International Business Machines Corporation

Xiv Ltd.

Microsoft Technology Licensing, LLC

Dror Cohen

Haim Helman

Ofir Zohar

Yaron Revah

Shemer Schwartz

Efri Zeidner

Jonatan Zukerman

Kariel Sendler

Noa Esther Aviv Hamamy

Amihay Birenboim

Idan Yehoshua Hen

Shemer Schwarz

Hani Hana Neuvirth

Itay Argoety

Tomer Haimovich

Yossef Basha

Raz Marom

Idan Belaiev

Yoni Zukerman

Miriam Weissler

Shermer Schwartz

A computer-implemented method, computer device and computer program are provided for training a Machine Learning model based on a plurality of signal records, each signal record comprising an entity identifier, a signal identifier and a timestamp. Signal records related to an entity can be input into the trained Machine Learning model. The trained Machine Learning model can be used to determine if an entity is malicious.

Method and system for predicting malicious entities

Techniques are described herein that are capable of using weighted peer groups to selectively trigger a security alert. A determination is made that an entity performs an operation. The entity has peers that are categorized among peer groups. For each peer group, an extent to which the peers in the peer group perform the operation is determined. Weights are assigned to the respective peer groups. For each peer group, the extent to which the peers in the peer group perform the operation and the weight that is assigned to the peer group are combined to provide a respective weighted group value. A risk score, which is based at least in part on the weighted group values of the peer groups, is assigned to the operation. The security alert regarding the operation is selectively triggered based at least in part on the risk score.

Using weighted peer groups to selectively trigger a security alert

According to examples, an apparatus may include a processor and a memory on which are stored machine-readable instructions that, when executed by the processor, may cause the processor to receive event data to be placed in a plurality of queues. The processor may determine logical partitions for the received event data and may store the event data in the plurality of queues based on the determined logical partitions. A first queue of the plurality of queues may be mapped to a first logical partition range and a second queue of the plurality of queues may be mapped to a second logical partition range. Based on respective loads at the plurality of queues, the processor may update a mapping of the determined logical partitions to the plurality of queues by transferring logical partitions between the first queue and the second queue.

Mapping logical partitions for event data to a plurality of queues

Methods, systems and computer program products are provided for detection of slow brute force attacks based on user-level time series analysis. A slow brute force attack may be detected based on one or more anomalous failed login events associated with a user, alone or in combination with one or more post-login anomalous activities associated with the user, security alerts associated with the user, investigation priority determined for the user and/or successful logon events associated with the user. An alert may indicate a user is the target of a successful or unsuccessful slow brute force attack. Time-series data (e.g., accounted for in configurable time intervals) may be analyzed on a user-by-user basis to identify localized anomalies and global anomalies, which may be scored and evaluated (e.g., alone or combined with other information) to determine an investigation priority and whether and what alert to issue for a user.

Detection of slow brute force attacks based on user-level time series analysis

Computing environment resource popularity is assessed, using a computed ratio of accumulations of resource usage values and a relationship condition, thereby providing inputs as guidance for automatic system enhancement utilizations such as anomaly detection, resource management, and access or maintenance prioritization. Unlike V1 approaches that base resource popularity on at most two resource usage values, the V2 assessment approaches taught herein consider a distribution of usage values across an entire group of resources, thereby providing finer grained actionable results. Usage value accumulations may be scaled. Popularity or rareness of one or more resources of various types may be determined. A cache or other decay model may be employed to optimize assessment efficiency by reducing usage value retrieval I/O transactions. Specific utilizations of resource popularity assessments for enhancing system usability, security, functionality, and effectiveness are discussed.

Resource popularity assessment and utilization

Disclosed is a data processing and/or storage system. The data processing and/or storage system includes at least two interfaces, wherein each of the at least two interfaces includes a non-dedicated communication port for communicating data to and form external data systems or clients based on a rule base.

System and method for mirroring data

One or more parameters of a received data service request may be compared against a lookup table. Based on one or more priority values stored in the lookup table and associated with the one or more request parameters, the data service request may be assigned a priority level.

System, method, and circuit for servicing a client data service request

Disclosed is a data processing and/or storage system. The data processing and/or storage system may include at least two interfaces, wherein each of the at least two interfaces includes a non-dedicated communication port for communicating data to and form external data systems or clients based on a rule base.

A method for data distribution, including distributing logical addresses among an initial set of devices so as provide balanced access, and transferring the data to the devices in accordance with the logical addresses. If a device is added to the initial set, forming an extended set, the logical addresses are redistributed among the extended set so as to cause some logical addresses to be transferred from the devices in the initial set to the additional device. There is substantially no transfer of the logical addresses among the initial set. If a surplus device is removed from the initial set, forming a depleted set, the logical addresses of the surplus device are redistributed among the depleted set. There is substantially no transfer of the logical addresses among the depleted set. In both cases the balanced access is maintained.

Data allocation in a distributed storage system

A method for data mirroring including receiving a sequence of transactions at a first storage node from a host indicating data to be stored by the node, storing the data therein, and delineating a first batch of the transactions. The node returns to the host an acknowledgment of having stored the data, delineates a second batch of the transactions received subsequent to the acknowledgment, and conveys the data to a second storage node. The first node also conveys to the second node a first record of the transactions in the first batch and a second record of the transactions in the second batch, and the data are stored in the second node responsively to the first and second records, so that all data indicated by the transactions in the first batch are stored by the second node prior to storing data indicated by the transactions in the second batch.

Parallel asynchronous order-preserving transaction processing

A method for operating a storage system, consisting of performing an allocation of respective partitions of a physical storage resource of the storage system to respective hosts of the storage system. The method also includes changing the allocation while permitting the respective hosts of the storage system to access the physical storage resource.

Systems and methods for temporarily transferring use of portions of partitioned memory between host computers

A method for data distribution, including distributing logical addresses among an initial set of devices so as provide balanced access, and transferring the data to the devices in accordance with the logical addresses. If a device is added to the initial set, forming an extended set, the logical addresses are redistributed among the extended set so as to cause some logical addresses to be transferred from the devices in the initial set to the additional device. There is substantially no transfer of the logical addresses among the initial set. If a surplus device is removed from the initial set, forming a depleted set, the logical addresses oldie surplus device are redistributed among the depleted set. There is substantially no transfer of the logical addresses among the depleted set. In both cases the balanced access is maintained.

A system, method and circuit for efficiently managing a cache storage device. A cache storage device may include a cache management module. The cache management module may be adapted to generate a management unit and to associate the management unit with new data that is to be written into the cache. The cache management module may be further adapted to assign two or more allocation units for each management unit, to store the new data in the cache. A cache management module may include a management unit module. The management unit module may be adapted to generate management units associated with predefined global cache management functions. The cache management module may further include an allocation unit module in communication with the management unit module. The allocation unit module may be adapted to assign allocation units for storing data written into the cache.

Method, system and circuit for efficiently managing a cache storage device

Upon receiving a request for one or a set of data blocks associated with a given data segment, a disk cache controller may retrieve into cache the some part of the entire data segment from a disk. Each data segment on a disk may include a fixed number of data blocks, and all data segments may include the same number of data blocks. Data segments may be dynamically defined and their locations and sizes may vary from segment to segment. Data segments may be defined when data is written to the disk, or may be defined at a later point. A table associated with a cache controller may store information as to the physical location or address on a disk of the starting point and/or size of each data segment.

Growing community of inventors

Tel Aviv, Israel

Dror Cohen