Abstract: In one embodiment, a monitoring device (or module) monitors messages exchanged between nodes in a communication network. The monitoring device further determines, based on time stamp data associated with each message, one or more latency distributions of paired response times between the nodes, and determines a node topology consistent with each of the one or more latency distributions of paired response times between the nodes. In some embodiments, the monitoring device also generates a graph of the node topology showing one or more communication links between the nodes, and annotates each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the latency distributions.

Abstract: An example method can include monitoring a network to identify flows between nodes in the network. Once flows have been identified, the flows can be tagged and labelled according to the type of traffic they represent. If a flow represents malicious or otherwise undesirable traffic, it can be tagged accordingly. A request can then be made for a reputation score of an entity which can identify one or more nodes of the network.

Abstract: Systems, methods, and computer-readable media for providing interoperability between nodes in separate networks as part of a federated network. In some embodiments, a system can identify a first cluster of nodes in a first network and a second cluster of nodes in a second network. The system can provide interoperability between the first cluster of nodes and the second cluster of nodes. First analytics for the first cluster of nodes can be generated using first network traffic data gathered based on first network traffic flowing through the first cluster of nodes by a group of sensors implemented in the first network. The second cluster of nodes can access the first analytics for the first cluster of nodes as part of providing the interoperability between the first cluster of nodes in the first network and the second cluster of nodes in the second network.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: Systems, methods, and computer-readable media for annotating process and user information for network flows. In some embodiments, a capturing agent, executing on a first device in a network, can monitor a network flow associated with the first device. The first device can be, for example, a virtual machine, a hypervisor, a server, or a network device. Next, the capturing agent can generate a control flow based on the network flow. The control flow may include metadata that describes the network flow. The capturing agent can then determine which process executing on the first device is associated with the network flow and label the control flow with this information. Finally, the capturing agent can transmit the labeled control flow to a second device, such as a collector, in the network.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: Systems, methods, and computer-readable media for detecting sensor deployment characteristics in a network. In some embodiments, a system can run a capturing agent deployed on a virtualization environment of the system. The capturing agent can query the virtualization environment for one or more environment parameters, and receive a response from the virtualized environment including the one or more environment parameters. Based on the one or more environment parameters, the capturing agent can determine whether the virtualization environment where the capturing agent is deployed is a hypervisor or a virtual machine. The capturing agent can also determine what type of software switch is running in the virtualized environment.

Abstract: Systems, methods, and computer-readable media are provided for automatically downloading and launching a new version of software package on components in a network environment. In some examples, an upgrade server of a network environment keeps a copy of all versions of software packages running on nodes or sensors of the network environment, identifications of corresponding nodes or sensors, and public keys associated with the software packages. The upgrade server can authenticate a new version of a software package using a two-step process.

Abstract: The technology visualizes data flows within a datacenter in an interactive hierarchical network chord diagram. Based on analyzed data describing data flows, a portion of the data flows that originate at the same first endpoint and terminate at the same second endpoint can be grouped. Subsequently, the dataflow monitoring system displays an interactive hierarchical network chord diagram to include a chord with a first endpoint and a second endpoint. The chord represents the grouped portion of data flows that originate at the same first endpoint and terminate at the same second endpoint. Upon receiving a selection of the chord or the first endpoint of the chord, the dataflow monitoring system expands the grouped portion of the data flows into a more granular representation of the network.

Abstract: In one embodiment, a monitoring device (or module) monitors messages exchanged between nodes in a communication network. The monitoring device further determines, based on time stamp data associated with each message, one or more latency distributions of paired response times between the nodes, and determines a node topology consistent with each of the one or more latency distributions of paired response times between the nodes. In some embodiments, the monitoring device also generates a graph of the node topology showing one or more communication links between the nodes, and annotates each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the latency distributions.

Abstract: A method provides for associating reputation scores with policies, stacks and hosts within a network and upon receiving information about a newly provisioned entity (such as a host or a stack), recommending a policy scheme for the newly provisioned entity that will result in a particular reputation score of the reputation scores. The method further includes implementing the policy scheme for the newly provisioned entity.

