International Business Machines Corporation

Gary I Givental

Aankur Bhatia

Kaleb Dean Walton

Srinivas Babu Tummalapenta

HuyAnh Dinh Ngo

Sharon Hagi

David M McMillen

Wesley A Khademi

Nicholas W Bradley

Michael John Suzio

Daniel E Chapman, Ii

Adam Lee Griffin

Lu An

Paul J Dwyer

Thomas S Wallace

Kyle Proctor

Chadwick M Baatz

Rafal Hajduk

John D Kuhn

Joel Rajakumar

An enhanced threat disposition analysis technique is provided. In response to receipt of a security threat identified in an alert, a threat disposition score (TDS) is retrieved. The TDS is generated from a machine learning scoring model that is built from information about historical security threats, including historical disposition of one or more alerts associated with the historical security threats. The TDS is based in part on an effectiveness of a prior calculated TDS to predict a particular historical disposition associated with the alert. The system augments an alert to include the threat disposition score, optionally together with a confidence level, to generate an enriched alert. The enriched alert is then presented to the security analyst for handling directly. Preferably, the machine learning model is updated continuously as the system handles security threats, thereby increasing the predictive benefit of the TDS scoring.

Threat disposition analysis and modeling using supervised machine learning

An enhanced threat disposition analysis technique is provided. In response to receipt of a security threat, a threat disposition score (TDS) is retrieved. The threat disposition score is generated from a machine learning scoring model that is built from information about historical security threats, including historical disposition of one or more alerts associated with the historical security threats. The system augments an alert to include the threat disposition score, optionally together with a confidence level, to generate an enriched alert. The enriched alert is then presented to the security analyst for handling directly. Depending on the TDS (and its confidence level), the analyst may be able to respond to the threat immediately, i.e., without further detailed investigation. Preferably, the machine learning model is updated continuously as the system handles security threats, thereby increasing the predictive benefit of the TDS scoring.

An example operation may include one or more of receiving storage requests endorsed by blockchain peers of a blockchain, selecting a group of the endorsed storage requests to be stored together and ordering the group of endorsed storage requests with respect to each other based on timestamps, encoding the group of ordered and endorsed storage requests into an image, and storing the encoded image within a data section of a block of the blockchain.

Image encoding for blockchain

A method, a computer program product, and a system for performing a of threat similarity analysis for automated action on security alerts. The method includes receiving, by a threat similarity analysis system, a security alert relating to a security from a threat disposition system within an environment, performing, by the threat similarity analysis system, a similarity analysis on the security alert using a machine learning model. The similarity analysis compares the security alert with previous security alerts within a time window. The threat similarity analysis system can apply a cosine similarity analysis to perform the similarity analysis. The method also includes determining, based on the similarity analysis, the security alert matches at least one previous security alert from the previous security alerts within a predetermined degree, and associating the security alert into a same security incident as the previous security alert determined by similarity analysis.

Similarity analysis for automated disposition of security alerts

A machine learning model selector is provided. A set of machine learning (ML) models are trained based on a first training dataset. The set of trained ML model is executed on a second training dataset to generate a corresponding output for a set of data instances in the second training dataset. For each data instance in the set of data instances, a corresponding ranking of ML models is generated based on the corresponding output for the data instance generated by the set of ML models. A ML model selector is trained based on the data instances in the set of data instances and the corresponding ranking of ML models, to select a trained ML model based on an input data instance.

Dynamic machine learning model selection

Mechanisms are provided to implement an ensemble of unsupervised machine learning (ML) models. The ensemble of unsupervised ML models processes a portion of input data to generate an ensemble output and the ensemble output is output to an authorized user computing device to obtain user feedback from the authorized user via the user computing device. The user feedback indicates a correctness of the ensemble output. The mechanisms modify at least one feature of the ensemble of unsupervised ML models based on the obtained user feedback to thereby generate a modified ensemble of unsupervised ML models. Subsequent portions of input data are then processed using the modified ensemble of unsupervised ML models.

