Granted Patent B2

US 12,335,275 · App. 18/436,185 · Granted Jun 17, 2025

Inventors: Navindra Yadav (Cupertino, CA); Abhishek Ranjan Singh (Pleasanton, CA); Shashidhar Gandham (Fremont, CA); Ellen Christine Scheib (Mountain View, CA); Omid Madani (San Carlos, CA); Ali Parandehgheibi (Sunnyvale, CA); Jackson Ngoc Ki Pang (Sunnyvale, CA); Vimalkumar Jeyakumar (Los Altos, CA); Michael Standish Watts (Los Altos, CA); Hoang Viet Nguyen (Pleasanton, CA); Khawar Deen (Sunnyvale, CA); Rohit Chandra Prasad (Sunnyvale, CA); Sunil Kumar Gupta (Milpitas, CA); Supreeth Hosur Nagesh Rao (Cupertino, CA); Anubhav Gupta (Fremont, CA); Ashutosh Kulshreshtha (Cupertino, CA); Roberto Fernando Spadaro (Milpitas, CA); Hai Trong Vu (San Jose, CA); Varun Sagar Malhotra (Sunnyvale, CA); Shih-Chun Chang (San Jose, CA); Bharathwaj Sankara Viswanathan (Mountain View, CA); Fnu Rachita Agasthy (Sunnyvale, CA); Duane Thomas Barlow (Fremont, CA)

Assignee: Cisco Technology, Inc.

H04L63/1408H04L43/04H04L43/0894H04L63/02H04L63/1425H04L43/062

Abstract

Claims (34)

1. A system comprising:

one or more processors; and

memory storing instructions which, when executed by the one or more processors, cause the one or more processors to:

obtain network data associated with a data center;

store connection data describing a connection between endpoints in the data center, the connection data based at least in part by comparing one or more packets transmitted in the data center;

determine a status of the data center based on the network data and the connection data;

detect, based at least partly on the status of the data center, an indication of an attack within the data center;

in response to the indication of the attack, modify, by the system, a security policy associated with the data center; and

generating a report of the modification of the security policy.

2. The system of claim 1 , wherein the network data being at least partly based on operation systems running in the data center.

3. The system of claim 2 , wherein the network data comprises a respective indication of active or previously active processes on at least one of the operating systems.

4. The system of claim 2 , wherein at least one of a log or the network data identifies files present on at least one of the operating systems.

5. The system of claim 2 , wherein at least one of the operating systems is a virtual machine or a hypervisor.

6. The system of claim 1 , wherein at least one of a log or the network data comprises data describing packets captured by a sensor process executing in the data center.

7. The system of claim 6 , wherein detecting the indication of the attack comprises at least one of detecting a spike in an amount of resources used by the sensor process or detecting spoofed packets.

8. The system of claim 1 , wherein detecting the indication of the attack comprises detecting a hidden process embedded in traffic between two or more reference points.

9. The system of claim 1 , wherein detecting the indication of the attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.

10. The system of claim 1 , wherein detecting the indication of the attack comprises detecting a packet that has a packet header field that differs from an expected header pattern.

11. A method comprising:

obtaining network data associated with a data center;

storing connection data describing a connection between endpoints in the data center, the connection data based at least in part by comparing one or more packets in the network data;

determining a status of the data center based on the network data and the connection data;

detecting, based at least partly on the status of the data center, an indication of an attack within the data center;

in response to the indication of the attack, modifying, by a system, a security policy associated with the data center; and

generate a report of the modification of the security policy.

12. The method of claim 11 , wherein the network data being at least partly based on operation systems running in the data center.

13. The method of claim 12 , wherein at least one of a log or the network data comprises a respective indication of active or previously active processes on at least one of the operating systems.

14. The method of claim 12 , wherein at least one of a log or the network data identifies files present on at least one of the operating systems.

15. The method of claim 12 , wherein at least one of the operating systems comprises a virtual machine or a hypervisor.

16. The method of claim 11 , wherein at least one of a log or the network data comprises data describing packets captured by a sensor process executing in the data center.

17. The method of claim 16 , wherein detecting the indication of the attack comprises at least one of detecting a spike in an amount of resources used by the sensor process or detecting spoofed packets.

18. The method of claim 11 , wherein detecting the indication of the attack comprises detecting a hidden process embedded in traffic between two or more reference points.

19. The method of claim 11 , wherein detecting the indication of the attack comprises detecting a scan of a network as initiated by a command from outside of the network or from an unexpected source inside the network.

20. The method of claim 11 , wherein detecting the indication of the attack comprises detecting a packet that has a packet header field that differs from an expected header pattern.

Assignments (1)

Continuity (6)

References Cited (400)