International Business Machines Corporation

Other

Fady Copty

Tamer Salman

Dov Murik

Ayman Jarrous

Sharon Keidar Barner

Allon Adir

Dmitry Pidan

Omri Soceanu

Gadiel Auerbach

Viresh Paruthi

Lev Greenberg

Sharon Keidar-Barner

Ronen Levy

Benjamin Zeltser

Shripad Nadgowda

Karen Frida Yorav

Cynthia Rae Eisner

Gilad Ezov

Omer Y Boehm

Ayelet Avni

Shai Doron

Orit Edelstein

David J Levitt

Shiri Lemel

Maksim Shudrak

Reda Igbaria

Matan Danos

An approach to predicting the outcome of a computer security response. The approach can analyze an unlabeled set of network data and based on the analysis, create a language model of the network. The approach can process the language model to predict a reduction factor associated with network availability. The approach can further process the language model and a malicious sequence to predict an effectiveness factor associated with blocking the malicious sequence. The approach can output bot the reduction factor and the effectiveness factor to a network administrator for determining the applicability of the computer security response.

Predicting security response impact

Embodiments may provide techniques that may provide more accurate and actionable alerts by cloud workload security systems so as to improve overall cloud workload security. For example, in an embodiment, a method may be implemented in a computer system comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, and the method may comprise generating performance and security information relating to a software system during development of the software system, generating performance and security information relating to the software system during deployed operation of the software system, matching the performance and security information generated during development of the software system with the performance and security information generated during deployed operation of the software system to determine performance and security alerts to escalate, and reporting the escalated performance and security alerts.

Sharing insights between pre and post deployment to enhance cloud workload security

Embodiments may provide techniques that that may automatically generate a customized SOC rule set for an organization. For example, in an embodiment, a method may be implemented in a computer comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method may comprise simulating operation of a security incident and event management system by running a plurality of rules of the system on labeled data, determining fitness metrics of the plurality of rules, selecting at least one rule of the plurality of rules based on the determined fitness metrics; modifying the selected rule to form an updated rule, and repeating running the updated rule on the labeled data, determining fitness metrics of the updated rule, and mutating the updated rule.

Genetic fuzzing for customization of security operations center rules per organization

A method for automatically migrating infrastructure as code (IaC) from a first cloud infrastructure platform to a second cloud infrastructure platform is provided. The method may include receiving an original IaC comprising a first type of coding language. The method may further include using natural language processing to map a connection between the first type of coding language and a second type of coding language. The method may further include based on the mapped connection, using the NLP to automatically generate a partial translation of the first type of coding language to the second type of coding language. The method may further include using a machine learning algorithm to correct at least one inaccuracy in the partial translation. The method may further include generating a complete translation and implementing a second IaC on the second cloud infrastructure platform based on the complete translation.

Migrating infrastructure as code between different cloud providers

An example system includes a processor to receive a source code sample to be classified. The processor can execute a hybrid code analysis to generate an internal analysis state. The processor can extract features from the internal analysis state via a trained machine learning model modified using transfer learning. The processor can generate a label based on the extracted features via a machine learning classifier model trained on internal analysis states of hybrid code analyses.

Predicting code vulnerabilities using machine learning classifier models trained on internal analysis states

The present invention relates to novel techniques for monitoring changes to source code of Infrastructure as Code systems to detect attempted anomalous changes and block such changes from the code. For example, a method may comprise learning a security architecture and history of an infrastructure as code system to be deployed in at least one cloud account, monitoring changes to source code of the infrastructure as code system that are made before deployment of the infrastructure as code system to detect an anomaly, determining whether the detected anomaly affects regulated resources of the infrastructure as code system, and blocking changes to the source code of the infrastructure as code system that produce the detected anomaly that affects regulated resources of the infrastructure as code system.

User and entity behavior analytics of infrastructure as code in pre deployment of cloud infrastructure

An approach for detecting non-compliant methodologies in a repository. The approach can generate an abstract model of an Infrastructure as Code (IaC) repository based on security requirements of an IaC. The approach can compare the abstract model to one or more validated abstract models associated with other repositories of a hybrid multi-cloud system. The approach can generate an alert notifying the IaC repository of one or more non-compliant methodology measures. The approach can send the alert to the IaC repository.

