International Business Machines Corporation

Bo-Yu Kuo

Chao-Min Chang

Cheng-Ta Lee

Sridhar R Muppidi

Bruno Dos Santos Silva

Gideon Zenz

Ron Williams

Andrii Sergeevich Iesiev

Yu-Jin Chen

Jacobus P Lodewijkx

Yu-Chi Tang

A method for receiving a full training data set including a plurality of individual training data set, dividing the plurality of individual training sets into N classes, where N is an integer greater than three, dividing the N classes into M full data classes and N-M partial data classes, performing training to obtain a trained fixed size machine learning (ML) classification model and a trained in-class confidence model, outputting a first set of prediction value(s) based on the performance of training, distributing each class of the N classes of individual training data sets to a different node of a distributed machine learning system; and outputting, from the nodes of the distributed machine learning system, a second set of prediction value(s) for each class of the N classes.

Multi-class classification using a dual model

A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Inline detection and prevention of adversarial attacks

A computer-implemented method, a computer program product, and a computer system for creating malware domain sinkholes by domain clustering. The computer system clusters malware domains into domain clusters. The computer system collects domain metrics in the domain clusters. The computer system sorts clustered malware domains in the respective ones of the domain clusters, based on the domain metrics. The computer system selects, from the clustered malware domains in the respective ones of the domain clusters, a predetermined number of top domains as candidates of respective domain sinkholes, wherein the respective domain sinkholes are created for the respective ones of the domain clusters.

Creating a malware domain sinkhole by domain clustering

Growing community of inventors

Kaohsiung, Taiwan

Bo-Yu Kuo