International Business Machines Corporation

Boris Rozenberg

Ariel Farkash

Oded Sofer

Allon Adir

Ehud Aharoni

Lev Greenberg

Abigail Goldsteen

Igor Gokhman

Omri Soceanu

Ron Ben-Natan

Ofer Haim Biller

Tamar Domany

David Rozenblat

Rosa Miroshnikov

Yehoshua Sagron

Oded Margalit

Micha Gideon Moffie

Ury Segal

Eyal Kushnir

Guy Lev

Ksenya Kveler

Muhammad Barham

Igor Gorkhman

Mor Weiss

Yuval Hager

A technique for privacy-preserving homomorphic inferencing using a neural network having an activation function, such as a non-linear high-degree polynomial. The network is trained to learn input features of an input feature vector together with their associated inverses. During inferencing, an encrypted data point is received at the network. The data point comprises an input feature vector that has been extended with a set of one or more additional feature values, the set of one or more additional feature values having been generated by applying a normalized inverse function to respective one or more features in the feature vector. Homomorphic inferencing is performed on the encrypted data point using the machine learning model to generate an encrypted result, which is then returned. By applying the normalized inverse function, the high-degree polynomial can use any value of an input feature during inferencing, whether the value is within or outside of a particular input range.

Non-linear approximation robust to input range of homomorphic encryption analytics

A method, a structure, and a computer system for expanding database column names. Exemplary embodiments may include identifying glossary terms that sufficiently syntactically match a column name, extracting partial expansions from the glossary terms, selectively combining a set of the partial expansions, and storing the combined set of partial expansions in association with the column name.

Expanding database column names

Detecting sequences of computer-executed operations, including training a BLSTM to determine forward and backward probabilities of encountering each computer-executed operations within a training set of consecutive computer-executed operations in forward and backward execution directions of the operations, and identifying reference sequences of operations within the training set where for each given one of the sequences the forward probability of encountering a first computer-executed operation in the given sequence is below a predefined lower threshold, the forward probability of encountering a last computer-executed operation in the given sequence is above a predefined upper threshold, the backward probability of encountering the last computer-executed operation in the given sequence is below the predefined lower threshold, and the backward probability of encountering the first computer-executed operation in the given sequence is above the predefined upper threshold, and where the predefined lower threshold is below the predefined upper threshold.

Detecting non-anomalous and anomalous sequences of computer-executed operations

Embodiments of the present invention may provide the capability to identify security breaches in computer systems from clustering properties of clusters generated based on monitored behavior of users of the computer systems by using techniques that provide improved performance and reduced resource requirements. For example, behavior of users or resources may be monitored and analyzed to generate clusters and train clustering models. Labeling information relating to some user or resource may be received. When users or resources are clustered and when a cluster contains some labeled users/resources then an anomaly score can be determined for a user/resource belonging to the cluster. A user or resource may be detected to be an outlier of at least one cluster to which the user or resource has been assigned, and an alert indicating detection of the outlier may be generated.

Identifying security breaches from clustering properties

Embodiments of the present systems and methods may provide data watermarking without reliance on error-tolerant fields, thereby providing for the incorporation of watermarks in data that was not considered suitable for watermarking. For example, in an embodiment, a computer-implemented method for watermarking data may comprise inserting watermark data into a field that requires format-preserving encryption.

Method for watermarking through format preserving encryption

A system for detecting cyber security events can include a processor to generate a first set of a plurality of time series and aggregate statistics based on a plurality of properties corresponding to user actions for each user in a set of users. The processor can also separate the set of users into a plurality of clusters based on the first set of the plurality of time series or aggregate statistics for each user and assign an identifier to each of the plurality of clusters. Additionally, the processor can generate a second set of a plurality of time series based on properties of the plurality of clusters, wherein the properties of a cluster correspond to a membership, a diameter, and a centroid and detect an anomaly based on a new value stored in the second set of the time series. Furthermore, the processor can execute a prevention instruction.

Cyber security event detection

Methods, computing systems and computer program products implement embodiments of the present invention that include assigning, to multiple users, respective sets of original roles for accessing data stored on a computer system, and performing, in response to requests from the users, multiple operations on the data. While performing the multiple operations on the data, a transaction log is generated that includes a plurality of entries, each of the entries storing attributes of a given operation. Based on the entries in the log file, a respective set of learned roles for respective users is identified, and the respective sets of the learned roles are assigned to the respective users.

Evidence-based role based access control

Methods, computing systems and computer program products implement embodiments of the present invention that include defining multiple primitives, each of the primitives including ranking and unranking methods. Two or more of the multiple primitives are selected, and an operation is performed on the selected primitives, thereby defining a complex format. Upon an encryption processor receiving a data record including a plaintext, the complex format is applied to the plaintext, thereby generating a non-reversible token. In some embodiments, the generated token is transmitted a remote computer.

Complex format-preserving tokenization scheme

A method comprising using at least one hardware processor for: receiving input from a user with respect to masking of a data element in one or more documents of a java script object notation (JSON) type, wherein the input comprises: an identifier of the data element, and one or more constraints for masking the data element based on the hierarchy of the one or more documents of the JSON-type; and generating a masking rule for the one or more documents of the JSON-type based on the input.

Masking data within JSON-type documents

Methods, computing systems and computer program products implement embodiments of the present invention that include defining multiple primitives, each primitive including ranking and unranking methods. Two or more of the multiple primitives are selected, and an operation is performed on the selected primitives, thereby defining a complex format. Upon and encryption processor receiving a data record comprising a plaintext, the complex format is applied to the plaintext, thereby generating a ciphertext, and the ciphertext is transmitted to a remote computer. Upon receiving the ciphertext, the remote computer can apply the complex format to the received ciphertext, thereby regenerating the plaintext.

Complex format-preserving encryption scheme

Embodiments are directed to a computer-based system for tuning roles. The system includes a memory and a processor system communicatively coupled to the memory. The processor system is configured to receive at least one database access log file and existing role definitions of the system. For each role, the processor system is further configured to create an existing user to permission assignment (EUPA) based at least in part on the existing role definitions of the system. For each role, the processor system is further configured to identify logical sessions in the at least one database access log file and create a demonstrated user to permission assignment (DUPA) formed at least in part from data of the identified logical sessions. For each role, the processor system is further configured to create a final user to permission assignment (FUPA) including a function of the EUPA and the DUPA.

Automatic role tuning in a computer system

A method of mapping between visual objects and web messages. The method comprises monitoring a plurality of web messages transmitted during at least one of loading and modifying a webpage having a plurality of dynamic visual objects by a browser of a client terminal, providing a dynamic model having a plurality of model elements each indicative of another of the plurality of dynamic visual objects, monitoring changes to the dynamic model to identify a first of the plurality of web messages has an effect on a first of the plurality of dynamic visual objects, and mapping, using a processor, between the first dynamic visual object and the first web message according to a source of the first web message.

Web application content mapping

A method, system or computer usable program product for masking communication data using context based rules including intercepting a communication between a server and a client by an intermediary, the communication having a recipient, parsing the communication by the intermediary to determine whether a context based alteration rule should be applied, responsive to an affirmative determination, applying the rule to the communication to produce an altered communication with altered data, and sending the altered communication to the recipient so that the altered data in the communication is utilized in a masked manner.

Growing community of inventors

Ramat Gan, Israel

Boris Rozenberg