International Business Machines Corporation

Diego M Zamboni

Matthias Schunter

Bernhard Jansen

James F Riordan

Axel Tanner

Ruediger Rissmann

Harigovind Ramasamy

Andreas Wespi

Yann Duponchel

Martim Carbone

Morton D Swimmer

Rüdiger Rissmann

At least one anomaly associated with at least one actual hardware element in a computer system having a plurality of hardware elements is addressed. The anomaly is detected, and, responsive to the detection, a virtualization layer is inserted between (i) an operating system of the computer system, and (ii) the plurality of hardware elements. Hardware emulation and/or selective hardware activation/deactivation are performed on the at least one actual hardware element by the virtualization layer. The insertion of the virtualization layer is accomplished in an on-the-fly manner.

Hardware emulation using on-the-fly virtualization

A first virtualization layer is inserted between (i) an operating system of a computer system, and (ii) at least first and second hardware devices of the computer system. Data is communicated between the first hardware device and the second hardware device, via the first virtualization layer, without exposing the data to the operating system.

Secure user interaction using virtualization

Methods and apparatus are provided for managing an IP network interconnecting a plurality of network hosts (). Status information, indicative of status of a host, is automatically acquired from each host (). The status information, such as MAC address, security and/or operational information, acquired from a host () is automatically recorded in at least one DNS record, associated with the IP address of that host (), of a DNS server (). The host status information in the DNS records can then be accessed for network management operations. The automatic acquisition and recording of the status information may be performed by a DHCP server () of the network on allocation of dynamic IP addresses to hosts ().

IP network management based on automatically acquired network entity status information

The invention relates to a method for operating virtual networks. The method comprises providing a first virtual network comprising a first set of network ports assigned to a first virtualization tag (T) and a second virtual network comprising a second set of network ports assigned to a second virtualization tag (T), the first and the second virtual network having compatible address ranges and being adapted to only pass data packets within them, providing a first network node having a source address (SA) in the first virtual network and being operationally connected to a first port (P) assigned to the first virtual network by means of the first virtualization tag (T), monitoring the first network node in order to detect a predetermined condition, and, on detection of the predetermined condition, reassigning the first port (P) to the second virtual network by means of assigning the second virtualization tag (T) to the first port (P), such that no data packet can be passed from the first network node (N) to a second network node (N) connected to a second port (P) assigned to the first virtual network by means of the first virtualization tag (T) directly and keeping of the source address (SA) for the first network node (N) in the second virtual network (). The invention further relates to a further method for operation virtual networks, a data network system and a computer program product adapted to perform the inventive methods.

Methods for operating virtual networks, data network system, computer program and computer program product

A method and apparatus for facilitating reduction in successful attacks on a monitored data processing system, such as a host computer. An intrusion detection system comprises a host or application based sensor for detecting code based intrusions with a relatively low false-positive rate. Malicious code strings related to a detected intrusion are identified, extracted and forwarded to a pattern filter located in the monitored data processing system to prevent further intrusions using said malicious code strings. The malicious code strings may be forwarded to a response server for assembling sets of similar malicious code strings for which signatures are generated to permit identification of all malicious code strings contained in a set. The generated signatures are then distributed to monitored and/or monitoring systems of a protected network to prevent further intrusions using the malicious code strings and variations thereof.

Growing community of inventors

Adliswil, Switzerland

Diego M Zamboni