International Business Machines Corporation

David Rozenblat

Oded Sofer

Ofer Haim Biller

Boris Rozenberg

Roza Miroshnikov

Rosa Miroshnikov

In some examples, a system for detecting unauthorized data access can include a processor to detect a suspicious operation to be executed by the system and review a plurality of highlights corresponding to the suspicious operation. The processor can also determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist and generate the predefined cyber security image based on a plurality of sub-cyber security images. Furthermore, the processor can store the predefined cyber security image in a cyber security image repository and prevent the suspicious operation from being executed.

Unauthorized data access detection based on cyber security images

Methods, computing systems and computer program products implement embodiments of the present invention that include assigning, to multiple users, respective sets of original roles for accessing data stored on a computer system, and performing, in response to requests from the users, multiple operations on the data. While performing the multiple operations on the data, a transaction log is generated that includes a plurality of entries, each of the entries storing attributes of a given operation. Based on the entries in the log file, a respective set of learned roles for respective users is identified, and the respective sets of the learned roles are assigned to the respective users.

Evidence-based role based access control

A method, computer program product and/or system receives information pertaining to network data traffic from and/or to a network accessible resource, analyzes the information to determine whether a user is engaged in potential hacking transaction(s) with respect to the resource. On condition that the user is determined to be engaged in potential hacking transaction(s), a 'scarecrow' message designed for display to the user, is generated and sent to the user.

Scarecrow for data security

Embodiments are directed to a computer-based system for tuning roles. The system includes a memory and a processor system communicatively coupled to the memory. The processor system is configured to receive at least one database access log file and existing role definitions of the system. For each role, the processor system is further configured to create an existing user to permission assignment (EUPA) based at least in part on the existing role definitions of the system. For each role, the processor system is further configured to identify logical sessions in the at least one database access log file and create a demonstrated user to permission assignment (DUPA) formed at least in part from data of the identified logical sessions. For each role, the processor system is further configured to create a final user to permission assignment (FUPA) including a function of the EUPA and the DUPA.

Growing community of inventors

Nes Harim, Israel

David Rozenblat