# US 12,224,921 B2 · Technologies for managing compromised sensors in virtualized environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,921 B2 - Document ID: US12224921B2 - Status: Granted - Kind: B2 - Application number: 18/429,022 - Filed: 2024-01-31 - Published: 2024-11-14 - Granted: 2025-02-11 - Earliest claimed: 2015-06-05 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Navindra Yadav; Abhishek Ranjan Singh; Anubhav Gupta; Shashidhar Gandham; Jackson Ngoc Ki Pang; Shih-Chun Chang; Hai Trong Vu - Web page: https://patentgrep.com/patent/US12224921B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/04842: Selection of displayed objects or displayed text elements (G06F3/0482 takes precedence) - G06F 3/04847: Interaction techniques to control parameter settings, e.g. interaction with sliders or dials - G06F 16/122: {using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185)} - G06F 16/137: {Hash-based (content-based indexing of textual data G06F16/31)} - G06F 16/162: {Delete operations (erasing in storage systems G06F3/0652)} - G06F 16/17: Details of further file system functions - G06F 16/173: {Customisation support for file systems, e.g. localisation, multi-language support, personalisation} - G06F 16/174: Redundancy elimination performed by the file system (error detection or correction of the data by redundancy in operations G06F11/14) - G06F 16/1744: {using compression, e.g. sparse files} - G06F 16/1748: {De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641)} - G06F 16/2322: {using timestamps} - G06F 16/235: {Update request formulation} - G06F 16/2365: {Ensuring data consistency and integrity} - G06F 16/24578: {using ranking} - G06F 16/248: Presentation of query results - G06F 16/285: {Clustering or classification} - G06F 16/288: {Entity relationship models} - G06F 16/29: Geographical information databases - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 20/00: Machine learning - G06N 99/00: Subject matter not provided for in other groups of this subclass - G06T 11/26: Drawing of charts or graphs - H04J 3/0661: {using timestamps} - H04J 3/14: Monitoring arrangements {(for SDH/SONET rings H04J3/085)} - H04L 1/242: {by comparing a transmitted test signal with a locally generated replica} - H04L 7/10: Arrangements for initial synchronisation - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 41/0668: by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure - H04L 41/0803: Configuration setting - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0893: Assignment of logical groups to network elements - H04L 41/0894: Policy-based network configuration management - H04L 41/12: Discovery or management of network topologies - H04L 41/16: using machine learning or artificial intelligence - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04L 43/02: Capturing of monitoring data - H04L 43/026: using flow identification - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/062: related to network traffic - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L 43/0805: by checking availability - H04L 43/0811: by checking connectivity - H04L 43/0829: Packet loss - H04L 43/0841: {Round trip packet loss} - H04L 43/0858: {One way delays} - H04L 43/0864: Round trip delays - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/0882: Utilisation of link capacity - H04L 43/0888: Throughput - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 43/12: Network monitoring probes - H04L 43/16: Threshold monitoring - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - H04L 45/306: {Route determination based on the nature of the carried application} - H04L 45/38: {Flow based routing} - H04L 45/46: {Cluster building} - H04L 45/507: {Label distribution} - H04L 45/66: {Layer 2 routing, e.g. in Ethernet based MAN's} - H04L 45/74: Address processing for routing - H04L 47/11: Identifying congestion - H04L 47/20: Traffic policing - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 47/2483: involving identification of individual flows - H04L 47/28: in relation to timing considerations - H04L 47/31: by tagging of packets, e.g. using discard eligibility [DE] bits - H04L 47/32: by discarding or delaying data units, e.g. packets or frames - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0263: {Rule management} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1458: {Denial of Service} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/16: {Implementing security features at a particular protocol layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/01: Protocols - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1001: for accessing one among a plurality of replicated servers - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/51: Discovery or management thereof, e.g. service location protocol [SLP] or web services - H04L 67/75: Indicating network or usage conditions on the user display - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 69/22: Parsing or analysis of headers - H04W 72/54: based on quality criteria - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2221/033: Test or assess software - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2105: Dual mode as a secondary aspect - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2115: Third party - G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL - H04J: MULTIPLEX COMMUNICATION (transmission in general H04B; peculiar to