101 results about "Network Endpoint" patented technology

Dynamic endpoint management is performed for heterogenous machine learning models. A placement event is detected for a machine learning model associated with a managed network endpoint. The managed network endpoint may provide access to different machine learning models via requests to invoke specified ones of the machine learning models received from clients of the machine learning service. A computing resource is selecting from the associated computing resources based on a determination that the computing resources satisfies a resource requirement for the machine learning model and the machine learning model is placed on the selected computing resource.

The technology disclosed allows for leveraging decentralized credentials to achieve bidirectional authentication between two actors leveraging a messaging platform / system, such as email or another text-based system, verifiable credentials (VCs), and secure web endpoints. It empowers one party (“Sender”) to send a message enclosed with a Verifiable Presentation which allows another party (“Recipient”) to authenticate the message's provenance and the identity of the sender. Moreover, the message contains a link to a secure web endpoint, where the recipient can submit a response signed by their own Verifiable Presentation, allowing the Sender to authenticate the identity of the Recipient. In this way, both participants are able to authenticate each other's identities with an additional factor of authentication, with neither participant being required to share a single service.

Load aware routing is performed for requests to managed network endpoints for heterogeneous machine learning models. A request to generate an inference is received via a managed network endpoint that invokes a specified machine learning model. Workloads of the different hosts for respective replicas of the machine learning model are evaluated to select one of the hosts to perform the request.

Systems, switches, network endpoints, and methods are provided. In one example, a system is described that includes a latency measurement circuit to measure traffic on a network from an endpoint sender to an endpoint receiver across multiple paths. The system also includes a packet marking circuit to provide a routing mark for a packet destined for the endpoint receiver according to a network traffic measurement provided by the latency measurement circuit, where the routing mark provides an indication that supports routing for the packet to reach the endpoint receiver via a chosen path or subset of paths among the multiple paths.

A device, system, and method are provided for generating a network security policy automatically based on network traffic. The network security policy is generated by building a directional graph from the network traffic, with the nodes of the graph representing network end points, and the edges representing communication between two nodes on a communication channel. A feature vector is generated for each of the nodes and a graph neural network is applied to the feature vectors to generate output vectors. The output vectors are clustered using a cost function based on a weighted combination of a distance-based cost function and a network functionality cost function. The clusters generated from the output vectors are used to assign network security rules to each of the clusters.

An embodiment selects, using performance data of a plurality of paths, a first path, each path comprising a data communication path from a first network endpoint through a subset of a plurality of network elements in a data communication network to a second network endpoint. An embodiment adjusts a packet header of a data packet, wherein a parameter setting in the adjusted data packet header causes a first network element in the data communication network to forward the adjusted data packet to a next network element in the data communication network along the first path. An embodiment sends the adjusted data packet, wherein the adjusted data packet causes a first subset of the plurality of network elements in the data communication network to forward the adjusted data packet to the second network endpoint along the first path.

Various embodiments described herein disclose an endpoint modeling and grouping management system that can collect data from endpoint computer devices in a network. In some embodiments, agents installed on the endpoints can collect real-time information at the kernel level providing the system with deep visibility. In some embodiments, the endpoint modeling and grouping management system can identify similarities in behavior in response to assessing the data collected by the agents. In some embodiments, the endpoint modeling and grouping management system can dynamically model groups such as logical groups, and cluster endpoints based on the similarities and / or differences in behavior of the endpoints. In some embodiments, the endpoint modeling and grouping management system transmits the behavioral models to the agents to allow the agents to identify anomalies and / or security threats autonomously.

A system and method for securely exchanging information between a server and an endpoint. A firewall and switch may administer connections between the endpoint and the server. The network interface of the server may send and receive information through the firewall and switch. A program task in the sever may set the network interface to be in an “on state” for a predetermined amount of time on a specific date thereby creating an active time transfer window that the network interface can receive communications from the endpoint.

Examples of the disclosure provide for a scatter network device. In some examples, the scatter network device includes a non-transitory memory, at least one processor, and a key exchange application stored in the non-transitory memory. When executed by the at least one processor, the key exchange application generates a key exchange request encrypted according to a public encryption key of a first network endpoint, wherein the encrypted key exchange request is indistinguishable from uniform random noise, and transmits the key exchange request to the first network endpoint via a first communication band, wherein the scatter network device transmits authenticated messages via a second communication band.

