International Business Machines Corporation

Bradley E Harris

Moazzam Khan

James Brent Peterson

Preeti Ravindra

Jeb R Linton

Naeem Altaf

Burkhard Ringlein

Satya Sreenivas

Ron Williams

Sanjay Nadhavajhala

Darrel Haswell

John Walter Morris

James Heinlein

One or more computer processors create a binary cluster of events by bootstrapping a set of ground truths contained with a rule engine applied to a set of high-dimensional datapoints, wherein the binary cluster contains two clusters each containing a plurality of high-dimensional datapoints; determine one or more peer groups for a set of unknown high-dimensional datapoints utilizing a trained multiclass classifier, wherein the high-dimensional datapoints are assigned to one or more peer groups by the trained multiclass classifier using an incremental learning algorithm in order to reduce system resources; create an activity distribution for each unknown high-dimensional datapoint associated with a user in the set of unknown high-dimensional datapoints and each peer group; calculate a deviation percentage between the activity distribution of the user and each peer group associated with the user; and responsive to exceeding a deviation threshold, classify the user or associated high-dimensional datapoints as risky.

Anomaly detection over high-dimensional space

An example operation may include one or more of dividing a data file into a plurality of data chunks, generating a randomness value for each data chunk based on one or more predefined randomness tests, and accumulating generated randomness values of the plurality of data chunks to generate an accumulated randomness value, detecting whether the data file is one or more of encrypted and compressed based on the accumulated randomness value and a predetermined threshold value, and storing information about the detection via a storage.

Randomness detection in network data

Methods and systems for artificially intelligent security incident and event management using an attention-based deep neural network and transfer learning are disclosed. A method includes: collecting, by a computing device, system and network activity events in bulk; forming, by the computing device, a corpus using the collected system and network activity events; correlating, by the computing device, discrete events of the system and network activity events into offenses; adding, by the computing device, additional features to the corpus representing the offenses and disposition decisions regarding the offenses; training, by the computing device, a deep neural network using the corpus; and tuning, by the computing device, the deep neural network for a monitored computing environment using transfer learning.

Artificially intelligent security incident and event management

Embodiments provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement the method of identifying an exploit kit, the method comprising: receiving, by the processor, a web page; extracting, by the processor, a plurality of features of the web page; and determining, by the processor, whether the web page is associated with an exploit kit, through an ensemble classifier model trained using the extracted features.

Exploit kit detection

Mechanisms are provided to perform security incident disposition operations. A security incident is received that includes a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph which includes nodes representing elements associated with the security incident and edges representing relationships between the nodes. The security incident data structure and security knowledge graph are processed to extract a set of security incident features corresponding to the security incident and input the extracted set of security incident features into a trained security incident machine learning model. The model generates a disposition classification output based on results of processing the extracted set of security incident features. The disposition classification output is output to the source of the security incident data structure.

Growing community of inventors

Sandy Springs, GA, United States of America

Bradley E Harris