International Business Machines Corporation

King Abdullah University of Science and Technology

Hani Talal Jamjoom

Zon-Yin Shae

Daniel J Williams

Mark Edward Podlaseck

Huiming Qu

Shriram Rajagopalan

Anshul Sheopuri

Yaoping Ruan

Dinesh Kumar

Zhongshu Gu

Debanjan Saha

Justin Gregory Manweiler

Justin David Weisz

David M Lubensky

Nikolaos Anerousis

Arjun Natarajan

Xiaokui Shu

Michael Vu Le

Chen Feng

Gennaro A Cuomo

Fan Jing Meng

Liangzhao Zeng

Jim Alain Laredo

Eran Raichstein

Ying Huang

Kun Bai

Katherine Barabash

John Erik Wittern

Hanghang Tong

Pu Jin

Yun-Wu Huang

David Leslie Cohn

Anna Levin

Tengfei Ma

Yaniv Ben-Itzhak

Kamal Kumar Bhattacharya

Michael Montinarelli

Xiao Cai

Sambit Sahu

Kang-Won Lee

Ian M Molloy

Marc Philippe Stoecklin

Roger C Raphael

Rajesh M Desai

Raymond Byars Jennings, Iii

Milton H Hernandez

Franck Vinh Le

Petros Zerfos

Thai Franck Le

Anni Rosa Coden

Shu Tao

Aliza Rivka Heching

Ramendra K Sahoo

Abhijit Bose

Katherine Vogt

Parviz Kermani

Iun Veng Leong

Sreeram Ramakrishnan

Yew-Huey Liu

Qiushi Wu

Md Salman Ahmed

Uttama Shakya

Denis R Saure

Viktor Heorhiadi

Mahmoud A Abdelhamid Mohamed

Monther Abdullah Al-Dawsari

Denis Roland Saure

Vlivek V Shrivastava

Hoda Parvin

Yun Mao

Ian Michael Molloy

Mechanisms are provided to implement a neural flow attestation engine and perform computer model execution integrity verification based on neural flows. Input data is input to a trained computer model that includes a plurality of layers of neurons. The neural flow attestation engine records, for a set of input data instances in the input data, an output class generated by the trained computer model and a neural flow through the plurality of layers of neurons to thereby generate recorded neural flows. The trained computer model is deployed to a computing platform, and the neural flow attestation engine verifies the execution integrity of the deployed trained computer model based on a runtime neural flow of the deployed trained computer model and the recorded neural flows.

Neural flow attestation

A method, apparatus and computer program product for scheduling placement of containers in association with a set of hosts. The technique utilizes metrics that characterize container-specific risks. A first metric is a host interface risk for a container that quantifies how similar or dissimilar the container is relative to other containers running on a host. Preferably, host interface risk is derived with respect to a system call interface comprising a set of system calls, and the metric is based at least in part on a measure of dissimilarity among system calls. A second metric is a data sensitivity score that quantifies a degree to which sensitive data accesses are associated to the container. Based at least in part on the host interface risk scores and the data sensitivity scores, one or more containers are automatically scheduled for placement on the set of hosts to minimize security risk for the set of hosts.

Security risk-aware scheduling on container-based clouds

Indirect function call target identification in software is provided. A set of explicit data flows that pass a function address between software modules of a program is determined using an explicit data dependency analysis. A set of indirect function call targets is generated from results of the explicit data dependency analysis and a dynamic execution analysis of the program. The set of indirect function call targets is expanded by identifying similar target functions based on feature embeddings generated by a graph neural network.

Indirect function call target identification in software

An approach is provided that, after receiving a request to execute a computer program, determines an active set of metadata that corresponds to the requested computer program and then loads basic blocks of the requested computer program into memory. One of the loaded basic blocks is a starting block of the requested computer program. The memory also stores basic blocks corresponding to some previously loaded computer programs. The approach also inactivates basic blocks that are currently stored in the memory, with the inactivated basic blocks being identified based on a comparison of the active set of metadata to the sets of metadata that corresponding to the basic blocks of previously loaded computer programs. After inactivating some basic blocks, the approach executes the starting block of the requested computer program.

Inactivating basic blocks of program code to prevent code reuse attacks

Mechanisms for identifying a pattern of computing resource activity of interest, in activity data characterizing activities of computer system elements, are provided. A temporal graph of the activity data is generated and a filter is applied to the temporal graph to generate one or more first vector representations, each characterizing nodes and edges within a moving window defined by the filter. The filter is applied to a pattern graph representing a pattern of entities and events indicative of the pattern of interest, to generate a second vector representation. The second vector representation is compared to the one or more first vector representations to identify one or more nearby vectors, and one or more corresponding subgraph instances are output to an intelligence console computing system as inexact matches of the temporal graph.