transmission of digital information H04L5/00; systems for the simultaneous or sequential transmission of more than one television signal H04N7/08; in exchanges H04Q11/00; stereophonic systems H04S) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state. ## Claims ### Claim 1 A method comprising: receiving, from a plurality of capturing agents deployed in a plurality of devices, data generated based on traffic at the plurality of devices, a first one of the plurality of devices including a leaf switch in a spine-leaf network fabric, and a second one of the plurality of devices includes a host of a hypervisor coupled with the spine-leaf network fabric via the leaf switch; comparing characteristics of the data to determine a difference in the characteristics; and based on the difference, determining a state of at least one of the plurality of capturing agents; wherein the data is generated based on observed data, statistics, and/or metadata about one or more packets, flows, communications, processes, events, and/or activities at the plurality of devices; wherein the determining the state includes: determining a first traffic pattern for traffic captured during a first period of time; determining a second traffic pattern for traffic captured during the first period of time; determining a third traffic pattern for traffic during a second period of time before the first period of time; determining a fourth traffic pattern for traffic during the second period of time; comparing the first traffic pattern with the third traffic pattern to identify a first traffic pattern delta between the first traffic pattern and the third traffic pattern; comparing the second traffic pattern with the fourth traffic pattern to identify a second traffic pattern delta between the second traffic pattern and the fourth traffic pattern; determining whether the first traffic pattern delta or the second traffic pattern delta exceed a delta threshold; when the first traffic pattern delta exceeds the delta threshold, determining a first one of the plurality of capturing agents is in the state; and when the second traffic pattern delta exceeds the delta threshold, determining a second one of the plurality of capturing agents is in the state. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining a threshold discrepancy between a first amount of traffic captured at the host and a second amount of traffic captured at the leaf switch. ### Claim 3 (depends on 2) The method of claim 2, wherein the determining the threshold discrepancy is at least partially a result of unauthorized activity at the first one of the plurality of devices or the second one of the plurality of devices. ### Claim 4 (depends on 3) The method of claim 3, wherein the determining that the threshold discrepancy is at least partially the result of the unauthorized activity includes determining a faulty one of the plurality of capturing agents when the first amount of the traffic is greater than the second amount of the traffic by a threshold amount. ### Claim 5 (depends on 2) The method of claim 2, wherein the first amount of the traffic includes a number of hits to a database residing at the hypervisor on the host. ### Claim 6 (depends on 1) The method of claim 1, further comprising: in response to the determining the state, increasing a time interval for receiving subsequent data from the plurality of capturing agents to reduce an amount of further data received during the state. ### Claim 7 (depends on 1) The method of claim 1, wherein, the data is received via a collector device, and the method further includes: in response to the determining the state: dropping, by the collector device, the data; or preventing, by the collector device, access by other devices to the data. ### Claim 8 A system comprising: one or more processors; and one or more computer-readable storage devices having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising: receiving, from a plurality of capturing agents deployed in a plurality of devices, data generated based on traffic at the plurality of devices, a first one of the plurality of devices including a leaf switch in a spine-leaf network fabric, and a second one of the plurality of devices includes a host of a hypervisor coupled with the spine-leaf network fabric via the leaf switch; comparing characteristics of the data to determine a difference in the characteristics; based on the difference, determining a state of at least one of the plurality of capturing agents; wherein the data is generated based on observed data, statistics, and/or metadata about one or more packets, flows, communications, processes, events, and/or activities at the plurality of devices; wherein the determining the state includes: determining a first traffic pattern for traffic captured during a first period of time; determining a second traffic pattern for traffic captured during the first period of time; determining a third traffic pattern for traffic during a second period of time before the first period of time; determining a fourth traffic pattern for traffic during the second period of time; comparing the first traffic pattern with the third traffic pattern to identify a first traffic pattern delta between the first traffic pattern and the third traffic pattern; comparing the second traffic pattern with the fourth traffic pattern to identify a second traffic pattern delta between