The invention discloses a circuit diagram analysis method for automatically generating an analog circuit netlist, and the method comprises the steps: carrying out the recognition of an input to-be-processed circuit diagram through a target detection model, and outputting the type and position of each component in the circuit diagram; removing components from the circuit diagram to be processed to obtain a circuit diagram without components; a representative template picture of each component is called, the matching degree of the template picture and the identified component area is calculated, and the pin function and the position coordinate of each identified component are determined; identifying connecting line segments in the circuit diagram without components by adopting a connected domain detection method, and judging to obtain a really connected circuit network in the circuit diagram in combination with connecting points; and matching the pin ports of the components with the circuit network endpoints one by one, generating a netlist file of the circuit diagram to be processed, and checking and outputting the netlist file. According to the method, circuit schematic diagrams of different styles can be processed, and the accuracy of circuit netlist conversion is remarkably improved.

A system and method for flow-level deduplication of network traffic are disclosed. A network node receives a first plurality of packets from a first network endpoint. The first plurality of packets represent a flow of data being communicated between the first network endpoint and a second network endpoint. The network node further receives a second plurality of packets from the second network endpoint. The network node identifies a sequence identifier of each packet of the first and second pluralities of packets. The network node determines that the first and second pluralities of packets are all associated with the same flow, based on the sequence identifiers of the first and second pluralities of packets. In response to that determination, the network node deduplicates the flow by discarding the first plurality of packets or the second plurality of packets. The network node may be a traffic visibility node.

The invention discloses an Internet of Things equipment security event threat level assessment method and device, and the method comprises the steps: obtaining security events, equipment types and working condition parameters of target equipment in a target time period, and carrying out the division according to the timestamps of all security events, thereby obtaining a plurality of time window association groups; taking the security events connected with the same network endpoint as the same threat source event, and generating a plurality of threat source event sets; calculating a threat score of each security event to obtain a comprehensive threat score table; generating a comprehensive situation score table in combination with the security event timestamps, the equipment types and the working condition parameters; calling a preset threat event rule base to perform rule matching, and generating a rule matching result table; and finally, according to the time window association table, the comprehensive threat score table, the comprehensive situation score table and the rule matching result table, determining the threat level of each security event. By comprehensively considering the associated information of the security event in multiple dimensions, a more accurate threat level evaluation result is obtained.

Systems and methods for dynamically binding network endpoints via key distribution are described. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include: a processor; and a memory coupled to the processor, where the memory includes program instructions that cause the IHS to: obtain a network binding map indicating a flat or hierarchical structure of a plurality of endpoints of a network; obtain a respective plurality of cryptographic keys for the plurality of endpoints; and distribute one or more keys of the plurality of cryptographic keys to individual endpoints based, at least in part, on the network binding map. In some embodiments, the program instructions further cause the IHS to: distribute, to individual endpoints, only the one or more keys associated with one or more other endpoints, of plurality of endpoints, to which the respective individual endpoint is bound, according to the network binding map.

Some embodiments provide a method for configuring a network to bridge data messages between a logical overlay network layer 2 (L2) segment and a physical L2 segment. The method identifies each host computer in the network on which at least one logical network endpoint connected to the logical overlay network L2 segment executes. For each identified host computer, the method configures a forwarding element executing on the identified host computer to bridge (i) data messages sent from the logical network endpoints executing on the identified host computer to network endpoints connected to the physical L2 segment and (ii) data messages sent from network endpoints connected to the physical L2 segment, executing on the identified host computer and on other host computers in the network, to the logical network endpoints executing on the identified host computer.

Disclosed are various approaches for large language model (LLM) supply chain security. In one example, an LLM-extended software bill of materials can be extended to provide LLM specific supply chain information for an LLM application that communicates with an LLM service. The LLM-extended software bill of materials can be attached to the LLM application. An LLM specific security test can be performed on the LLM application. A signed LLM security test attestation can be attached to the LLM-extended software bill of materials based on completion of the automated LLM security test. The LLM application or the LLM-extended software bill of materials can be published or transmitted to a predetermined network endpoint.

