, 2013, pp. 577-588.
Aniszczyk C., “Distributed Systems Tracing with Zipkin,” Twitter Blog, Jun. 7, 2012, 3 Pages, [Retrieved on Jan. 26, 2021] Retrieved from URL: https://blog.twitter.com/engineering/en_us/a/2012/distributed-systems-tracing-with-zipkin.html.
Ayers A., et al., “TraceBack: First Fault Diagnosis by Reconstruction of Distributed Control Flow,” Proceedings of the 2009 ACM SIGPLAN Conference on Programming Language Design and Implementation—PLDI '09, Jun. 12-15, 2005, vol. 40, No. 6, 13 pages.
Baah G.K., et al., “The Probabilistic Program Dependence Graph and Its Application to Fault Diagnosis,” IEEE Transactions on Software Engineering, IEEE Service Center, Los Alamitos, CA, US, Jul./Aug. 2010, vol. 36, No. 4, pp. 528-545, ISSN 0098-5589, XP011299543.
Bosch G., “Virtualization,” Modified on Apr. 2010 by Davison B., 33 Pages.
Brahmi H.I., et al., “Improving Emergency Messages Transmission Delay in Road Monitoring Based WSNs,” 6th Joint IFIP Wireless and Mobile Networking Conference (WMNC), 2013, 8 Pages, [Retrieved on Aug. 31, 2021].
Choi C.H., et al., “CSMonitor: A Visual Client/Server Monitor for CORBA-based Distributed Applications,” Proceedings of 1998 Asia Pacific Software Engineering Conference, Taipei, Taiwan, Los Alamitos, CA, USA, Dec. 2-4, 1998, 8 Pages, DOI:10.1109/APSEC.1998.733738, ISBN 978-0-8186-9183-6, XP010314829.
Cisco Systems, Inc., “CCNA2 v3.1 Module 1 WANs and Routers,” Cisco.com, May 14, 2018, 26 pages.
Cisco Systems, Inc., “CCNA2 v3.1 Module 2 Introduction to Routers,” Cisco.com, Jan. 18, 2018, 23 pages.
Citirx, “AppFlow: Next-Generation Application Performance Monitoring,” Citirx.com, 2011, pp. 1-8.
Diaz J.M., et al., “A Simple Closed-Form Approximation for the Packet Loss Rate of a TCP Connection Over Wireless Links,” IEEE Communications Letters, Sep. 2014, vol. 18, No. 9, 4 Pages.
Extended European Search Report for European Application No. 19215055.5, dated Jan. 17, 2020, 9 Pages.
Extended European Search Report for European Application No. 20165008.2, dated May 25, 2020, 6 pages.
Extended European Search Report for European Application No. 21150804.9, dated May 6, 2021, 8 Pages.
Extended European Search Report for European Application No. 21156151.9, dated May 25, 2021, 8 pages.
Extended European Search Report for European Application No. 21190461.0, dated Mar. 1, 2022, 10 Pages.
Github, “OpenTracing,” 10 pages, Retrieved from URL: https://github.com/opentracing/specification/blob/master/specification.md.
Goins A., et al., “Diving Deep into Kubemetes Networking,” Rancher, Jan. 2019, 42 pages.
Grove D., et al., “Call Graph Construction in Object-Oriented Languages,” ACM Object-oriented Programming, Systems, Languages, and Applications—OOPSLA '97 Conference Proceedings, Oct. 1997, 18 pages.
Henke C., et al., “Evaluation of Header Field Entropy forHash-Based Packet Selection,” based on Search String from Google: “entropy header fields,” Obtained on: Nov. 12, 2019, Passive and Active Network Measurement—PAM, 2008, vol. 4979, pp. 82-91.
Hogg S., “Not your Father's Flow Export Protocol (Part 2), What is AppFlow and how does it Differ From Other Flow Analysis Protocols?,” Core Networking, Mar. 19, 2014, 6 pages.
Ihler A., et al., “Learning to Detect Events With Markov-Modulated Poisson Processes,” ACM Transactions on Knowledge Discovery From Data, Dec. 2007, vol. 1, No. 3, Article 13, pp. 13:1 to 13:23.
International Search Report and Written Opinion for International Application No. PCT/US2016/035348, dated Jul. 27, 2016, 8 pages.
International Search Report and Written Opinion for International Application No. PCT/US2016/035349, dated Jul. 27, 2016, 8 pages.
International Search Report and Written Opinion for International Application No. PCT/US2016/035350, dated Aug. 17, 2016, 13 pages.
