Netskope, Inc.

The technology disclosed relates to an inline proxy configured with synthetic request injection logic to intercept incoming requests during an application session, and generate, during the application session, synthetic requests that are separate from the incoming requests.

The disclosed technology teaches a method for security monitoring in TLS or other certificate-pinned sessions by a cloud-based network security system. When a security condition is detected in the decrypted packets, alerts are generated for the client device. The method involves injecting a message into the session using keys extracted by the cloud-based resource for encryption. Some implementations utilize an inspection proxy and an endpoint routing client for secure tunneling. A secure web gateway buffers encrypted packets in a new session with a cloud-based resource, detects a connection access request from a certificate-pinned application, requests and receives key extraction, and forwards keys to the security system. The secure web gateway applies the keys to systematically encrypted traffic, decrypts packets, and relays ongoing session traffic between the security system and the client device via the inspection proxy, which applies security policies during the process.

The technology disclosed relates to reducing error in security enforcement by a network security system (abbreviated NSS). The NSS classifies incoming connection access requests as loss prevention inspectable or connection preserving by determining their conformance or non-conformance with semantic and content requirements of HTTP and HTTPs protocols. The NSS forwards the loss prevention inspectable connection access requests to a data inspection and loss prevention appliance (abbreviated DILPA) for deep inspection. The NSS directly sends the connection preserving connection access requests to the destination servers, preventing connection termination and error generation.

A dynamic security system to secure cellular devices across a cellular network in a cloud-based environment. The dynamic security system includes a tenant of multiple tenants having multiple cellular devices, a tunnel, a traffic steering module, and a threat management module. The tunnel transmits and identifies traffic associated with different network identifiers. The traffic steering module routes traffic towards gateways and the threat management module analyzes traffic at the tunnel and generates policies and recommendations to remediate a threat. The threat management module intercepts traffic within the tunnel at an application layer of the cloud-based environment, creates policy profiles for tenants, monitors a threat landscape, and relates the threat with the policy profiles. The threat management module further stores tenant profiles, threat information, and policy profiles. Finally, the threat management module generates recommendations based on these profiles and provides recommendations at the cellular device to remediate the threat.

The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.

A cellular security system that uses multiple policies to protect a cellular network against various threats in a cloud-based environment. The cellular security system includes a tenant with multiple cellular devices, multiple tunnels that receive and route traffic, monitor traffic, capture real-time traffic attributes, and detect anomalies. The cellular security system further includes an anomaly detection model, an alert generator, and an anomaly reporter. The anomaly detection model retrieves baseline profiles from a threat database, loads policies related to a threat, and compares real-time traffic features with baseline profiles. The anomaly detection model further applies an anomaly detection algorithm to a traffic instance, assigns an anomaly score, and raises a flag for anomaly detection where the anomaly score is greater than a threshold. The alert generator sends an alert to the tenant in the cloud-based environment, and the anomaly reporter notifies a management plane for further remediation of the anomaly.

The disclosed technology teaches keeping up with the deployment of APIs, so that Secure Access Service Edge (SASE) protection is afforded, parsing an OpenAPI specification for an API family, for identifying overall attributes of the API family. The technology includes parsing an OpenAPI specification to extract usable attributes of API resources, which are useful for building a connector, including extracting attributes of core activities that trigger protective actions, and applying a connection creator that performs actions including accessing a template for creating connector rules and using the extracted attributes with the template to produce the connector rules, thereby automating generation of connectors. Using the connector rules for the SASE protection is also taught.

A clientless security system to secure cellular devices across a network in a cloud-based environment. The clientless security system includes a tenant with multiple cellular devices, tunnels for transmitting traffic, and a traffic steering module for directing traffic towards a gateway. The traffic steering module provides a SIM with custom network identifiers, configures them, creates and distributes a device-to-IP mapping to gateways in real-time. The gateways loads tenant information, decrypts secure sockets layer (SSL), and determines an installation of a certificate for a hypertext transfer protocol communication. A uniform resource locator (URL) is classified based on a server name indication when certificate is uninstalled. When the certificate is installed, proxy policies are enforced. The gateway retrieves security policies, detects threats based on the security policies, remediates detected threats and encrypts the SSL.

A method for providing data exchange using secure tunnel in a multi-tenant cloud native control plane system. A request is received by cloud control plane for accessing data. The cloud control plane provisions network connection to service endpoint at cloud provider for providing access using data plane and control plane. The control plane identifies routing information of network traffic from multiple end-user devices to establish the connection. Resiliency of the network is identified based on control plane or data plane failure and maintains the connection. Network patterns are identified for network traffic. These patterns are used by the cloud control plane to determine network policy for data access and routing. The secure tunnel is chosen from multiple tunnels based on the network policy, routing information. Data packets are forwarded by the data plane on the secure tunnel and data access is provided to the client endpoint using the secure tunnel.

The technology disclosed relates to reducing error in security enforcement by a network security system (abbreviated NSS). The NSS classifies incoming connection access requests as loss prevention inspectable or connection preserving by determining their conformance or non-conformance with semantic and content requirements of HTTP and HTTPs protocols. The NSS forwards the loss prevention inspectable connection access requests to a data inspection and loss prevention appliance (abbreviated DILPA) for deep inspection. The NSS directly sends the connection preserving connection access requests to the destination servers, preventing connection termination and error generation.