International Business Machines Corporation

Johannes Noll

Dirk Harz

Marc Noske

Markus Ludwig

Mark Usher

Matthias Seul

Volker Vogeley

Astrid Granacher

Juergen Kader

Uwe Küllmar

Matthias Bartelt

Marc-André Isenberg

Volker G A Vogeley

Martin Steigemann

A method for identification of malicious domains is provided. The method extracts a set of domain information from one or more input streams. The set of domain information includes a set of domains and a set of domain characteristics describing each domain. The method clusters the set of domains to generate a set of campaign clusters of related domains. The clusters are based on the set of domain characteristics. The method modifies the set of campaign clusters with a set of threat intelligence ratings to generate a set of enriched campaign clusters. A portion of the set of threat intelligence ratings correspond to one or more domains within the set of campaign clusters. The method determines a cluster designation for each campaign cluster of the set of enriched campaign clusters and distributes the cluster designations for each campaign cluster to one or more threat intelligence resource.

Domain clustering for malicious campaign identification

A method for identification of malicious internet content and campaigns is provided. The method extracts a cryptocurrency indicator within a compromised data set and inserts the cryptocurrency indicator into a threat intelligence database. The method identifies a set of cryptocurrency transactions associated with the cryptocurrency indicator. From the cryptocurrency indicator and the set of cryptocurrency transactions, the method generates a transaction graph with a set of features representing the set of cryptocurrency transactions. The method modifies the threat intelligence database with at least a portion of the transaction graph.

Cryptocurrency transaction pattern based threat intelligence

A network-accessible cyber-threat security analytics service is configured to receive and respond to requests that originate as name queries to a Domain Name System (DNS) service. Threat intelligence information provided by the service is organized into threat intelligence zones that correspond to zones exposed via the DNS service. Upon receipt of a DNS query, the query having been generated by an application seeking access to threat intelligence data exposed by the service, the query is translated into a DNS zone-specific API request based on the type of threat intelligence information sought. The zone-specific API request is then used to retrieve the requested threat intelligence information from a threat intelligence database. The requested threat intelligence information is then returned to the application by being encoded as part of a response to the DNS query. In this manner, the DNS protocol is leverage to facilitate highly-efficient access and retrieval of threat intelligence information.

Threat intelligence information access via a DNS protocol

Mechanisms are provided to implement a malicious activity response system (MARS) that automatically identifies and handles malicious activities within the data processing system. The MARS identifies threat intelligence associated with characteristics of malicious activity. The MARS forms a hypothesis for the malicious attack to identify a malicious attack that is occurring. The MARS identifies a trap for use in isolating the malicious activity; deploys the trap and automatically reconfiguring a network associated with the data processing system such that the malicious activity is routed to the trap thereby isolating the malicious activity, observes a behavior of the malicious activity within the trap; and extracts features associated with the malicious activity in the trap. The MARS then utilizes the extracted features to improve an operation of the malicious activity response system in handling future malicious activity.

Cognitive malicious activity identification and handling

According to one exemplary embodiment, a method for detecting unsolicited bulk emails (UBE) is provided. The method may include receiving an email. The method may also include identifying a uniform resource locator (URL) contained in the received email. The method may then include dividing the identified URL into a plurality of component parts. The method may further include generating a tree structure based on the plurality of component parts. The method may also include generating an input string based on the generated tree structure. The method may then include calculating a hash value based on the generated input string. The method may further include determining if the calculated hash value matches a UBE hash value within a plurality of UBE hash values. The method may also include identifying the received email as a UBE based on determining that the calculated hash value matches the UBE hash value.

Unsolicited bulk email detection using URL tree hashes

A processor attracts and harvests spam messages. The processor simulates a message relay server. The processor receives one or more messages for the message relay server. The processor relays a message that is included in the one or more messages based on a determination that a pattern of the message matches a first identification pattern for probe messages. The processor captures a second message that originated from an IP address of the relayed probe message. The processor processes the one or more messages and the second message to generate an identification pattern that identifies potential spam messages.

Growing community of inventors

Ronshausen, Germany

Johannes Noll