International Search Report and Written Opinion for International Application No. PCT/US2016/035351, dated Aug. 10, 2016, 15 pages.
Janoff, Christian, et al., “Cisco Compliance Solution for HIPAA Security Rule Design and Implementation Guide,” Cisco Systems, Inc., Updated Nov. 14, 2015.
Juels A., “RFID Security and Privacy: A Research Survey,” Feb. 2006, IEEE Journal on Selected Areas in Communications, vol. 24, No. 2, pp. 381-394.
Kalyanasundaram B., et al., “Using Mobile Data Collectors to Federate Clusters of Disjoint Sensor Network Segments,” IEEE, International Conference on Communications, Department of Computer Science and Electrical Engineering, University of Maryland Baltimore County, 2013, pp. 1496-1500.
Kubernetes Blog, “Borg: The Predecessor to Kubernetes,” Apr. 23, 2015, 2 pages, Retrieved from URL: https://kubernetes.io/blog/2015/04/borg-predecessor-to-kubernetes/.
Kubernetes IO, “Kubernetes Components,” Aug. 28, 2020, 4 pages, Retrieved from URL: https://kubernetes.io/docs/concepts/overview/components/.
Kubernetes IO, “Nodes,” Jan. 12, 2021, 6 pages, Retrieved from URL: https://kubernetes.io/docs/concepts/architecture/nodes/.
Kubernetes IO, “Pods,” Jan. 12, 2021, 5 pages, Retrieved from URL: https://kubernetes.io.docs/concepts/workloads/pods/pod/.
Kubernetes IO, “What is Kubernetes?,” Oct. 22, 2020, 3 pages, Retrieved from URL: https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/.
Lab Sku: “VMware Hands-on Labs—HOL-SDC-1301,” Lab Overview, 2013, [Version Mar. 21, 2014-Jul. 9, 2016] Retrieved from URL: http://docs.hol.vmware.com/HOL-2013/hol-sdc-1301_html_en/, Uploaded in 2 Parts, 118 Pages.
Merriam-Webster, “Definition of Database,” Merriam-Webster Dictionary, 2018, 4 Pages.
Miller N., et al., “Collecting Network Status Information for Network-Aware Applications,” Proceedings IEEE INFOCOM, 2000, vol. 2, pp. 641-650.
Moe J., et al., “Understanding Distributed Systems Via Execution Trace Data,” Proceedings of the 9th International Workshop on Program Comprehension, Toronto, Canada, May 12-13, 2001, 8 Pages.
Nagarajan R., et al., “Approximation Techniques for Computing Packet Loss in Finite-buffered Voice Multiplexers,” IEEE Journal on Selected Areas in Communications, 1991.
Notification Concerning Transmittal of International Preliminary Report on Patentability for International Application No. PCT/US2016/035348, dated Dec. 14, 2017, 7 pages.
Notification Concerning Transmittal of International Preliminary Report on Patentability for International Application No. PCT/US2016/035349, dated Dec. 14, 2017, 7 pages.
Notification Concerning Transmittal of International Preliminary Report on Patentability for International Application No. PCT/US2016/035350, dated Dec. 14, 2017, 11 pages.
Notification Concerning Transmittal of International Preliminary Report on Patentability for International Application No. PCT/US2016/035351, dated Dec. 14, 2017, 11 pages.
Opentracing IO, “The OpenTracing Semantic Specification,” 8 pages, Retrieved from URL: https://opentracing.io/docs/.
Sardella A., “Securing Service Provider Networks: Protecting Infrastructure and Managing Customer Security,” Juniper Networks, Inc., White Paper, Dec. 2006, pp. 1-19.
Senel F., et al., “Optimized Interconnection of Disjoint Wireless Sensor Network Segments Using K Mobile Data Collectors,” IEEE International Conference on Communications (ICC), 2012.
Sherri S., et al., “A Chipset Level Network Backdoor: Bypassing Host-Based Firewall & IDS,” ACM 2009, pp. 125-134.
Sigelman B.H., et al., “Dapper, A Large-Scale Distributed Systems Tracing Infrastracture,” Google Technical Report dapper-2010-1, Apr. 2010, 14 Pages, Retrieved from the Internet: URL: https://research.google/pubs/pub36356/.
Templeton S.J., et al., “Detecting Spoofed Packets,” IEEE, Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX'03), 2003, pp. 1-12.
Zhang D., et al., “Packet Loss Measurement and Control for VPN based Services,” Proceedings of IEEE Instrumentation and Measurement Technology Conference, May 17-19, 2005, vol. 3, 5 Pages.