Detecting infrastructure as code compliance inconsistency in a multi-hybrid-cloud environment

Deriving malware signatures by training a binary decision tree using known malware and benign software samples, each tree node representing a different software feature set and having one descending edge representing samples that are characterized by the node's software feature set and another descending edge representing samples that are not characterized thusly, selecting multiple continuous descending paths for multiple subsets of nodes, each path traversing a selected one of the edges descending from each of the nodes in its corresponding subset, deriving, based on the nodes and edges in any of the paths, a malware-associated software feature signature where the malware samples represented by leaves that directly or indirectly descend from an end of the continuous descending path meets a minimum percentage of the total number of samples represented by the leaves, and providing the malware signatures for use by a computer-based security tool configured to identify malware.

Automatic malware signature generation for threat detection systems

An apparatus, a computer program product and a method for dimensionality reduction comprising: obtaining a set of Application Programming Interface (API) functions of a system invocable by a program, and a set of artifacts. Each artifact is associated with at least one API function and indicative of a functionality thereof. The method further comprising: clustering the API functions based on an analysis of the artifacts to create a set of clusters smaller than the set of API functions, such that each cluster comprises API functions having a similar functionality; and performing a dimensionality reduction to a feature vector using the set of clusters.

Dimensionality reduction based on functionality

An apparatus, a computer program product and a method for co-verification of systems comprising software and hardware components. The method comprises obtaining an over-approximation of the system that over-approximates the software or the hardware by using a non-deterministic version thereof; performing simulation of the over-approximation of the system; and utilizing an outcome of the simulation to guide a co-simulation of the system. The co-simulation comprises instrumenting the software to identify whether the coverage goals are reached during execution, generating a test input for the system, simulating execution of the test input by the instrumented software, wherein during said simulating, stimuli provided from the instrumented software to underlying hardware is provided to a hardware simulator that is configured to simulate the hardware-under-test; determining a coverage of the execution of the test input, and utilizing the coverage information in a successive iteration of the method.

Co-verification of hardware and software

Embodiments of the present systems and methods may provide techniques that may provide unit-level test of an SUT, but which translates the unit-level test into a valid test of the SUT itself. For example, in an embodiment, a computer-implemented method for testing a system, the method may comprise analyzing the system to determine sub-components of the system and inputs to the sub-components, performing dynamic testing of the system and collecting pairs of inputs to the system and inputs to the sub-components, training a machine learning model to translate from inputs to the sub-components to inputs to the system input using the collected pairs of inputs to the system and inputs to the sub-components and performing sub-component level testing and translating the sub-component level testing to system level testing.

System level test generation using DNN translation from unit level test

A system, an apparatus, a computer program product and a method for obfuscation-based security and authentication. The method comprises: obtaining a different key for each different device; obfuscating an interface layer utilized by components of the device to interact, using the key, to produce an obfuscated interface layer; and providing, directly or indirectly, the two components with the key to allow the two components to utilize the obfuscated interface layer to interact with each other. The system comprises a plurality of devices that are instances of a same device and a server coupled to a memory retaining a plurality of keys, each of which is used to obfuscate interface layers of a different device to produce heterogeneous set of devices instead of a homogenous set of devices. Communications and operations with the plurality of devices are performed in an obfuscated manner through the server.

Interface layer obfuscation and usage thereof

In some examples, a system for authenticating users can include a processor to train a first predictive application based on a first set of user engagements with advertisements, wherein the first predictive application is associated with a first advertising identifier. The processor can also train a second predictive application based on a second set of user engagements with the advertisements, wherein the second predictive application is associated with a second advertising identifier. Additionally, the processor can compare the first predictive application and the second predictive application and authenticate a user in response to detecting a similarity of the first predictive application and the second predictive application is below a threshold value, wherein authenticating the user enables the user to access a resource or service.

Growing community of inventors

Nazareth, Israel

Fady Copty