Some embodiments provide a method for configuring a network to bridge data messages between a hardware-implemented L2 overlay network segment and a software-implemented L2 overlay network segment. The method identifies a host computer on which a logical network endpoint connected to the software-implemented overlay executes. The hardware-implemented L2 overlay connects at least a first set of network endpoints located in a first physical network zone and connected to a first L2 network segment and a second set of network endpoints located in a second physical network zone and connected to a second L2 network segment. The identified host computer is located in the first physical network zone. The method configures a forwarding element executing on the host computer to bridge data messages between the logical network endpoint and (i) the first set of network endpoints and (ii) the second set of network endpoints.

The system includes one or more virtual machines deployed on a network and connected to a server via one or more networks. Each virtual machine obtains and analyzes network traffic and constructs a local network map of devices based on the analysis. Information corresponding to the local network map of devices is provided to the server and the network server aggregates one or more local network maps of devices into a global network map of devices. The global network map of devices is constructed into 2D and 3D graphical user interfaces by the server. The characteristics of user devices that request the global network map of devices from the server are obtained by the server and analyzed and in response to the request, the server provides an appropriate 2D or 3D graphical user interface to the requesting device.

The present disclosure provides a traffic routing service exposure method and device, electronic equipment and storage medium, and relates to the technical field of computers. The method comprises: when a target exposure CR occurs creation or update, obtaining service exposure configuration information from the target exposure CR; creating a gateway resource and / or a traffic routing resource according to the service exposure configuration information, wherein the gateway resource is used to define a target network endpoint, and the traffic routing resource is used to define a traffic routing rule; and dynamically configuring a proxy server according to the gateway resource and the traffic routing resource, wherein the proxy server is used to route traffic based on the target network endpoint to a backend according to the traffic routing rule. The present disclosure can realize the definition of the target network endpoint and the traffic routing rule through the target exposure CR, thereby dynamically configuring the proxy server to realize traffic routing, and can reduce the complexity of configuration and management.

A system and method for detection and prevention of ticket forgery cyberattacks by improving host-level analytics and monitoring and extending the improved host-level analytics and monitoring to endpoints of a network. The methodology described herein comprises the use of a ticket-granting log extension utility which stores every logon session on a network, queries the local ticket cache, and generates additional custom data as a part of an event log stream such as a start time, end time, renew time, and related session data. This comprehensive log extension data can be used to identify certain types of ticket forgery cyberattacks by comparing the user session name with the client name identified in the ticket presented for access to network resources and other means. This host-level ticket forgery detection can be extended to network endpoints for additional security.

Techniques described herein can efficiently detect network endpoints that are vulnerable to individual security threats. New security threats are constantly emerging. Identifying endpoints that are vulnerable to a security threat enables proactive protection of the vulnerable endpoints. Furthermore, detecting endpoints that are vulnerable to a security threat enables tailored protection operations that are limited to protecting vulnerable endpoints without necessarily also expending resources to protect invulnerable endpoints. Historic vulnerability data is used to group endpoints into cohorts that share similar histories of security infections and compromises. When an active security compromise is discovered at an affected endpoint, cohort protection operations can be applied to protect endpoints in the same cohort as the affected endpoint.

A system and method for flow-level deduplication of network traffic are disclosed. A network node receives a first plurality of packets from a first network endpoint. The first plurality of packets represent a flow of data being communicated between the first network endpoint and a second network endpoint. The network node further receives a second plurality of packets from the second network endpoint. The network node identifies a sequence identifier of each packet of the first and second pluralities of packets. The network node determines that the first and second pluralities of packets are all associated with the same flow, based on the sequence identifiers of the first and second pluralities of packets. In response to that determination, the network node deduplicates the flow by discarding the first plurality of packets or the second plurality of packets. The network node may be a traffic visibility node.

This application provides a method, apparatus, device, medium, and product for cross-domain account management. The method includes: upon receiving a centralized authentication request, determining the account information corresponding to the user's currently logged-in first network endpoint, where the centralized authentication request instructs the user to access a second network endpoint from the first network endpoint. Both the first and second network endpoints include any one of a user management system, a data domain, and a business system; matching the account information corresponding to the second network endpoint from an account model based on the account information corresponding to the first network endpoint, where the account model includes the user's primary account information, secondary account information, and secondary account information; and logging into the second network endpoint based on the account information corresponding to the second network endpoint. This solves the technical problem in related technologies where unified account authentication and cross-domain data access cannot be achieved without modifying the interfaces of each data domain.

