International Business Machines Corporation

Gregory Bret Sorkin

Jeffrey Owen Kephart

David Michael Chess

Steve Richard White

William Carlisle Arnold

Gerald James Tesauro

Steven Richard White

Myron Dale Flickner

Jehoshua Bruck

Charles Edwin Cox

Joseph W Wells

Baruch M Schieber

David Paul Williamson

Mark O Carey, Iii

Geraldine M Preston

Mariusz A Fus

Alexandre Guy Morin

A method of optimizing a manufacturing operation includes receiving as input data a description of a plurality of desired results of the operation, receiving as input data capabilities of a machine to accomplish the operation, determining an operation space including of a set of operations sufficient to accomplish all of the plurality of desired results using the machine capabilities, categorizing the operation space into groups, each group corresponding to one of the plurality of desired results, wherein any operation in the group sufficing to accomplish the corresponding one result, selecting a subset of the operation space, the subset comprising at least one representative from each of the groups, thereby making it sufficient to accomplish all of the plurality of desired results, and determining a short way to sequence the operations from the selected subset.

Punch and die optimization

A method of constructing data classifiers in cases where the number of features is much larger than the number of training examples and it is critical to avoid overtraining, is particularly useful in recognizing computer objects containing or likely to contain a computer virus. The method provides a novel way of tolerating imperfectly classifiable data, of learning in time polynomial in the size of the input data, and of avoiding overtraining. Training is performed by constructing and solving a linear program (LP) or integer program (IP).

Method of constructing data classifiers and classifiers constructed according to the method

A system and a method is disclosed for scheduling mobile agents. The system includes a dispatcher and at least one data processor that embodies a scheduling engine. A transceiver is coupled to the dispatcher for performing two-way communication with mobile agents through mobile agent transceivers. The dispatcher is responsive to a reception of a message or signal that is transmitted from a mobile agent for entering the received signal into the scheduling engine. The scheduling engine is responsive to an occurrence of a triggering event and to signals received from mobile agents for recomputing a schedule of activities for a plurality of the mobile agents, and for causing information descriptive of the recomputed schedule to be selectively transmitted to none, one, or more than one of the mobile agents through the transceiver. The two-way communication can use radio devices capable of entering and displaying text messages. A signal transmitted from the mobile agent may include information for specifying, by example, that the mobile agent has arrived at the location of a next scheduled activity; or that the mobile agent has completed a scheduled activity; or that the mobile agent has failed to complete a scheduled activity; or that the mobile agent is extending a duration of a currently scheduled activity beyond the time scheduled for the termination of the current activity; or that the mobile agent lacks one or more resources needed to complete a current activity; or that the mobile agent lacks one or more skills needed to complete the current activity.

Method and apparatus for scheduling mobile agents utilizing rapid two-way communication

A system for continuous monitoring and autonomous detection of patterns in the main memory subsystem of a computer system. The invention can be embodied as an extension to existing memory scrubbing hardware to permit stored code pattern analysis and identification during the autonomous transparent memory scrubbing process. A library of stored target signatures is provided to which code signatures are compared during analysis. Code signatures may be derived directly from the memory subsystem data pattern or may be indirectly and more efficiently derived from the error correction code (ECC) string associated with the stored data pattern. This invention is directly applicable to computer virus detection and neutralization systems.

Autonomous system for recognition of patterns formed by stored data during computer memory scrubbing

The present invention concerns a method and system for protection against corruption of data. In order to backup files to be stored in a storage medium, a set of redundant parity symbols is computed by encoding cross-sections across said files using a systematic code. These parity symbols and the files are then stored for later retrieval. If some of these files are erased, corrupted, damaged or infected by a virus, they are reconstructed by decoding the surviving files and the parity symbols.

Coding scheme for file backup and systems based thereon

The present invention provides a method of reducing the amount of memory required to scan a given data string for the presence of computer viruses or other data traits of interest including the steps of 1) loading into a memory of a computer a set of generic features that are functionally similar to standard computer virus signatures, but tend to be less specific to particular viruses, 2) locating occurrences of the generic features within the data string, 3) applying a first mapping from the occurrences located during step 2) to obtain a subset of standard signatures, 4) loading the subset of standard signatures into a memory of said computer, 5) locating occurrences within the data string of all signatures from the subset of standard signatures, and 6) applying a second mapping from the occurrences located during step 5) to identify a set of computer viruses that are likely to be present in the data string.

Efficient detection of computer viruses and other data traits

A data string is a sequence of atomic units of data that represent information. In the context of computer data, examples of data strings include executable programs, data files, and boot records consisting of sequences of bytes, or text files consisting of sequences of bytes or characters. The invention solves the problem of automatically constructing a classifier of data strings, i.e., constructing a classifier which, given a string, determines which of two or more class labels should be assigned to it. From a set of (string, class-label) pairs, this invention provides an automated technique for extracting features of data strings that are relevant to the classification decision, and an automated technique for developing a classifier which uses those features to classify correctly the data strings in the original examples and, with high accuracy, classify correctly novel data strings not contained in the example set. The classifier is developed using 'adaptive' or 'learning' techniques from the domain of statistical regression and classification, such as, e.g., multi-layer neural networks. As an example, the technique can be applied to the task of distinguishing files or boot records that are infected by computer viruses from files or boot records that are not infected.

Method and apparatus for detecting a presence of a computer virus

A system and method for verifying the integrity of a computer system's BIOS programs stored in alterable read only memory (such as FLASH ROM), and preventing malicious alteration thereof. The system and method regularly check the contents of the alterable read only memory using a digital signature encrypted by means of an asymmetrical key cryptosystem.

System and method for protecting integrity of alterable ROM using

Adaptive statistical regression and classification of data strings, with

A method for restoring a computer program infected with a computer virus to its non-viral condition. The method uses certain information about an uninfected host program recorded prior to infection without relying upon pre-existing knowledge of the computer virus. The method includes: recording a checksum of the uninfected original program, the length of the program, and information pertaining to bytes located near the beginning and end of the original program; and, subsequent to any modification of the original program that is deemed suspicious, generating one or more trial reconstructions based on the recorded information and information contained in the modified file; comparing a checksum of each generated trial reconstruction with the checksum of the original program stored in the database; and outputting a trial reconstruction as the original uninfected program if its checksum matches that of the original program.

Generic disinfection of programs infected with a computer virus

Information pertaining to the verification of the identity of, and reversal of, a transformation of computer data is derived automatically based on a set of samples. The most important class of transformations is computer viruses. The process extracts this information for a large, fairly general class of viruses. Samples consisting of host programs infected with the virus and sample pairs consisting of an infected host and the corresponding original, uninfected host are obtained. A description of how the virus attaches to the host program, including locations within uninfected host of components of both the original host and the virus is generated. Viral code is matched across samples to obtain a description of 'invariant' regions of the virus. Host bytes embedded within the virus are located. A description of the original host locations permits ant-virus software on a user's machine to restore the bulk of a program that has been infected. Characterization of the correspondence between invariable portions of the virus and destroyed parts of the host enables anti-virus software to complete the repair.

Automatic analysis of a computer virus structure and means of attachment

A searching method determines, given a specified encryption method (or set of encryption methods) and a specified pattern (or set of patterns), whether a given text contains an encryption, with any key, of anything fitting the pattern or patterns. The procedure detects and locates patterns that are present within data that has been encrypted, provided that the encryption method is one of a variety of simple methods that are often employed by computer programs such as computer viruses. The method includes:

Growing community of inventors

New York, NY, United States of America

Gregory Bret Sorkin