International Business Machines Corporation

David M McMillen

Kaleb Dean Walton

Gary I Givental

Nicholas W Bradley

Clark Debs Jeffries

Kevin David Himberger

John Ziraldo

An approach is provided for determining a likelihood of an attack on a first computer system of a first business. Characteristics are determined for target businesses having target computer systems currently or recently under attack by an entity whose Internet Protocol (IP) address was selected from a list of suspicious IP addresses. Percentages associated with the characteristics are determined. Each percentage indicates a percentage of the target businesses whose associated characteristic matches a corresponding characteristic of the first business. A score is incremented by an amount for each of the percentages that exceeds an associated threshold. The score is incremented by twice the amount if the IP address matches an address of a source or destination of traffic through a security device in the first computer system. A recommendation to change a security policy for the first computer system is generated if the score exceeds twice the predetermined amount.

Generating accurate preemptive security device policy tuning recommendations

An approach is provided for determining a likelihood of an attack on a first computer system of a first business. Characteristics of the first business and a second business are determined. The second business has a second computer system currently or recently under attack. The characteristics include respective industries, sizes, geographical locations, types of sensitive data, and security vulnerabilities associated with the first and second businesses or first and second computer systems, an address of traffic through a device in the first computer system, and an address of an entity responsible for the attack on the second computer system. Based on a similarity between the characteristics of the first and second businesses, a likelihood that the entity responsible for the attack on the second computer system will attack the first computer system of the first business is determined.

An intrusion event detection system, method, and program product with an enumeration of specific known benign intrusion events, and performing a vulnerability test on specific elements of the computer system for the particular known benign intrusion event. These vulnerability tests are performed at predetermined time intervals measured from a previous test or previous intrusion event of the known benign intrusion event. The predetermined time interval is increased based on various attributes, passage of time since the last intrusion event of either the specific known benign intrusion event or another known benign intrusion event, or even a an undetermined or harmful intrusion event, or the present detection of an intrusion even; or the vulnerability of a specific element in the computer system to a specific intrusion event.

Growing community of inventors

Tuxedo Park, NY, United States of America

David M McMillen