原始名称记载: Palo Alto Networks, Inc.

A log system prompts a foundation model to identify regular expressions that delineate single line logs in log files and incorporates user feedback for the regular expressions in a feedback loop as part of a hybrid parsing approach. The log system splits the log files into single line logs according to the regular expressions and augments the single line logs with classifications and values of metadata fields. The augmented single line logs are then clustered into hierarchical clusters with corresponding cluster patterns and the log system stores the augmented single line logs in a database indexed by the classifications and values of metadata fields and associated with corresponding clusters/cluster patterns. A presentation module accesses the database when responding to user queries for filtered single line logs and log correlations/root cause analysis.

The present application discloses a method, system, and computer system for securing code. The method includes (i) obtaining a code sample, (ii) detecting a call flow associated with the code sample, (iii) determining whether to inject a software development kit (SDK) to the code sample based at least in part on the call flow, and (iv) in response to determining to inject the SDK to the code sample: (a) automatically injecting the SDK to the code sample to obtain an SDK-injected code sample, and (b) providing the SDK-injected code sample.

Anycast addressing is utilized to support the connection of multiple application connectors fronting an application(s) to a network element and anycast routing of network traffic destined for the application(s). When an application is indicated for onboarding in a tenant's network fabric, a network controller allocates virtual and anycast addresses to the application. Allocation of anycast addresses is per domain name and port/protocol combination. Upon determining that the application is available, the application connector(s) advertises reachability of the application via the anycast address. The network controller orchestrates configuration of a domain name system entry that resolves the application name to its virtual Internet Protocol (IP) address and destination network address translation rules that translate the virtual IP address to the anycast address and the anycast address to the application's private IP address. Application network traffic can thus be forwarded to the application via any application connector that advertised the anycast address.

This disclosure provides for server-side application layer session tracking by leveraging the TLS ticket mechanism. Assuming a client indicates support for a TLS ticket when establishing a transport layer session, a server creates a TLS ticket for the transport layer session and conveys in the TLS ticket to the client an identifier used for application layer session tracking. When the client resumes a transport layer session with the TLS ticket, a server extracts from the TLS ticket the identifier and indicates or makes available the identifier application layer session tracking.

Vulnerable program code generated by a language model is detected inline. A detection service monitors for and intercepts network traffic of a language model. For responses from the language model that include generated program code, the detection service extracts the program code and determines a programming language to which the program code corresponds. The detection service employs machine learning-based and/or rule-based vulnerability detection techniques to determine whether the program code comprises any vulnerabilities. If the program code is determined to comprise a vulnerability, the detection service can block transmission of the response comprising the program code to its destination or communicate an alert with the response indicating that the program code is vulnerable to prevent inclusion of the vulnerable program code in a software project.

A root domain evaluation service prompts a language model with task instructions to evaluate various aspects of the root domain that inform a prediction of whether the root domain is benign, where the prompt comprising the task instructions has been engineered so that results of the benignity evaluations provided by the language model can be leveraged to obtain first feature values of the root domain. The service also obtains second feature values of the root domain that comprise data and/or metadata of the root domain. The service inputs the first and second feature values into a classifier trained to predict whether a root domain is benign based on the corresponding features to obtain a prediction of the root domain's benignity. The service also analyzes the second feature values based on heuristics for benign domain name detection to further inform whether the root domain is benign.

The present application discloses a method, system, and computer system for proactively discovering malicious domains through a guided crawling of attack infrastructure. The method includes (i) determining a set of toxic network neighborhoods on the internet, (ii) expanding one or more network graphs for the set of toxic network neighborhoods; (iii) determining a set of domains expected to be malicious from the set of toxic network neighborhoods, and (iv) performing an action based at least in part on the set of domains expected to be malicious. A particular toxic network neighborhood shares a plurality of hosting environments.