International Business Machines Corporation

Cheng-Ta Lee

Iosif Viorel Onut

Bruno Dos Santos Silva

Sridhar R Muppidi

Saritha Arunkumar

Wei-Hsiang Hsiung

Chun-Shuo Lin

Russell L Couturier

Richard Ory Jerrell

Galia Diamant

James E Damgar

Socheat Sou

Chao-Min Chang

Ron Williams

Wei-jie Liau

Bo-Yu Kuo

George Patrick Carper

Ettore Merlo

Howard Ruihua Zhao

Vaisakhi Mishra

Pengxiang Xu

Annamaria Balazs

Mattias Johansson

Julien Cassagne

Guy Jourdan

Aspects of the invention include techniques for correlating distinct phishing campaigns by identifying shared modus operandi. A non-limiting example method includes building, from a source code, an abstract syntax tree and building, from the abstract syntax tree, a decloaked abstract syntax tree. The method includes removing payload data from the decloaked abstract syntax tree to define an obfuscation pattern. The obfuscation pattern is compared to a plurality of predetermined obfuscation patterns. The method includes correlating, based on the comparison, the source code to one or more phishing kits.

Method of correlating distinct phishing campaigns by identifying shared modus operandi

In an approach, a processor receives a set of normal domains, a set of suspicious domains, and a set of malicious domains; labels each domain of the set of normal domains as normal producing a labelled set of normal domains and each domain of the set of suspicious domains and the set of malicious domains as malicious producing a labelled set of malicious domains; samples a preset percentage of the labelled set of normal domains producing a sampled set of normal domains; aggregates the sampled set of normal domains and the labelled set of malicious domains producing a set of aggregated domains; filters the set of aggregated domains using hit size, inter-arrival-time, and univariate volumetric filters producing a set of filtered domains; and determines a cluster of a set of clusters to which each of the set of filtered domains is to be assigned using a trained K-shape model.

Volumetric clustering on large-scale DNS data

A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Inline detection and prevention of adversarial attacks

A generated signal is injected into a first network node in a set of network nodes. The generated signal comprises a predetermined pattern, the predetermined pattern comprises a plurality of time periods, wherein during each time period in the plurality of time periods a first data traffic is prevented from exiting the first network node. By monitoring data flow within the set of network nodes while the generated signal is being injected, a correlation with the generated signal is detected, the correlation correlating a second network node with the first network node. The second network node is associated with the first network node. Responsive to the association, traffic from the second network node to the set of network nodes is blocked.

Signal based node relationship identification

A method, a computer program product, and a system for implementing a dynamic virtual database honeypot. The method includes relaying a query request received from a database client to a database and receiving, from the database, a response relating to the query request. The method also includes determining the query request is an attack on the database based on session information relating to the database and the database client, generating a honey token based on information contained within the response, generating an alternate response formatted in a same format as the response and containing artificial information that masks the information contained within the response. The method further includes inserting the honey token into the alternate response and transmitting the alternate response to the database client.

Dynamic virtual honeypot utilizing honey tokens and data masking

In an approach for prohibiting voice attacks, a processor, in response to receiving a voice input from a source, determines, using a predetermined filter including an allowlist, that the voice input does not match any corresponding entry of the predetermined filter. A processor routes the voice input to an adversarial pipeline for processing. A processor identifies an adversarial example of the voice input using a predetermined connectionist temporal classification method. A processor generates a configurable distorted adversarial example using the adversarial example identified. In response to a user reply, a processor injects the configurable distorted adversarial example as noise into a voice stream of the user reply in real-time to alter the voice stream. A processor routes the altered voice stream to the source.

Prohibiting voice attacks

In an approach to auditing of multi-factor authentication, one or more computer processors receive a request for a multi-factor authentication for a service from at least one device associated with a user. One or more computer processors retrieve information associated with the at least one device. One or more computer processors log the request and the information associated with the at least one device. One or more computer processors calculate a strength of the multi-factor authentication based on the request and the information associated with the at least one device. One or more computer processors log a multi-factor authentication audit trail.

Auditing of multi-factor authentication

Growing community of inventors

Chamblee, GA, United States of America

Cheng-Ta Lee