International Business Machines Corporation

Eitan Menahem

Andrey Finkelshtein

Bar Haim

Alexandra Shulman-Peleg

Ayman Jarrous

Noga Agmon

Yehonatan Bitton

Anton Puzanov

Oded Margalit

Aviv Ron

Itay Hazan

Yuval Margalit

Eitan Chertok

Romy Varga

Gal Steimberg

Sarit Hollander

A system and a method for training and classification using an optimized classification schema using an ensemble of cascaded classifiers is disclosed. Each of the cascaded classifiers is characterized by a set of classifier parameters and the classifiers which are not the first in a cascade are associated with one or more thresholds used to determine when to execute them according to a confidence measure computed by a preceding cascaded classifier. The optimization comprises a genetic algorithm applied to a set of ensembles of classification and parameters and the set of scores, into a pool of ensembles and associated scores. The scores may be based on associated classification quality and cost.

Optimizing cascade of classifiers schema using genetic search

Described are techniques for automated labeling of cybersecurity incidents. The techniques include generating a set of labels for a received cybersecurity incident based on features of the received cybersecurity incident. The techniques further include prioritizing the set of labels to generate a subset of labels, and associating the subset of labels to the received cybersecurity incident.

Label recommendation for cybersecurity content

An example system includes a processor to receive mouse event data of a session. The processor is to split the mouse event data of the session into mouse event n-grams. The processor is to extract features from the mouse event n-grams. The processor is to send the extracted features to a trained machine learning model. The processor is to receive an output decision from the trained machine learning model.

Machine learning model trained using features extracted from n-grams of mouse event data

A cyber security method including: obtaining user flow data associated with a browsing session at a website; constructing a directed graph representative of the browsing session; computing a set of features for the directed graph; and applying a machine learning classifier to the set of features, to classify the browsing session as legitimate or fraudulent.

User flow graph analytics for cyber security

A machine learning clustering process is trained. Web pages of a website are clustered. User flow data associated with a first browsing session at the website is obtained. The user flow data includes a plurality of web page identifiers (e.g., URLs). A web page record for each of the web page identifiers is generated. Each web page record includes words of the corresponding web page identifier. Clusters of web page identifiers previously output from the trained machine learning clustering process are received. For each of the web page records, a cluster of web page identifiers is identified by mapping the web page record to one of the clusters of web page identifiers using the machine learning clustering process. A directed graph representative of the first browsing session is constructed. One or more nodes of the directed graph are the identified clusters of web page identifiers.

Clustering web page addresses for website analysis

Automated detection of personal information in free text, which includes: automatically applying a named-entity recognition (NER) algorithm to a digital text document, to detect named entities appearing in the digital text document, wherein the named entities are selected from the group consisting of: at least one person-type entity, and at least one non-person-type entity; automatically detecting at least one relation between the named entities, by applying a parts-of-speech (POS) tagging algorithm and a dependency parsing algorithm to sentences of the digital text document which contain the detected named entities; automatically estimating whether the at least one relation between the named entities is indicative of personal information; and automatically issuing a notification of a result of the estimation.

Automated detection of personal information in free text

A method for training thresholds controlling data flow in a plurality of cascaded classifiers for classifying malicious software, comprising: in each of a plurality of iterations: computing a set of scores, each for one of a set of threshold sequences, each threshold sequence is a sequence of sets of classifier output thresholds, each set of classifier output thresholds used to control a flow of data from a first cascaded classifier of the plurality of cascaded classifiers to a second cascaded classifier of the plurality of cascaded classifiers, each score computed when classifying, using the respective threshold sequence, each of a plurality of software objects as one of a set of maliciousness classes; computing a set of new threshold sequences by applying a genetic algorithm to the set of threshold sequences and the set of scores; and using the set of new threshold sequences in a consecutive iteration.

