Granted Patent B2

US 12,192,078 · App. 18/593,403 · Granted Jan 7, 2025

Inventors: Sunil Kumar Gupta (Milpitas, CA); Navindra Yadav (Cupertino, CA); Michael Standish Watts (Mill Valley, CA); Ali Parandehgheibi (Sunnyvale, CA); Shashidhar Gandham (Fremont, CA); Ashutosh Kulshreshtha (Cupertino, CA); Khawar Deen (Sunnyvale, CA)

Assignee: Cisco Technology, Inc.

H04L43/045G06F3/0482G06F3/04842G06F3/04847G06F9/45558G06F16/122G06F16/137G06F16/162G06F16/17G06F16/173G06F16/174G06F16/1744G06F16/1748G06F16/2322G06F16/235G06F16/2365G06F16/24578G06F16/248G06F16/285G06F16/288G06F16/29G06F16/9535G06F21/53G06F21/552G06F21/556G06F21/566G06N20/00G06N99/00G06T11/206H04J3/0661H04J3/14H04L1/242H04L7/10H04L9/0866H04L9/3239H04L9/3242H04L41/046H04L41/0668H04L41/0803H04L41/0806H04L41/0816H04L41/0893H04L41/12H04L41/16H04L41/22H04L43/02H04L43/026H04L43/04H04L43/062H04L43/08H04L43/0805H04L43/0811H04L43/0829H04L43/0841H04L43/0858H04L43/0864H04L43/0876H04L43/0882H04L43/0888H04L43/10H04L43/106H04L43/12H04L43/16H04L45/306H04L45/38H04L45/46H04L45/507H04L45/66H04L45/74H04L47/11H04L47/20H04L47/2441H04L47/2483H04L47/28H04L47/31H04L47/32H04L61/5007H04L63/0227H04L63/0263H04L63/06H04L63/0876H04L63/1408H04L63/1416H04L63/1425H04L63/1433H04L63/1441H04L63/145H04L63/1458H04L63/1466H04L63/16H04L63/20H04L67/01H04L67/10H04L67/1001H04L67/12H04L67/51H04L67/75H04L69/16H04L69/22H04W72/54H04W84/18G06F2009/4557G06F2009/45587G06F2009/45591G06F2009/45595G06F2221/033G06F2221/2101G06F2221/2105G06F2221/2111G06F2221/2115G06F2221/2145H04L67/535

Abstract

Claims (32)

1. A method comprising:

receiving network traffic from a first host in a network;

extracting connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;

assessing the connection data using a machine learning process to determine a reputation score for the first host;

utilizing the reputation score to assign the first host to a group having a group policy; and

restricting traffic from the second host to the first host according to the group policy.

2. The method of claim 1 , wherein the second host comprises a firewall.

3. The method of claim 2 , wherein the first host comprises a device located outside the firewall.

4. The method of claim 1 , wherein the machine learning process utilizes data from one or more malware trackers.

5. The method of claim 1 , wherein the machine learning process utilizes data obtained from a whois database.

6. A system comprising:

one or more processors; and

a computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the one or more processors to:

receive network traffic from a first host in a network;

extract connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;

assess the connection data using a machine learning process to determine a reputation score for the first host;

utilize the reputation score to assign the first host to a group having a group policy; and

restrict traffic from the second host to the first host according to the group policy.

7. The system of claim 6 , wherein the second host is a firewall.

8. The system of claim 7 , wherein the first host is a device located outside of the firewall.

9. The system of claim 7 , wherein the machine learning process utilizes data from one or more malware trackers.

10. The system of claim 7 , wherein the machine learning process utilizes data obtained from a whois database.

11. A non-transitory computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:

receive network traffic from a first host in a network;

extract connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;

assess the connection data using a machine learning process to determine a reputation score for the first host;

utilize the reputation score to assign the first host to a group having a group policy; and

restrict traffic from the second host to the first host according to the group policy.

12. The non-transitory computer-readable medium of claim 11 , wherein the second host is a firewall.

13. The non-transitory computer-readable medium of claim 12 , wherein the first host is a device located outside of the firewall.

14. The non-transitory computer-readable medium of claim 11 , wherein the machine learning process utilizes data from one or more malware trackers.

15. The non-transitory computer-readable medium of claim 11 , wherein the machine learning process utilizes data obtained from a whois database.

Assignments (1)

Continuity (5)

References Cited (400)