the second traffic pattern and the fourth traffic pattern; determining whether the first traffic pattern delta or the second traffic pattern delta exceed a delta threshold; when the first traffic pattern delta exceeds the delta threshold, determining a first one of the plurality of capturing agents is in the state; and when the second traffic pattern delta exceeds the delta threshold, determining a second one of the plurality of capturing agents is in the state. ### Claim 9 (depends on 8) The system of claim 8, the operations further comprising: determining a threshold discrepancy between a first amount of traffic captured at the host and a second amount of traffic captured at the leaf switch. ### Claim 10 (depends on 9) The system of claim 9 wherein the determining the threshold discrepancy is at least partially a result of unauthorized activity at the first one of the plurality of devices or the second one of the plurality of devices. ### Claim 11 (depends on 10) The system of claim 10, wherein the determining that the threshold discrepancy is at least partially the result of the unauthorized activity includes determining a faulty one of the plurality of capturing agents when the first amount of the traffic is greater than the second amount of the traffic by a threshold amount. ### Claim 12 (depends on 9) The system of claim 9, wherein the first amount of the traffic includes a number of hits to a database residing at the hypervisor on the host. ### Claim 13 (depends on 9) The system of claim 9, the operations further comprising: in response to the determining the state, increasing a time interval for receiving subsequent data from the plurality of capturing agents to reduce an amount of further data received during the state. ### Claim 14 (depends on 8) The system of claim 8, wherein, the data is received via a collector device, and the operations further include: in response to the determining the state: dropping, by the collector device, the data; or preventing, by the collector device, access by other devices to the data. ### Claim 15 A non-transitory computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising: receiving, from a plurality of capturing agents deployed in a plurality of devices, data generated based on traffic at the plurality of devices, a first one of the plurality of devices including a leaf switch in a spine-leaf network fabric, and a second one of the plurality of devices includes a host of a hypervisor coupled with the spine-leaf network fabric via the leaf switch; comparing characteristics of the data to determine a difference in the characteristics; and based on the difference, determining a state of at least one of the plurality of capturing agents, wherein the data is generated based on observed data, statistics, and/or metadata about one or more packets, flows, communications, processes, events, and/or activities at the plurality of devices; wherein the determining the state includes: determining a first traffic pattern for traffic captured during a first period of time; determining a second traffic pattern for traffic captured during the first period of time; determining a third traffic pattern for traffic during a second period of time before the first period of time; determining a fourth traffic pattern for traffic during the second period of time; comparing the first traffic pattern with the third traffic pattern to identify a first traffic pattern delta between the first traffic pattern and the third traffic pattern; comparing the second traffic pattern with the fourth traffic pattern to identify a second traffic pattern delta between the second traffic pattern and the fourth traffic pattern; determining whether the first traffic pattern delta or the second traffic pattern delta exceed a delta threshold; when the first traffic pattern delta exceeds the delta threshold, determining a first one of the plurality of capturing agents is in the state; and when the second traffic pattern delta exceeds the delta threshold, determining a second one of the plurality of capturing agents is in the state. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, the operations further comprising: determining a threshold discrepancy between a first amount of traffic captured at the host and a second amount of traffic captured at the leaf switch. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the determining the threshold discrepancy is at least partially a result of unauthorized activity at the first one of the plurality of devices or the second one of the plurality of devices. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the determining that the threshold discrepancy is at least partially the result of the unauthorized activity includes determining a faulty one of the plurality of capturing agents when the first amount of the traffic is greater than the second amount of the traffic by a threshold amount. ### Claim 19 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the first amount of the traffic includes a number of hits to a database residing at the hypervisor on the host. ### Claim 20 (depends on 16) The non-transitory computer-readable medium of claim 16, the operations further comprising: in response to the determining the state, increasing a time interval for receiving subsequent data from the plurality of capturing agents to reduce an amount of further data received during the state.