Sap Ag

Sap Se

Cedric R J Hebert

Laurent Y Gomez

Cedric S P Ulmer

Frederic Montagut

Henrik Plate

Jochen Haller

Slim Trabelsi

Maarten E Rits

Merve Sahin

Pascal T C Spadone

Yevgen Reznichenko

Laurent L Y Gomez

In an example embodiment, a combination of machine learning and rule-based techniques are used to automatically detect social engineering attacks in a computer system. More particularly, three phases of detection are utilized on communications in a thread or stream of communications: attack contextualization, intention classification, and security policy violation detection. Each phase of detection causes a score to be generated that is reflective of the degree of danger in the thread or stream of communications, and these scores may then be combined into a single global social engineering attack score, which then may be used to determined appropriate actions to deal with the attack if it transgresses a threshold.

Computer system attack detection

In an example embodiment, rather than merely identifying and patching vulnerabilities, a defender in a computer system is able to utilize deception to set traps for attackers who might attack an application. In this manner, rather than the attacker simply merely needing one entry point to succeed, the attacker would then need to avoid all traps, and the defender only needs one trap to be alerted of the attacker. More particularly, in an example embodiment, traps are set in a way that fools attackers, by blending deceptive but believable network traffic into real traffic to and from the application.

Application self-defense through deceptive message transmission

Embodiments include a system for tracing a collaborative workflow. The system includes an event collector and a transition engine. The event collector may be configured to receive data that represents an event of the collaborative workflow. The collaborative workflow has a local workflow part and a global workflow part. The transition engine may be configured to compute a new instance state of a model of the collaborative workflow. The new instance state represents an instance of the collaborative workflow obtained through the event of the collaborative workflow. The new instance state complies with rules of a local model of the local workflow part and with rules of a global model of the global workflow part.

Tracing of collaborative workflows

A method and system to control an interaction of a plurality of participants in a workflow process. The method classifies the plurality of activities as (1) first activity of the workflow process, (2) first activity of a participant in an on-going workflow process, and (3) interaction activity. A set of access control policies is generated for each type of activity. The policies include workflow initialization policy, participation policy and interaction policies. The policies determine if a requesting participant is permitted to interact with a responding participant. In addition, the system includes a policy enforcement point for receiving a request from a requesting participant, wherein the request is for activating an activity of a responding participant. The policy enforcement point forwards the request to a policy decision point where the request is evaluated based on the set of access control policies.

Automated generation of access control policies in cross-organizational workflow

A system for selecting services that are used for a composite service, may include an accessing unit and a processing unit. The accessing unit may be configured to access: tasks of the composite service, transactional requirements of the tasks, services that are configured to fulfill the tasks, and transactional properties of the services. The processing unit may be configured to: compute conditions for services that are configured to fulfill a task and select a service configured to fulfill the task and having transactional properties that fulfill the conditions, wherein the conditions are computed using data comprising the transactional requirements of the tasks.

Service selection for composite services

A technique for protecting against installation of malicious software includes preventing interaction with a software product when keywords in a disclaimer associated with the software product are detected. A computing device identifies keywords in a disclaimer associated with a software product. If keywords are identified, further interaction with the software is prevented by removing interactive content that facilitates interaction with the software and adding interactive content facilitating sending a request to an administrator for permission to interact with the software. The administrator determines whether interaction with the software product is permitted.

Growing community of inventors

Mougins, France

Cedric R J Hebert