International Business Machines Corporation

Bar Haim

Eitan Menahem

Aviv Ron

Andrey Finkelshtein

Ilgen Banu Yuceer

Alon Freund

Noga Agmon

Anton Puzanov

Eitan Chertok

Romy Varga

Yuval Lapidot

Amit Haim

Described are techniques for automated labeling of cybersecurity incidents. The techniques include generating a set of labels for a received cybersecurity incident based on features of the received cybersecurity incident. The techniques further include prioritizing the set of labels to generate a subset of labels, and associating the subset of labels to the received cybersecurity incident.

Label recommendation for cybersecurity content

Techniques are provided for generating security response recommendations. In one embodiment, the techniques involve receiving scoring functions, a logical operator selection, a security graph, and external threat intelligence, generating a search pattern based on the scoring functions and the logical operator selection, evaluating the search pattern against a selected node of the security graph to identify a potential security threat represented by the security graph at the selected node, and generating a recommendation based on the evaluation and the external threat intelligence.

Generating security response recommendations

Automated detection of personal information in free text, which includes: automatically applying a named-entity recognition (NER) algorithm to a digital text document, to detect named entities appearing in the digital text document, wherein the named entities are selected from the group consisting of: at least one person-type entity, and at least one non-person-type entity; automatically detecting at least one relation between the named entities, by applying a parts-of-speech (POS) tagging algorithm and a dependency parsing algorithm to sentences of the digital text document which contain the detected named entities; automatically estimating whether the at least one relation between the named entities is indicative of personal information; and automatically issuing a notification of a result of the estimation.

Automated detection of personal information in free text

A method for quantifying a similarity between a target dataset and multiple source datasets and identifying one or more source datasets that are most similar to the target dataset is provided. The method includes receiving, at a computing system, source datasets relating to a source domain and a target dataset relating to a target domain of interest. Each dataset is arranged in a tabular format including columns and rows, and the source datasets and the target dataset include a same feature space. The method also includes pre-processing, via a processor of the computing system, each source-target dataset pair to remove non-intersecting columns. The method further includes calculating at least two of a dataset similarity score, a row similarity score, and a column similarity score for each source-target dataset pair, and summarizing the calculated similarity scores to identify one or more source datasets that are most similar to the target dataset.

Identifying source datasets that fit a transfer learning process for a target domain

A method, computer program product and computer system are provided. A processor retrieves a target file for inspection of malware. A processor converts the target file to a time domain format. A processor determines one or more time-frequency domain features of the converted target file. A processor generates a malicious classification for the target file based on the one or more time-frequency domain features of the converted target file and one or more classification models.

Growing community of inventors

Ashqelon, Israel

Bar Haim