Fuzzy cyber detection pattern matching

Adversarial input detection and purification (AIDAP) preprocessor and deep learning computer model mechanisms are provided. The deep learning computer model receives input data and processes it to generate a first pass output that is output to the AIDAP preprocessor. The AIDAP preprocessor determines a discriminative region of the input data based on the first pass output and transforms a subset of elements in the discriminative region to modify a characteristic of the elements and generate a transformed input data. The deep learning computer model processes the transformed input data to generate a second pass output that is output to the AIDAP preprocessor which detects an adversarial input or not based on a comparison of the first pass and second pass outputs. If an adversarial input is detected, a responsive action that mitigates effects of the adversarial input is performed.

Detecting and purifying adversarial inputs in deep learning computing systems

Reducing attack surface by selectively collocating applications on host computers is provided. System resources utilized by each application running in a plurality of host computers of a data processing environment are measured. Which applications running in the plurality of host computers that utilize similar system resources are determined. Those applications utilizing similar system resources are collocated on respective host computers.

Reducing attack surface by selectively collocating applications on host computers

Serving data assets based on security policies is provided. A request to access an asset received from a user having a particular context is evaluated based on a set of asset access enforcement policies. An asset access policy enforcement decision is generated based on evaluating the request. It is determined whether the asset access policy enforcement decision is to transform particular data of the asset prior to allowing access. In response to determining that the asset access policy enforcement decision is to transform the particular data of the asset prior to allowing access, a transformation specification that includes an ordered subset of unit transformations for transforming the particular data of the asset is generated based on the particular context of the user and the set of asset access enforcement policies. A transformed asset is generated by applying the transformation specification to the asset transforming the particular data of the asset.

Serving data assets based on security policies by applying space-time optimized inline data transformations

For multipathing using a network of overlays, a set of virtual network interfaces (VNICs) corresponding to a physical network interface (PNIC) is created in a first data processing system. A first virtual network interface (VNIC) from the set of VNICs is bound to a virtual machine (VM) executing in a first data processing environment across a data network from the first data processing system. During a data communication with a second data processing system, data is divided into a first portion and a second portion, the first portion using a first path from the first VNIC to the first VM to the second data processing system, and the second portion using a second path from the PNIC to the second data processing system.

Multipathing using a network of overlays

Systems and methods for capturing images of a target area that include controlling an image sensor mounted to a gimbal to capture images of the target area over time and controlling the gimbal using an elevator algorithm to adjust the orientation of the image sensor.

3D surface estimation and prediction to boost fidelity of realtime LiDAR model generation

A computing system includes a plurality of physical hosts; a first application of a first tenant and a second application of a second tenant distributed over the plurality of physical hosts; and a plurality of virtual switches with a plurality of ports, each switch associated with a corresponding one of the physical hosts. A first virtual network couples the plurality of first application components and a second virtual network, isolated from the first virtual network, couples the plurality of second application components. A cloud management dashboard coupled to a software defined network controller is configured to receive an application performance monitoring request from a tenant and instruct the software defined network controller to turn on port mirroring on at least a portion of those of the plurality of ports corresponding to the application of the requesting tenant, to mirror corresponding packets to a packet data repository.

Providing agentless application performance monitoring (APM) to tenant applications by leveraging software-defined networking (SDN)

From a hardware sensor at a first time, sensor data comprising a first sample and a second sample is received. The sensor data is modified to create new data, wherein a first data point of the new data corresponds to the first sample, a second data point of the new data corresponds to the second sample, and wherein the first data point and the second data point are arranged differently from the first sample and the second sample. The hardware sensor is emulated by sending, to a consumer of hardware sensor data at a second time, the new data instead of the sensor data.

Sensor data manipulation using emulation

A database comprises historical information of a user's response to previous notifications. The database is accessed to determine a time at which to provide a (new) notification to the user, utilizing at least: a) current user activity status (e.g., determined from measurement information collected from one or more personal devices and/or user calendar events; b) time/day; and c) context information about the notification (e.g., geo-location, indoors/outdoors) including notification type (e.g., calendar entry, email, IM). The user gets the notification via a portable device at the determined time. A machine learning model can select the determined time by discriminating features of the previous notifications for which the user immediately attended versus those that were deferred and/or ignored. Content of the notification can also be altered in view of such discriminating features so as to increase a likelihood the user will immediately attend to the provided notification.

Predicting user attentiveness to electronic notifications

An embodiment includes a method for autonomous healing of an application comprising a plurality of microservices. The method comprises the steps of detecting a performance degradation of at least a portion of the application; and responsive to detecting the performance degradation, downgrading at least one of the plurality of microservices within the application. The downgrading comprises deploying a prior version of the at least one of the plurality of microservices; and routing at least a portion of traffic to the prior version instead of a current version of the at least one of the plurality of microservices.

Autonomously healing microservice-based applications

Growing community of inventors

Cos Cob, CT, United States of America

Hani Talal Jamjoom