International Business Machines Corporation

Crowdstrike, Inc.

Q1 Labs Inc.

Ibm Canada Limited - Ibm Canada Limitee

Iosif Viorel Onut

Paul Ionescu

Guy-Vincent Jourdan

Gregor Von Bochmann

Omer Tripp

Wayne Duncan Smith

Khalil A Ayoub

Seyed M Mir Taheri

Nevon C Brake

Mustafa Emre Dincturk

Ronald B Williams

Ori Segal

Obidul Islam

Qian Cui

Elizabeth Ann Holz

Joni E Saylor

Hyun Kyu Seo

Russell L Couturier

Michael Hanner

Eugenia Kondratova

Gil Mirmovitch

Suryakant Choudhary

Khalil Andrew Ayoub

Guy Podjarny

Jeffrey Charles Turnham

Jason David Keirstead

John Thomas Peyton, Jr

Douglass J Wilson

Mohammadreza Barouni Ebrahimi

Cheng-Ta Lee

Craig R Conboy

Hosam Aly

Kamara Akili Benjamin

Seyed Ali Moosavi Byooki

Ory Segal

William Alexander Bird

Aviv Ron

Shahar Sperling

Avishay Bartik

Andrii Sergeevich Iesiev

Ettore Merlo

Natalia Stakhanova

Aliakbar Ghorbani

Mattias Johansson

Julien Cassagne

Guy Jourdan

Seyed M Taheri

John Thomas Peyton

Jerome Simon Mathieu

Khalil Andres Ayoub

Nevon Christopher Brake

Seyed Ali Byooki

Sayed M Taheri

Mechanisms are provided to detect content generated from phishing attacks. The mechanisms process an electronic communication, received from a data network, to produce a structure token. The structure token represents a content structure of the electronic communication. The structure token is processed by a machine learning model, which is trained to identify content that is generated in response to one or more phishing attacks. The machine learning model produces a classification output that indicates whether the electronic communication includes content that was generated in response to the one or more phishing attacks.

Detection of content generated from phishing attacks

Aspects of the invention include techniques for correlating distinct phishing campaigns by identifying shared modus operandi. A non-limiting example method includes building, from a source code, an abstract syntax tree and building, from the abstract syntax tree, a decloaked abstract syntax tree. The method includes removing payload data from the decloaked abstract syntax tree to define an obfuscation pattern. The obfuscation pattern is compared to a plurality of predetermined obfuscation patterns. The method includes correlating, based on the comparison, the source code to one or more phishing kits.

Method of correlating distinct phishing campaigns by identifying shared modus operandi

Synchronizing requests with a respective context includes, responsive to a determination that there are more pages to explore, performing regular crawling operations for a current page, recording a current page in a list of explored pages and extracting links from the current page. Responsive to a determination that there are more links to extract, a next link to analyze is selected to form a selected link and responsive to a determination that there is a new request associated with the selected link, a new request identifier is created and saved as an entry in a hashmap. Responsive to a determination that there is not a new request associated with selected link, a request associated with the selected link is updated with a new link value when the link value differs.

Synchronizing HTTP requests with respective HTML context

A generated signal is injected into a first network node in a set of network nodes. The generated signal comprises a predetermined pattern, the predetermined pattern comprises a plurality of time periods, wherein during each time period in the plurality of time periods a first data traffic is prevented from exiting the first network node. By monitoring data flow within the set of network nodes while the generated signal is being injected, a correlation with the generated signal is detected, the correlation correlating a second network node with the first network node. The second network node is associated with the first network node. Responsive to the association, traffic from the second network node to the set of network nodes is blocked.

Signal based node relationship identification

Preliminary program analysis of an executable may be performed. A security vulnerability level of a portion of the executable may be determined based on the preliminary program analysis. The security vulnerability level of the portion may be compared to a security vulnerability threshold. The precision of runtime monitoring of the portion may be tuned based on the comparison.

Precision-tuned runtime monitoring

Mechanisms are provided to detect phishing exfiltration communications. The mechanisms receive an input electronic communication from a data network and process the input electronic communication to extract a structure token that represents the content structure of the input electronic communication. The structure token is input to a machine learning model that is trained to identify phishing exfiltration communication grammars, and relationships between phishing exfiltration communication grammars, in structure tokens. The machine learning model processes the structure token to generate a vector output indicating computed values for processing by classification logic. The classification logic processes the vector output from the machine learning model to classify the input electronic communication as either a phishing exfiltration communication or a non-phishing exfiltration communication, and outputs a corresponding classification output.