System and method for staged ensemble classification

A method for quantifying a similarity between a target dataset and multiple source datasets and identifying one or more source datasets that are most similar to the target dataset is provided. The method includes receiving, at a computing system, source datasets relating to a source domain and a target dataset relating to a target domain of interest. Each dataset is arranged in a tabular format including columns and rows, and the source datasets and the target dataset include a same feature space. The method also includes pre-processing, via a processor of the computing system, each source-target dataset pair to remove non-intersecting columns. The method further includes calculating at least two of a dataset similarity score, a row similarity score, and a column similarity score for each source-target dataset pair, and summarizing the calculated similarity scores to identify one or more source datasets that are most similar to the target dataset.

Identifying source datasets that fit a transfer learning process for a target domain

A method, computer program product and computer system are provided. A processor retrieves a target file for inspection of malware. A processor converts the target file to a time domain format. A processor determines one or more time-frequency domain features of the converted target file. A processor generates a malicious classification for the target file based on the one or more time-frequency domain features of the converted target file and one or more classification models.

Time and frequency domain analysis of bytecode for malware detection

A keystroke dynamics anonymization technique that includes: receiving a plain-text password from a computer user; providing at least the plain-text password as a seed to a pseudorandom mapping function; applying the pseudorandom mapping function to keycodes that are produced by the computer responsive to keystrokes of the computer user, to map the keycodes to a set of mapped, anonymized keycodes; and providing the set of mapped, anonymized keycodes to a keystroke dynamics algorithm, to enable the keystroke dynamics algorithm to (a) learn a keystroke dynamics model of the computer user, and (b) authenticate an identity of the computer user.

Keystroke dynamics anonimization

A system for training a file classification model for classifying malicious software comprising at least one hardware processor adapted to: computing a plurality of datasets, each for one of a plurality of executable files, each file having a label, each dataset is computed by: receiving a respective file; detecting a plurality of binary functions in the respective file; translating each of the respective plurality of binary functions to produce a plurality of disassembled functions; clustering a plurality of operation-codes identified in the plurality of disassembled functions into a plurality of clusters according to respective operation-code; computing a plurality of statistical values of the plurality of disassembled functions and the plurality of clusters; and associating the plurality of statistical values with the file's label to produce a dataset; and training a file classification model using the plurality of datasets to compute at least one classification score of an input file.

System and method for machine based detection of a malicious executable file

Embodiments of the present systems and methods may decide if a software file is malicious or benign, using properties of the file's overlay, if existing. For example, in an embodiment, a computer-implemented method for identifying malware in computer systems may comprise receiving a plurality of executable files labeled as being malicious or benign, training a machine learning model using properties extracted from overlays associated with each of the plurality of received labeled executable files, receiving an executable file that is not labeled, determining whether the received unlabeled executable file is malicious or benign using the trained machine learning model based on properties extracted from an overlay associated with the received unlabeled executable file, and transmitting information identifying the received unlabeled executable file as malicious when the received unlabeled executable file is determined to be malicious.

Detecting malicious executable files by performing static analysis on executable files' overlay

Challenging a current user of a computing device by measuring characteristics of user actions sensed by a computing device, determining that the measurements meet a uniqueness condition with respect to corresponding measurements in a comparison set of actions, recording the user actions and their measurements in a set of challenge actions associated with an authorized user, and responsive to a challenge requirement to determine whether a current user of the computing device is the authorized user, selecting challenge actions associated with an authorized user, prompting the current user to perform the selected challenge actions that are then sensed by the computing device, measuring characteristics of the prompted actions, and determining that the measurements of the characteristics of the prompted actions meet a similarity condition with respect to measurements of corresponding characteristics of the selected challenge actions.

Challenge generation for verifying users of computing devices

Embodiments of the present invention may involve identifying a user of a touchscreen device. A touchscreen device may receive a user input. One or more features of the user input on the touchscreen device may be identified. The one or more features of the user input may include, for example, geometric patterns, swiping motifs, a pressure, a spatial orientation, or any combination thereof. A user profile comprising the one or more features of the user input may be generated. The touchscreen device may receive a second input from an unknown user. A statistical evaluation may be performed comparing one or more features of the second input with one or more features of the user input in the user profile. A probability that the unknown user is the user may be determined. If a low probability is determined, the unknown user may be locked out of the touchscreen device.

Growing community of inventors

Beer Sheva, Israel

Eitan Menahem