Synthetic audit events in workload segmentation

Patent metadata

Field	Value
Publication number	US-12452210-B2
Application number	US-202217582520-A
Country	US
Kind code	B2
Filing date	Jan 24, 2022
Priority date	Jan 24, 2022
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

Systems and methods include operating a local security agent that is configured to allow or block flows based on security policies, to implement microsegmentation; and, responsive to a block of a flow, creating a synthetic audit event that reflects what the flow would have been had it not been blocked. The steps can include creating a packet for the flow and transmitting the packet with an indicator that it represents the synthetic audit event. The steps can include receiving the security policies which include an indicator on which blocks to create the synthetic audit event.

First claim

What is claimed is:

1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming a host that includes one or more processors to perform steps of:
operating a local security agent that is configured to allow or block flows based on security policies, to implement microsegmentation where policies for allowing or blocking flows are determined and put in place by a cloud service and enforcement of the policies is performed locally in a plurality of hosts including the host, via the local security agent on the host and corresponding local security agents on the plurality of hosts;
responsive to a block of a flow, reconstructing a source and destination of the flow and creating a synthetic audit event based on the reconstructed source and destination that reflects what the flow would have been had it not been blocked, wherein the reconstructing the source and destination comprises using local host-state information without accessing a remote security policy store or a remote network security device, wherein the reconstructing the source and destination of the flow further comprises combining packet metadata, initial sequence numbers, source and destination addresses and ports, network topology information including address or ort mappings resulting from network address translation, and identity information of applications running on the source and destination hosts associated with the flow, and wherein the synthetic audit is configured for network debugging in an absence of network connectivity; and
providing the synthetic audit event to the cloud service for analyzing the policies related to the microsegmentation including analyzing the block of the flow.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
creating a packet for the flow and transmitting the packet with an indicator that it represents the synthetic audit event.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
receiving the security policies which include an indicator on which blocks to create the synthetic audit event.

4. The non-transitory computer-readable storage medium of claim 1 , wherein reconstructing the source and a destination for the flow includes combining Internet Protocol (IP) socket and connection data from one or more sources to determine a most likely source and destination for the flow which have not successfully exchanged packets, the reconstructing is sent out to create the synthetic audit event.

5. The non-transitory computer-readable storage medium of claim 4 , wherein the reconstruction is based on a plurality of time-series sources including packet metadata, initial sequence number, source address, destination address, source port, destination port, network topology, and applications.

6. The non-transitory computer-readable storage medium of claim 1 , wherein the steps further include
raising an alert based on the synthetic audit event.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the host includes a database.

8. A method comprising steps of:
operating a local security agent that is configured to allow or block flows based on security policies, to implement microsegmentation where policies for allowing or blocking flows are determined and put in place by a cloud service and enforcement of the policies is performed locally in a plurality of hosts including the host, via the local security agent on the host and corresponding local security agents on the plurality of hosts,
responsive to a block of a flow, reconstructing a source and destination of the flow and creating a synthetic audit event based on the reconstructed source and destination that reflects what the flow would have been had it not been blocked, wherein the reconstructing the source and destination comprises using local host-state information without accessing a remote security policy store or a remote network security device, wherein the reconstructing the source and destination of the flow further comprises combining packet metadata, initial sequence numbers, source and destination addresses and ports, network topology information including address or port mappings resulting from network address translation, and identity information of applications running on the source and destination hosts associated with the flow, and wherein the synthetic audit is configured for network debugging in an absence of network connectivity, and
providing the synthetic audit event to the cloud service for analyzing the policies related to the microsegmentation including analyzing the block of the flow.

9. The method of claim 8 , wherein the steps further include
creating a packet for the flow and transmitting the packet with an indicator that it represents the synthetic audit event.

10. The method of claim 8 , wherein the steps further include
receiving the security policies which include an indicator on which blocks to create the synthetic audit event.

11. The method of claim 8 , wherein reconstructing the source and a destination for the flow includes combining Internet Protocol (IP) socket and connection data from one or more sources to determine a most likely source and destination for the flow which have not successfully exchanged packets.

12. The method of claim 11 , wherein the reconstruction is based on a plurality of packet metadata, initial sequence number, source address, destination address, source port, destination port, network topology, and applications.

13. The method of claim 8 , wherein the steps further include
raising an alert based on the synthetic audit event.

14. The method of claim 8 , wherein the host includes a database.

15. An apparatus comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to
operate a local security agent that is configured to allow or block flows based on security policies, to implement microsegmentation where policies for allowing or blocking flows are determined and put in place by a cloud service and enforcement of the policies is performed locally in a plurality of hosts including the host, via the local security agent on the host and corresponding local security agents on the plurality of hosts;
responsive to a block of a flow, reconstructing a source and destination of the flow and creating a synthetic audit event based on the reconstructed source and destination that reflects what the flow would have been had it not been blocked, wherein the reconstructing the source and destination comprises using local host-state information without accessing a remote security policy store or a remote network security device, wherein the reconstructing the source and destination of the flow further comprises combining packet metadata, initial sequence numbers, source and destination addresses and ports, network topology information including address or port mappings resulting from network address translation, and identity information of applications running on the source and destination hosts associated with the flow, and wherein the synthetic audit is configured for network debugging in an absence of network connectivity; and
provide the synthetic audit event to the cloud service for analyzing the policies related to the microsegmentation including analyzing the block of the flow.

16. The apparatus of claim 15 , wherein the instructions that, when executed, further cause the one or more processors to
create a packet for the flow and transmitting the packet with an indic

Assignees

• Zscaler Inc

Inventors

• Nahas Peter
• Melson Michael J
• Laplante Scott
• Liu Raymond Brian

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title