Cisco Technology, Inc., “Cisco IOS Software Release 12.4T Features and Hardware Support,” Feb. 2009, 174 pages.
Costa, Raul, et al., “An Intelligent Alarm Management System for Large-Scale Telecommunication Companies,” In Portuguese Conference on Artificial Intelligence, Oct. 2009, 14 pages.
De Carvalho, Tiago Filipe Rodrigues, “Root Cause Analysis in Large and Complex Networks,” Dec. 2008, Repositorio.ul.pt, pp. 1-55.
Foundation for Intelligent Physical Agents, “FIPA Agent Message Transport Service Specification,” Dec. 3, 2002, http://www.fipa.org; 15 pages.
Gia, Tuan Nguyen, et al., “Fog Computing in Healthcare Internet of Things: A Case Study on ECG Feature Extraction,” 2015 IEEE International Conference on Computer and Information Technology; Ubiquitous Computing and Communications; Dependable, Autonomic and Secure Computing; Pervasive Intelligence and Computing, Oct. 26, 2015, pp. 356-363.
Joseph, Dilip, et al., “Modeling Middleoxes,” IEEE Network, Sep./Oct. 2008, pp. 20-25.
Kent, S., et al., “Security Architecture for the Internet Protocol,” Network Working Group, Nov. 1998, 67 pages.
Online Collins English Dictionary, 1 page (Year: 2018).
Voris, Jonathan, et al., “Bait and Snitch: Defending Computer Systems with Decoys,” Columbia University ibraries, Department of Computer Science, 2013, pp. 1-25.
Bauch, Petr, “Reader's Report of Mater's Thesis, Analysis and Testing of Distributed NoSQL Datastore Riak,” May 28, 2015, Brno. 2 pages.
Kim, Myung-Sup, et al., “A Flow-based Method for Abnormal Network Traffic Detection,” IEEE, 2004, pp. 599-612.
Thomas, R., “Bogon Dotted Decimal List,” Version 7.0, Team Cymru NOC, Apr. 27, 2012, 5 pages.
Bosch, Greg, “Virtualization,” 2010, 33 pages.
Breen, Christopher, “MAC 911, How to dismiss Mac App Store Notifications,” Macworld.com, Mar. 24, 2014, 3 pages.
Zatrochova, Zuzana, “Analysis and Testing of Distributed NoSQL Datastore Riak,” Spring, 2015, 76 pages.
Witze, Alexandra, “Special relativity aces time trial, ‘Time dilation’ predicted by Einstein confirmed by lithium ion experiment,” Nature, Sep. 19, 2014, 3 pages.
Chou, C.W., et al., “Optical Clocks and Relativity,” Science vol. 329, Sep. 24, 2010, pp. 1630-1633.
Huang, Hing-Jie, et al., “Clock Skew Based Node Identification in Wireless Sensor Networks,” IEEE, 2008, 5 pages.
Ives, Herbert, E., et al., “An Experimental Study of the Rate of a Moving Atomic Clock,” Journal of the Optical Society of America, vol. 28, No. 7, Jul. 1938, pp. 215-226.
Australian Government Department of Defence, Intelligence and Security, “Top 4 Strategies to Mitigate Targeted Cyber Intrusions,” Cyber Security Operations Centre Jul. 2013, http://www.asd.gov.au/infosec/top-mitigations/top-4-strategies-explained.htm.
Author Unknown, “Blacklists & Dynamic Reputation: Understanding Why the Evolving Threat Eludes Blacklists,” www.dambla.com, Dambala, Atlanta, GA, USA, 9 pages.
Aydin, Galip, et al., “Architecture and Implementation of a Scalable Sensor Data Storage and Analysis Using Cloud Computing and Big Data Technologies,” Journal of Sensors, vol. 2015, Article ID 834217, Feb. 2015, 11 pages.
Backes, Michael, et al., “Data Lineage in Malicious Environments,” IEEE 2015, pp. 1-13.
Arista Networks, Inc., “Application Visibility and Network Telemtry using Splunk,” Arista White Paper, Nov. 2013, 11 pages.
Bayatii, Mohsen, et al., “Message-Passing Algorithms for Sparse Network Alignment,” Mar. 2013, 31 pages.
Berezinski, Prezemyslaw, et al., “An Entropy-Based Network Anomaly Detection Method,” Entropy, 2015, vol. 17, www.mdpi.com/journal/entropy, pp. 2367-2408.
Berthier, Robin, et al., “Nfsight: Netflow-based Network Awareness Tool,” 2010, 16 pages.