Techniques described herein can efficiently detect network endpoints that are vulnerable to individual security threats. New security threats are constantly emerging. Identifying endpoints that are vulnerable to a security threat enables proactive protection of the vulnerable endpoints. Furthermore, detecting endpoints that are vulnerable to a security threat enables tailored protection operations that are limited to protecting vulnerable endpoints without necessarily also expending resources to protect invulnerable endpoints. Historic vulnerability data is used to group endpoints into cohorts that share similar histories of security infections and compromises. When an active security compromise is discovered at an affected endpoint, cohort protection operations can be applied to protect endpoints in the same cohort as the affected endpoint.

Apparatuses, systems, computing devices, switches, network endpoints, and methods to handle probe packets. In at least one embodiment, probe packets are handled in a more time-efficient manner as compared to non-probe packets by identifying probe packets and directing probe packets to particular queues.

This invention belongs to the field of inspection data processing technology, specifically involving a drone inspection video stream communication method, gateway, and medium based on device status recognition. The inspection monitoring gateway acquires security configurations, verifies the initial data packets encrypted and forwarded by the drone via the inspection node, and establishes a secure connection. The real-time video stream is identified by device type and its status characteristics are analyzed, classifying the video stream into datasets of different priorities. Adaptive communication channels are constructed for each priority dataset based on device type and network endpoint information. Differentiated upload frequencies and strategies are implemented according to the priority of the datasets through the corresponding channels. The method achieves control from data security access and intelligent analysis to network resource scheduling. The raw video is converted into a priority-based structured data stream. By dynamically matching business priorities with network channels, highly reliable transmission of high-value alarm data is ensured, improving the security and real-time response capability of the inspection system.

Dynamic Cipher Key Management (DCKM) of the present invention enables the protection of sensitive electronic data by assigning symmetric or asymmetric cipher keys using a process that delivers the cipher key to a network endpoint device by means of a key installation, delivery, and storage methodology. DCKM may negate the need to physically touch the network device under protection. Further, DCKM's process is based on a set of operating principles that maintains the highest levels of assurance that the cipher key pairs are issued with only devices that have the right and authorization to create a secure communication path. The DCKM process realizes the same level of security confidence that is only achieved today with conventional token based key management services with respect to the paired devices linked via a cipher key public and private relationship.

The invention relates to generating a non-redundant physical, logical, and location-specific network endpoint identifier. First information identifying a first one of a target circuit or a radio frequency (RF) tag is communicated to a second one of the target circuit or the RF tag. Second information identifying the second one of the target circuit and the RF tag is then derived from the transmitted first information. The second information is then stored. In some cases, the first information is communicated through a wired interface or a wireless interface between the target circuit and the RF tag. The first information identifying the RF tag may be communicated to the target circuit, and may derive second information identifying the target circuit based on the first information identifying the RF tag by making the second information equivalent to the first information or applying a predetermined algorithm to the first information to generate the second information.

An attestation service is configured to receive a request to enable attestation for a compute instance according to an attestation policy indicating one or more baseline health measurement values for validating compute instances. The attestation service provides a network endpoint for the compute instance to request attestation. The attestation service receives, via the network endpoint from a compute instance, one or more health measurement values of the compute instance. The attestation service validates the compute instance based at least on a comparison of the one or more current health measurement values and the one or more baseline health measurement values. The attestation service, in response to validating the compute instance, generates an attestation token indicating that the compute instance is authorized to access a secured resource of the provider network.

This invention relates to the field of Internet of Things (IoT) technology, specifically to a data encryption method based on WiFi Mesh. The WiFi Mesh-based data encryption method includes the following steps: S1, a key exchange phase, where an unconnected node sends a network access request to a connected node, and the connected node generates a public key A and a private key a using an asymmetric encryption algorithm; S2, the connected node sends public key A to the unconnected node, which generates a random key B using a random number, and encrypts the random key B using public key A to obtain ciphertext b; the broadcast key E is initially generated by the WiFi root node using a random number, and all WiFi Mesh network endpoints use the same broadcast key E; the unicast key F is randomly generated by the connected node. Compared with existing technologies, this invention has the following advantages: it solves the problem of sensitive information leakage during the initial key exchange in data transmission using an asymmetric encryption algorithm; it improves the starting point of the entire cycle, ensuring the security of subsequent data communication.