# US 2024/0205243 A1 · Intelligent quarantine on switch fabric for physical and virtualized infrastructure

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2024/0205243 A1
- Document ID: US20240205243A1
- Status: Published application
- Kind: A1
- Application number: 18/591,090
- Filed: 2024-02-29
- Published: 2024-06-20
- Earliest claimed: 2020-03-20
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Balaji Sundararajan; Gaurang Rajeev Mokashi; Preety Mordani; Vivek Agarwal
- Web page: https://patentgrep.com/patent/US20240205243A1

## CPC

- H04L 49/25: Routing or path finding in a switch fabric
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
- H04L 47/20: Traffic policing
- H04L 49/70: {Virtual switches}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- G06F 2009/45591: {Monitoring or debugging support}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/1458: {Denial of Service}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems, methods, and computer-readable media for performing threat remediation through a switch fabric of a virtualized network environment. Data traffic passing into a virtualized network environment including a plurality of virtual machines running on a switch fabric is monitored. A network threat introduced through at a least a portion of the data traffic is identified at the switch fabric. One or more remedial measures are performed in the network environment based on the identification of the network threat in the virtualized network environment.

## Claims

### Claim 1

A method comprising:
monitoring, at a first node in a switch fabric, data traffic passing into a network environment including a plurality of virtual machines;
detecting, at the first node, a traffic pattern indicative of a denial of service (DoS) attack within the monitored data traffic passing into the virtualized network environment;
generating threat information in response to detecting the traffic pattern indicative of a DoS attack; and
at the first node, using the threat information to prevent transmission of the DoS attack traffic into either or both the virtual machines and one or more hypervisors hosting the virtual machines in the virtualized network environment.

### Claim 2 (depends on 1)

The method of claim 1, wherein the threat information identifies DoS attack traffic at a ternary content addressable memory (TCAM) level.

### Claim 3 (depends on 1)

The method of claim 1, further comprising: at a second node, using the threat information to prevent transmission of the DoS attack traffic from the switch fabric into either or both the virtual machines and one or more hypervisors hosting the virtual machines in the virtualized network environment.

### Claim 4 (depends on 1)

The method of claim 1, wherein the threat information is propagated to more than one node in the switching fabric.

### Claim 5 (depends on 1)

The method of claim 1, wherein the traffic pattern indicative of a DoS attack is based on monitoring for TCP/SYN packets in the data traffic monitored at the first node.

### Claim 6 (depends on 1)

The method of claim 1, wherein the traffic pattern indicative of a DoS attack is based on matching a signature of a known network threat at the first node.

### Claim 7 (depends on 1)

The method of claim 1, wherein the traffic pattern indicative of a DoS attack is based on matching an exclusion list at the first node.

### Claim 8

A system comprising:
a switch fabric including a plurality of nodes, wherein each node in the plurality of nodes includes a physical network device, one or more processors, a memory; and wherein each node receives traffic to pass into a network environment including a plurality of virtual machines;
a switch fabric threat remediation agent, and
wherein the plurality of nodes and the switch fabric threat remediation agent include software instructions, which when executed by one or more processors within the switch fabric cause the system to perform operations including:
monitoring, at a first node in a switch fabric, data traffic passing into the network environment;
detecting, at the first node, a traffic pattern indicative of a denial of service (DoS) attack within the monitored data traffic passing into the virtualized network environment,
generating threat information in response to detecting the traffic pattern indicative of a DoS attack;
at the first node, using the threat information to prevent transmission of the DoS attack traffic into either or both the virtual machines and one or more hypervisors hosting the virtual machines in the virtualized network environment.

### Claim 9 (depends on 8)

The system of claim 8, wherein the switch fabric threat remediation agent is implemented, at least in part, in the virtualized network environment.

### Claim 10 (depends on 8)

The system of claim 8, wherein the switch fabric threat remediation agent is implemented, at least in part, in a container within the virtualized network environment.

### Claim 11 (depends on 8)

The system of claim 8, wherein the switch fabric threat remediation agent is implemented, at least in part, at one or more nodes, either physical or virtualized, in the switch fabric.

### Claim 12 (depends on 8)

The system of claim 8, wherein the threat information identifies DoS attack traffic at a ternary content addressable memory (TCAM) level.

### Claim 13 (depends on 8)

The system of claim 8, wherein the threat information is propagated to more than one node of the plurality of nodes.

### Claim 14 (depends on 13)

The system of claim 13, wherein each node that receives the propagated threat information uses the threat information to prevent transmission of the DoS attack traffic from the switch fabric into either or both the virtual machines and one or more hypervisors hosting the virtual machines in the virtualized network environment.

### Claim 15 (depends on 8)

The system of claim 8, wherein the traffic pattern indicative of a DoS attack is based on monitoring for TCP/SYN packets in the data traffic monitored at the first node.

### Claim 16

A non-transitory media storing program instructions, which when executed by one or more processors in a system comprising a plurality of nodes organized in a switch fabric, which when executed by one or more processors within the switch fabric cause the system to perform operations including:
monitoring, at a first node in the switch fabric, data traffic passing into a virtualized network environment;
detecting, at the first node, a traffic pattern indicative of a denial of service (DoS) attack within the monitored data traffic passing into the virtualized network environment;
generating threat information in response to detecting the traffic pattern indicative of a DoS attack; and
at the first node, using the threat information to prevent transmission of the DoS attack traffic into at least one hypervisor or virtual machine in the virtualized network environment.

### Claim 17 (depends on 16)

The non-transitory media of claim 16, wherein the operations further include configuring the first node to identify DoS attack traffic at a ternary content addressable memory (TCAM) level.

### Claim 18 (depends on 16)

The non-transitory media of claim 16, wherein the operations further include propagating the threat information to more than one node of the plurality of nodes.

### Claim 19 (depends on 18)

The non-transitory media of claim 18, wherein the operations further include using the threat information to prevent transmission of DoS attack traffic at each node that receives the propagated threat information.

### Claim 20 (depends on 16)

The non-transitory media of claim 16, wherein the traffic pattern indicative of a denial of service (DoS) attack is based on monitoring for TCP/SYN packets in the data traffic monitored at the first node.