Detection of phishing campaigns based on deep learning network detection of phishing exfiltration communications

Embodiments include method, systems and computer program products for automatic detection of an incomplete static analysis security assessment. In some embodiments, a method includes obtaining component versioning data associated with a build of an application. The method further includes determining, using the component versioning data associated with the build of the application, that a static analysis security assessment configuration of the application is incomplete. The method further includes, responsive to determining that the static analysis security assessment configuration of the application is incomplete, generating metadata indicating that at least a portion of the build of the application has been changed from a previous build of the application.

Automatic detection of an incomplete static analysis security assessment

Embodiments provide a computer implemented method for detecting a phishing internet link, wherein an internet link is a Uniform Resource Locator (URL) or a domain name, the method including: receiving the internet link; replacing one or more visually confusing characters with one or more original characters, wherein the one or more visually confusing characters are similar to the one or more original characters; removing a top-level domain from the internet link; removing a common subdomain from the internet link; splitting the remaining internet link into a list of words; converting the list of words into a list of word vectors; calculating an average word vector of the list of word vectors; and providing a phishing score for the average vector, indicating a probability of the internet link being a phishing internet link.

Detection of phishing internet link

A computer-implemented method and/or computer program product selectively assigns a task using a hybrid task assignment process. One or more processors direct a working hardware node in a network to crawl a particular application, thus causing the working hardware node to encounter a task in the particular application. The processor(s) selectively handle the task according to whether the task is reserved for dynamic assignment to an other hardware node in the network, such that in response to a determination that the task encountered is not reserved, the task is handled by the working hardware node that is crawling the particular application, and in response to a determination that the task encountered is reserved, the task encountered is sent to a central unit for dynamic assignment to the other hardware node in the network.

Hybrid task assignment for web crawling

Countering phishing attacks by generating multiple synthetic victims, where each of the synthetic victims includes synthetic victim information that represents a computer user identity and includes associated sensitive information, where the computer user identity and its associated sensitive information are fictitious in that they are not known to be associated with a legitimate computer user, providing any of the synthetic victim information of the synthetic victims to a computer-hosted phishing site, storing the synthetic victim information in a computer-accessible database, receiving from a computer-hosted target site information provided to the computer-hosted target site by a requestor, identifying in the computer-accessible database database synthetic victim information matching the requestor information, and notifying the computer-hosted target site that the requestor information is of a synthetic victim.

Countering phishing attacks

A method for identifying client states, receives a set of paths representative of a document object model (DOM) associated with a web page of a rich internet application and for each path in the set of paths received, extracts a subtree, as subtree X, for a current path. The method traverses all known sub-paths under the current path and delete corresponding subtrees from subtree X and reads contents of and determines states of subtree X to form a state X. The state X is added to a set of current states and responsive to a determination no more paths exist, returns the set of current states of the rich internet application.

Identifying client states

An illustrative embodiment of a computer-implemented process for identifying a request invalidating a session excludes all marked logout requests of a Web application, crawls an identified next portion of the Web application and responsive to a determination, in one instance, that the state of the crawl is out of session, logs in to the Web application. The computer-implemented process further selects all crawl requests sent since a last time the crawl was in-session, excluding all marked logout requests and responsive to a determination that requests remain, crawls a selected next unprocessed request. Responsive to a determination, in the next instance, that state of the crawl is out of session and the selected request meets logout request criteria, the computer-implemented process marks the selected request as a logout request.

Identifying requests that invalidate user sessions

Identifying sequential browsing operations includes receiving session data associated with a plurality of sessions, creating a reduced page for each page in a series of pages associated with a first session in the plurality of sessions, and creating a hash value associated with each reduced page for each page in the series of pages associated with the first session of the plurality of sessions. Responsive to a determination that the hash value of the first session is equivalent to the hash value of the second session, an associated page is identified as an equivalent page and the equivalent pages are merged to create a common sequence without a need to resend requests associated with the session data to a server.

Identification of sequential browsing operations

Growing community of inventors

Kanata, Canada

Iosif Viorel Onut