Iterative development of protocol parsers

    公开(公告)号:US11777832B2

    公开(公告)日:2023-10-03

    申请号:US17557769

    申请日:2021-12-21

    CPC classification number: H04L43/18 H04L43/04

    Abstract: Systems, methods, and related technologies for determining fields of an unknown protocol are described. One or more packets may be removed from a network traffic capture in response to the one or more packets having a known protocol. The remaining network traffic capture may be grouped into one or more clusters of packets based on similarity. Each of the one or more clusters may be parsed to identify one or more fields of an unknown protocol. The network traffic capture may be modified, including annotating the one or more fields of the unknown protocol.

    INCREASING DATA AVAILABILITY
    13.
    发明公开

    公开(公告)号:US20230275818A1

    公开(公告)日:2023-08-31

    申请号:US18310617

    申请日:2023-05-02

    Abstract: Systems, methods, and related technologies for increasing data availability. The determining of one or more recommendations to improve classification may include accessing network traffic from a network and selecting an entity. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. The entity may be classified and in response to the classification meeting a condition, one or more properties that are unavailable in the network traffic may be determined. A data source associated with the one or more properties for which a value is not present in the network traffic may be determined and the data source associated with the one or more properties that are unavailable in the network traffic may be stored.

    ADAPTIVE SCANNING
    14.
    发明公开
    ADAPTIVE SCANNING 审中-公开

    公开(公告)号:US20230156471A1

    公开(公告)日:2023-05-18

    申请号:US18158247

    申请日:2023-01-23

    Abstract: Adaptive scanning is described. The adaptive scanning may include performing a passive scan of communications associated with a device, where the passive scan comprises observing one or more communications of the device over a network. One or more attributes associated with the device based on the passive scan are determined and an active scan of the device is performed based on the one or more attributes based on the passive scan. The active scan is customized for the device based on the one or more attributes determined based on the passive scan and the active scan comprises sending one or more requests to the device. One or more attributes associated with the device may be determined based on the active scan. The one or more attributes based on the passive scan and the one or more results based on the active scan associated with the device are stored.

    COMPLIANCE MONITORING
    15.
    发明申请

    公开(公告)号:US20230114394A1

    公开(公告)日:2023-04-13

    申请号:US18080562

    申请日:2022-12-13

    Abstract: Systems, methods, and related technologies for device compliance monitoring are described. In certain aspects, one or more compliance rules associated with a device classification are used to determine a compliance level of a device. The one or more compliance rules may be based on a standard. An action can be initiated based on the compliance level.

    AGENTLESS NETWORK TRAFFIC MAPPING
    16.
    发明申请

    公开(公告)号:US20230110265A1

    公开(公告)日:2023-04-13

    申请号:US17489272

    申请日:2021-09-29

    Inventor: Eli Fainberg

    Abstract: Systems, methods, and related technologies for generating a network traffic map based on network traffic information and additional data are described. Network traffic information may be obtained from endpoints using an operating system (OS) interface, without an agent beinginstalled on the endpoints. A network traffic map may be generated forthe network based on the network traffic information.

    ENTITY ATTRIBUTE DESIGNATION BASED ON LOGIC PROGRAMMING

    公开(公告)号:US20230099243A1

    公开(公告)日:2023-03-30

    申请号:US17489890

    申请日:2021-09-30

    Abstract: Systems, methods, and related technologies for entity classification and attribute designation are described. Device property data associated with a device coupled to a network is accessed. One or more features for the device are identified based on the device property data. A first value for an attribute of the device is determined based on a set of rules applied to the one or more features of the device. A first belief value for the attribute is determined based on the set of rules applied to the one or more features of the device. A final value for the attribute of the device is selected based at least in part on the first belief value for the first value of the attribute.

    Multiple sourced classification
    19.
    发明授权

    公开(公告)号:US11463469B2

    公开(公告)日:2022-10-04

    申请号:US16834921

    申请日:2020-03-30

    Inventor: Yang Zhang

    Abstract: Systems, methods, and related technologies for improving classification use multiple classification resources. Network traffic from a network may be accessed and an entity may be selected. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. A first classification result of the entity based on accessing one or more local profiles is determined by a processing device. In response to the first classification result meeting a condition, one or more values associated with one or more properties associated with the entity may be sent (e.g., to a cloud based classification resource). A second classification result may be received. The second classification result may be determined based one accessing at least one remote profile. At least one of the first classification result or the second classification result may be stored.

    Segmentation management including translation

    公开(公告)号:US11411822B2

    公开(公告)日:2022-08-09

    申请号:US16144130

    申请日:2018-09-27

    Inventor: Ilya Fainberg

    Abstract: Systems, methods, and related technologies for segmentation management are described. The segmentation management may include visualization, configuration including translation, simulation, or a combination thereof of one or more segmentation policies. In certain aspects, a segmentation policy is accessed and a segmentation rule is determined based on the segmentation policy. An enforcement point associated with the segmentation rule may be determined, where the enforcement point is communicatively coupled to a network. The segmentation rule may be translated into a configuration associated with the enforcement point and the configuration communicated to the enforcement point.

Patent Agency Ranking