Abstract: In one embodiment, a monitoring device (or module) monitors messages exchanged between nodes in a communication network. The monitoring device further determines, based on time stamp data associated with each message, one or more latency distributions of paired response times between the nodes, and determines a node topology consistent with each of the one or more latency distributions of paired response times between the nodes. In some embodiments, the monitoring device also generates a graph of the node topology showing one or more communication links between the nodes, and annotates each communication link of the one or more communication links with at least one of a mean response time or a median response time based on at least one of the latency distributions.

Abstract: The technology visualizes data flows within a datacenter in an interactive hierarchical network chord diagram. Based on analyzed data describing data flows, a portion of the data flows that originate at the same first endpoint and terminate at the same second endpoint can be grouped. Subsequently, the dataflow monitoring system displays an interactive hierarchical network chord diagram to include a chord with a first endpoint and a second endpoint. The chord represents the grouped portion of data flows that originate at the same first endpoint and terminate at the same second endpoint. Upon receiving a selection of the chord or the first endpoint of the chord, the dataflow monitoring system expands the grouped portion of the data flows into a more granular representation of the network.

Abstract: A method provides for associating reputation scores with policies, stacks and hosts within a network and upon receiving information about a newly provisioned entity (such as a host or a stack), recommending a policy scheme for the newly provisioned entity that will result in a particular reputation score of the reputation scores. The method further includes implementing the policy scheme for the newly provisioned entity.

Abstract: An example method can include monitoring a network to identify flows between nodes in the network. Once flows have been identified, the flows can be tagged and labelled according to the type of traffic they represent. If a flow represents malicious or otherwise undesirable traffic, it can be tagged accordingly. A request can then be made for a reputation score of an entity which can identify one or more nodes of the network.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Abstract: Systems, methods, and computer-readable media are provided for automatically downloading and launching a new version of software package on components in a network environment. In some examples, an upgrade server of a network environment keeps a copy of all versions of software packages running on nodes or sensors of the network environment, identifications of corresponding nodes or sensors, and public keys associated with the software packages. The upgrade server can authenticate a new version of a software package using a two-step process.

Abstract: A monitoring device/module monitors a plurality of nodes in a data center network, and determines one or more latency distributions of response times for messages exchanged between pairs of nodes of the plurality of nodes. The network monitoring device determines a network topology, including one or more communication links interconnecting nodes of the plurality of nodes, consistent with the one or more latency distributions. The network monitoring device also determines a representative response time for each communication link based on the one or more latency distributions, and compares a current response time a message exchanged between one pair of nodes to the representative response time for the communication link interconnecting the one pair of nodes. The network monitoring device identifies a network anomaly when the current response time deviates from the representative response time for the communication link interconnecting the one pair of nodes by a threshold amount.

Abstract: Systems, methods, and computer-readable media are provided for de-duplicating sensed data packets in a network. As data packets of a particular network flow move through the network, the data packets can be sensed and reported by various sensors across the network. An optimal sensor of the network can be determined based upon data packets reported by the various sensors. Data packets sensed and reported by the optimal sensor can be preserved for network analysis. Duplicative data packets of the particular network flow sensed and reported by other sensors of the network can be discarded to save storage capacity and processing power of network-flow analysis tools. Analysis of the particular network flow can be performed based upon the data packets sensed by the optimal sensor and non-duplicative data packets of the particular network-flow sensed by other sensors of the network.

Abstract: An approach for detecting anomalous flows in a network using header field entropy. This can be useful in detecting anomalous or malicious traffic that may attempt to “hide” or inject itself into legitimate flows. A malicious endpoint might attempt to send a control message in underutilized header fields or might try to inject illegitimate data into a legitimate flow. These illegitimate flows will likely demonstrate header field entropy that is higher than legitimate flows. Detecting anomalous flows using header field entropy can help detect malicious endpoints.