Modification of machine learning model ensembles based on user feedback

Mechanisms are provided to implement a hybrid machine learning (ML) anomaly detector comprising an ensemble of unsupervised ML models and a semi-supervised ML model. The ensemble of unsupervised ML models are executed on log data to generate, for each entry in the log data, a predicted anomaly score and corresponding anomaly classification label of the entry. A partially labeled dataset is generated based on a selected subset of entries and other unlabeled log data in the log data. A similarity analysis of the unlabeled log data with entries in the selected subset of entries is performed and anomaly classification labels of the selected subset of entries are propagated to the other unlabeled log data based on the similarity analysis.

Hybrid machine learning to detect anomalies

A method identifies and prioritizes anomalies in received monitoring logs from an endpoint log source. One or more processors identify anomalies in the monitoring logs by applying a plurality of disparate types of anomaly detection algorithms to the monitoring logs, and then determine a likelihood that the identified anomalies are anomalous based on outputs of the plurality of disparate types of anomaly detection algorithms. The processor(s) then prioritize the monitoring logs based on the likelihood that the identified anomalies are actually anomalous, and send prioritized monitoring logs that exceed a priority level to a security information and event management system (SIEM).

Detecting and responding to an anomaly in an event log

An example operation may include one or more of retrieving a predefined image from a storage, encoding data attributes to be stored on a blockchain into one or more image layers of the predefined image to generate an encoded image, generating a data block comprising the encoded image including the data attributes which are encoded into the one or more image layers, and storing the data block via a hash-linked chain of data blocks on a distributed ledger.

Multi-layered image encoding for data block

An anomaly detection system configured to generate a plurality of tensors based on spatial attributes of a set of cybersecurity data and temporal attributes of the set of cybersecurity data. The set of cybersecurity data comprising numeric data and textual data collected from a plurality of computational sources. The anomaly detection system can provide the plurality of tensors to a Hierarchical Temporal Memory (HTM) network. The HTM network can be configured to generate respective HTM outputs for respective regions of the HTM network. The anomaly detection system can determine that at least one HTM output indicates an anomaly, convert the at least one HTM output to a notification, and provide the notification to a user interface.

Anomaly detection using cognitive computing

Mechanisms are provided to implement an image based event classification engine having an event image encoder and a first neural network computer model. The event image encoder receives an event data structure comprising a plurality of event attributes, where the event data structure represents an event occurring in association with a computing resource. The event image encoder executes, for each event attribute, a corresponding event attribute encoder that encodes the event attribute as a pixel pattern in a predetermined grid of pixels, corresponding to the event attribute, of an event image. The event image is into to a neural network computer model which applies one or more image feature extraction operations and image feature analysis algorithms to the event image to generate a classification prediction classifying the event into one of a plurality of predefined classifications and outputs the classification prediction.

Advanced image recognition for threat disposition scoring

Eye tracking for the purpose of detecting attendee disengagement with respect to a presentation including a visual display communicated over a network. The eye tracking method includes: during a play of the presentation, tracking eye positions of a set of control party(ies); during a play of the presentation, tracking eye positions of a set of non-control party(ies); determining a set of divergence value(s) corresponding to divergence between the eye position(s) of the control party(ies) and the non-control party(ies); and determining a disengagement value corresponding to relative disengagement of the non-control party(ies) based, at least in part on the set of divergence value(s).

Utilizing eye tracking to determine attendee engagement

An approach is provided for determining a likelihood of an attack on a first computer system of a first business. Characteristics are determined for target businesses having target computer systems currently or recently under attack by an entity whose Internet Protocol (IP) address was selected from a list of suspicious IP addresses. Percentages associated with the characteristics are determined. Each percentage indicates a percentage of the target businesses whose associated characteristic matches a corresponding characteristic of the first business. A score is incremented by an amount for each of the percentages that exceeds an associated threshold. The score is incremented by twice the amount if the IP address matches an address of a source or destination of traffic through a security device in the first computer system. A recommendation to change a security policy for the first computer system is generated if the score exceeds twice the predetermined amount.

Growing community of inventors

Bloomfield Hills, MI, United States of America

Gary I Givental