Bhuyan, Dhiraj, “Fighting Bots and Botnets,” 2006, pp. 23-28.
Blair, Dana, et al., U.S. Appl. No. 62/106,006, filed Jan. 21, 2015, entitled, “Monitoring Network Policy Compliance.”
Chandran, Midhun, et al., “Monitoring in a Virtualized Environment,” GSTF International Journal on Computing, vol. 1, No. 1, Aug. 2010.
Chari, Suresh, et al., “Ensuring continuous compliance through reconciling policy with usage,” Proceedings of the 18th ACM symposium on Access control models and technologies (SACMAT'13), Jun. 2013, ACM, New York, NY, USA, pp. 49-60.
Chen, Xu, et al., “Automating network application dependency discovery: experiences, limitations, and new solutions,” 8th USENIX conference on Operating systems design and implementation (OSDI'08), 2008, USENIX Association, Berkeley, CA, USA, pp. 117-130.
Cisco Systems, “Cisco Network Analysis Modules (NAM) Tutorial,” Cisco Systems, Inc., 2006, Version 3.5.
Cisco Systems, Inc., “Addressing Compliance from One Infrastructure: Cisco Unified Compliance Solution Framework,” 2014.
Cisco Systems, Inc., “Cisco Application Dependency Mapping Service,” 2009.
Baek, Kwang-Hyun, et al., “Preventing Theft of Quality of Service on Open Platforms,” 2005 Workshop of the 1st International Conference on Security and Privacy for Emerging Areas in Communication Networks, 2005, 12 pages.
Cisco Systems, Inc, “Cisco Data Center Network Architecture and Solutions Overview,” Feb. 2006, 19 pages.
Cisco Systems, Inc, “Cisco Application Visibility and Control,” Oct. 2011, 2 pages.
Cisco Systems, Inc, “Cisco Tetration Platform Data Sheet,” Updated Mar. 5, 2018, 21 pages.
Duan, Yiheng, et al., Detective: Automatically Identify and Analyze Malware Processes in Forensic Scenarios via DLLs, IEEE ICC 2015—Next Generation Networking Symposium, pp. 5691-5696.
Theodorakopoulos, George, et al., “On Trust Models and Trust Evaluation Metrics for Ad Hoc Networks,” EEE Journal on Selected Areas in Communications. vol. 24, Issue 2, Feb. 2006, pp. 318-328.
Zeng, Sai, et al., “Managing Risk in Multi-node Automation of Endpoint Management,” 2014 IEEE Network Operations and Management Symposium (NOMS), 2014, 6 pages.
Cisco Systems, Inc., “Cisco VN-Link: Virtualization-Aware Networking,” White Paper, Mar. 2009, 10 pages.
Cisco Systems, Inc., “Cisco, Nexus 5000 Series and Cisco Nexus 2000 Series Release Notes, Cisco NX-OS Release 5.1(3)N2(1b), NX-OS Release 5.1(3)N2(1a) and NX-OS Release 5.1(3)N2(1),” Sep. 5, 2012, Part No. OL-26652-03 CO, 24 pages.
Cisco Systems, Inc., “Nexus 3000 Series NX-OS Fundamentals Configuration Guide, Release 5.0(3)U3(1): Using PowerOn Auto Provisioning,” Feb. 29, 2012, Part No. OL-26544-01, 10 pages.
Cisco Systems, Inc., “Quick Start Guide, Cisco ACE 4700 Series Application Control Engine Appliance,” Software Ve740rsion A5(1.0), Sep. 2011, 138 pages.
Cisco Systems, Inc., “Routing and Bridging Guide, Cisco ACE Application Control Engine,” Software Version A5(1.0), Sep. 2011, 248 pages.
Cisco Systems, Inc., “VMWare and Cisco Virtualization Solution: Scale Virtual Machine Networking,” Jul. 2009, 4 pages.
Cisco Systems, Inc., “Cisco Remote Integrated Service Engine for Citrix NetScaler appliances and Cisco Nexus 7000 Series Switches Configuration Guide,” Last modified Apr. 29, 1974, 78 pages.
Cisco Systems, Inc., “Cisco Application Control Engine (ACE) Troubleshooting Guide—Understanding the ACE Module Architecture and Traffic Flow,” Mar. 11, 2011, 6 pages.
Related Publications (1)
Number Date Country
20230014842 A1 Jan 2023 US
Provisional Applications (1)
Number Date Country
62171899 Jun 2015 US
Continuations (2)
Number Date Country
Parent 16867791 May 2020 US
Child 17935771 US
Parent 15173477 Jun 2016 US
Child 16867791 US