Xue Y Wu

20220407881, Dec 22, 2022

May 26, 2022

17/826011

- Seattle WA, US
Michael Ryan Corder - Seattle WA, US
Edmund Hope Driggs - Seattle WA, US
Benjamin Thomas Higgins - Shoreline WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Kenneth Perrault - Seattle WA, US
Jesse Abraham Rothstein - Seattle WA, US
Jonathan Jacob Scott - Seattle WA, US
Marc Adam Winners - Seattle WA, US
Xue Jun Wu - Seattle WA, US

H04L 9/40
H04L 43/062

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Metrics may be determined based on monitoring network traffic associated with a plurality of entities each associated with a profile that includes the metrics for each entity. Beaconing metrics associated with beaconing activity may be determined based on the metrics. The profile of each entity may be compared with the beaconing metrics to determine the entities that may be engaged in beaconing activity. The entities may be characterized based on beaconing activity such that the beaconing activity includes communication with endpoints associated with the third parties, employing communication protocols associated with the third-parties, or exchanging payloads consistent with the beaconing activity. Reports that include information associated with the entities and its beaconing activity may be generated.

20220247771, Aug 4, 2022

Apr 15, 2022

17/722217

- Seattle WA, US
Jeff James Costlow - Kingston WA, US
John Gemignani, JR. - Bremerton WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Eric James Rongo - Seattle WA, US
Xue Jun Wu - Seattle WA, US

H04L 9/40
H04L 43/062

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers.

20220239685, Jul 28, 2022

Apr 15, 2022

17/721514

- Seattle WA, US
Jeff James Costlow - Kingston WA, US
John Gemignani, JR. - Bremerton WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Eric James Rongo - Seattle WA, US
Xue Jun Wu - Seattle WA, US

H04L 9/40
H04L 43/0876
H04L 43/062
H04L 9/08

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Networks may be configured to protect servers using centralized security protocols. Centralized security protocols may depend on centralized control provided by authentication control servers. If a client intends to access protected servers it may communicate with the authentication control server to obtain keys that enable it to access the requested servers. NMCs may monitor network traffic the centralized security protocol to collect metrics associated with the control servers, clients, or resource servers.

20210044608, Feb 11, 2021

Mar 16, 2020

16/820582

- Seattle WA, US
Edmund Hope Driggs - Seattle WA, US
Xue Jun Wu - Seattle WA, US
Nicholas Jordan Braun - Seattle WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Michael Christopher Kelly - Seattle WA, US

H04L 29/06
H04L 12/26
H04L 12/24
H04L 29/08
G06N 5/04
G06N 20/00

Embodiments are directed to monitoring network traffic associated with networks to provide metrics. A monitoring engine may determine an anomaly based on the metrics exceeding threshold values. An inference engine may be instantiated to provide an anomaly profile based on portions of the network traffic that are associated with the anomaly. The inference engine may provide an investigation profile based on the anomaly profile such that the investigation profile includes information associated with investigation activities associated with an investigation of the anomaly. The inference engine may monitor the investigation of the anomaly based on other portions of the network traffic such that the other portions of the network traffic are associated with monitoring an occurrence of the investigation activities. The inference engine may modify a performance score associated with the investigation profile based on the occurrence of the investigation activities and a completion status of the investigation.

20210037043, Feb 4, 2021

Jul 29, 2019

16/525290

- Seattle WA, US
Songqian Chen - Seattle WA, US
Amanda Jewitt - Seattle WA, US
Olga Kazakova - Kirkland WA, US
Todd Kemmerling - Bainbridge Island WA, US
Bhushan Prasad Khanal - Seattle WA, US
Katherine Megan Porterfield - Seattle WA, US
Jade Alexi Tabony - Seattle WA, US
Karan Rajesh Thakker - Seattle WA, US
Xue Jun Wu - Seattle WA, US

H04L 29/06

Embodiments are directed to monitoring network traffic using NMCs that may be arranged to provide scores based on threat assessments associated with anomaly classes such that the anomaly classes may be associated with types of anomalous activity. NMCs may employ the anomaly classes, the scores, characteristics of the anomaly classes, or the like, to determine triage models. The NMCs may modify the scores based on the triage models or archival information associated with the anomaly classes. The NMCs may associate the modified scores with the anomaly classes. In response to detecting anomalous activity, the NMCs may provide other scores based on the anomalous activity and provide a report that includes the other scores to a user.

20200382529, Dec 3, 2020

May 28, 2019

16/424387

- Seattle WA, US
Jesse Abraham Rothstein - Seattle WA, US
Xue Jun Wu - Seattle WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Kevin Michael Seguin - Seattle WA, US

H04L 29/06
H04L 12/26

Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). NMCs may determine requests provided to a server based on a first portion of network traffic. NMCs may determine suspicious requests based on characteristics of the provided requests. NMCs may employ the characteristics of the suspicious requests to provide correlation information that is associated with the suspicious requests. NMCs may determine dependent actions associated with the server based on a second portion of the network traffic and the correlation information. And, in response to determining anomalous activity associated with the evaluation of the dependent actions, NMCs may provide reports associated with the anomalous activity.

20200067952, Feb 27, 2020

Aug 21, 2018

16/107509

- Seattle WA, US
Edmund Hope Driggs - Seattle WA, US
Xue Jun Wu - Seattle WA, US
Nicholas Jordan Braun - Seattle WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Michael Christopher Kelly - Seattle WA, US

H04L 29/06
H04L 12/26
H04L 12/24
H04L 29/08
G06N 5/04
G06F 15/18

Embodiments are directed to monitoring network traffic associated with networks to provide metrics. A monitoring engine may determine an anomaly based on the metrics exceeding threshold values. An inference engine may be instantiated to provide an anomaly profile based on portions of the network traffic that are associated with the anomaly. The inference engine may provide an investigation profile based on the anomaly profile such that the investigation profile includes information associated with investigation activities associated with an investigation of the anomaly. The inference engine may monitor the investigation of the anomaly based on other portions of the network traffic such that the other portions of the network traffic are associated with monitoring an occurrence of the investigation activities. The inference engine may modify a performance score associated with the investigation profile based on the occurrence of the investigation activities and a completion status of the investigation.

20200052985, Feb 13, 2020

Sep 9, 2019

16/565109

- Seattle WA, US
Eric Joseph Hammerle - Seattle WA, US
Benjamin Thomas Higgins - Shoreline WA, US
Bhushan Prasad Khanal - Seattle WA, US
Michael Kerber Krause Montague - Lake Forest Park WA, US
Xue Jun Wu - Seattle WA, US

H04L 12/26

Embodiments are directed to monitoring network traffic using a monitoring engine that monitors network traffic in networks to provide metrics. An inference engine may provide activity profiles based on portions of the network traffic where each activity profile includes features associated with the portions of network traffic. The inference engine may determine other activity profiles correlated with the activity profiles based on correlation models such that the determination of the other activity profiles occurs prior to monitoring an occurrence of other portions of the network traffic. The inference engine may modify monitoring actions of the monitoring engine based on the other activity profiles. The inference engine may provide reports based on the portions of the network traffic, the activity profiles, the other portions of the network traffic, or the other activity profiles.