International Business Machines Corporation

Abhishek Basu

Craig M Trim

Mary E Rudden

Aankur Bhatia

Peter Currie Boyle

Eniko I Rozsa

Leo Kluger

Kyle Proctor

Brenda Haddock

Maria Wittnebert

Terry Liggett

Diman Ghazi

Luiz Marcel Arbos

Xavier Verges Farrero

A technique for threat response associated with an endpoint detection and response (EDR) system. The system uses a combination of automated observable detection, threat intelligence enrichment, graph analysis, and supervised machine learning to machine-predict analyst behavior in classifying (as 'true' or ‘false’ positives) the EDR alerts, and to support either (i) automated suppression of those alerts that the system classifies with sufficient confidence as either true or false, or (ii) for those alerts than cannot be so classified, the providing of recommendations to analysts to facilitate their activities. Auto-detection of observables for graph-based feature detection, together with the automated disposition of alerts where possible greatly reduces overall analyst workload for the EDR system. Further, and even where a machine-based prediction does not have sufficient confidence to enable bypassing the analyst, the system provides the analyst with additional context and enrichment to facilitate expedited (or at least more efficient) alert handling.

Auto-detection of observables and auto-disposition of alerts in an endpoint detection and response (EDR) system using machine learning

A computer-implemented method for generating a description of a target skill set using domain specific language, a computer program product, and a system. Embodiments may comprise, on a processor, ingesting a data set related to the target skill from a data store, semantically analyzing the data set to generate a skill ontology, generating a hyperplane to separate one or more priority skills from among the plurality of related skills, generating a description for the target skill from the one or more priority skills, and presenting the generated description to a user. The skill ontology may include relationships between the target skill and a plurality of related skills.

Hyperplane optimization in high dimensional ontology

A computer-implemented method includes: generating, by a computing device, a sample of a query, wherein the query maps to a predetermined categorization; processing the sample with a first natural language process, wherein the processing produces an output comprising a categorization of the sample; storing data regarding whether the categorization of the output matches the predetermined categorization; generating a report based on the stored data indicating a percentage of a plurality of samples of the query whose categorizations match the predetermined characterization; outputting the report; and receiving a second natural language process comprising updates to the first natural language process based on the report, wherein the updates increase the percentage of the plurality of samples that match the predetermined categorization when processed with the second natural language process relative to when the plurality of samples was processed with the first natural language process.

Query recognition resiliency determination in virtual agent systems

Growing community of inventors

Kolkata, India

Abhishek Basu