International Business Machines Corporation

Other

John Michael Garrison

Michael A Gilfix

Tyron Jerrod Stading

Paul T Baffes

Allan Hsu

Steven Black

Herve Debar

Ronald O'Neal Edmark

Kenneth W Blake

Vikki Kim Converse

Yih-Shin Tan

Kent F Hayes, Jr

Michael S McKay

Andreas Wespi

Debora Rinkevich

Brian D Jeffrey

Mark Charles Davis

David Gerard Kuehr-McLaren

Samar Choudhary

Charles David Brant

Donna E Skibbie

Debora Jean Byrne

John D Wolpert

Reid L Sayre

Ronald S Woan

Shawn L Young

RoseAnne Swart

John Charles Bihlmeyer

Rose Anne Swart

Gale Arthur Wilson

Embodiments of the present invention and provide a method for distributed virtual machine (VM) image management in a cloud computing management includes receiving in a hypervisor executing in memory of a host computer, a request for VM image data from a VM and determining whether or not the requested VM image data is present in a local cache of either the hypervisor of the host computer or in a cache of a hypervisor of a peer host. The method additionally includes retrieving the requested VM image data from a seed image in a remote data store in the cloud computing environment only when it is determined that the VM image data neither is present in the local cache of the hypervisor of the host computer nor is present in the cache of the hypervisor of the peer host.

Distributed virtual machine image management for cloud computing

A method of allocating costs for resource usage in a distributed computing environment includes creating a standardized template for deploying a desired functionality within the distributed computing environment; the standardized template defining computing resources of the distributed computing environment needed to support the desired functionality, associating fixed costs with the computing resources, and calculating a total allocated cost associated with the standardized template by referencing the fixed costs. A system of allocating costs for resource usage in a distributed computing environment includes a standardized template for deploying a desired functionality within the distributed computing environment, the standardized template defining a plurality of interconnected computing resources, a fixed cost associated with each of the plurality of interconnected computing resources, and a software application configured to sum the fixed costs to produce a total cost for deploying the desired functionality.

Charging resource usage in a distributed computing environment

A solution in a distributed computing environment is deployed and includes selecting a solution template corresponding to the solution, the solution template defining requirements for a plurality of computing elements; selecting resources within a computing infrastructure which match the requirements; and deploying the solution by configuring the resources according to the solution template.

Allocating resources in a distributed computing environment

A system and method for utilizing data mining to generate a policy document or to revise theory within a policy document. A data base of unknown events is mined for application to the development of a system management policy document. The results of the data mining of the database of unknown events are automatically incorporated into a policy document, subject to user approval, to produce a new policy document or an updated version of an existing policy document.

Suggesting data interpretations and patterns for updating policy documents

A method simplified drag and drop operations of display icons. This method calculates a projected path for an icon based on the past movement of the icon. The method highlights the 'best fit' target icon as the mouse pointer moves across the screen. As the mouse pointer moves, or changes direction, the 'best fit' target icon can change, with the current best-fit icon being highlighted. In addition to highlighting the target icon, a line or arrow from the mouse pointer to the target icon is maintained. The line presents the predicted path in a very noticeable, visual way. As the best-fit target icon changes, the line is re-drawn to point to the current best-fit icon. Regardless of how the target icon is visually indicated, releasing the mouse button will cause the drop operation to be completed &#x201c;into&#x201d; target. Completion of the drop could be instantaneous, or could be rendered with animation of some sort to indicate moving from the source to the target.

Method for predictive drag and drop operation to improve accessibility

A method and system for managing an intrusion on a computer by graphically representing an intrusion pattern of a known past intrusion, and then comparing the intrusion pattern of the known intrusion with a current intrusion. The intrusion pattern may either be based on intrusion events, which are the effects of the intrusion or activities that provide a signature of the type of intrusion, or the intrusion pattern may be based on hardware topology that is affected by the intrusion. The intrusion pattern is graphically displayed with scripted responses, which in a preferred embodiment are presented in pop-up windows associated with each node in the intrusion pattern. Alternatively, the response to the intrusion may be automatic, based on a pre-determined percentage of common features in the intrusion pattern of the known past intrusion and the current intrusion.

Method and system for responding to a computer intrusion

A method for providing access control to a single sign-on computer network is disclosed. A user is assigned to multiple groups within a computer network. In response to an access request by the user, the computer network determines a group pass count based on a user profile of the user. The group pass count is a number of groups in which the access request meets all their access requirements. The computer network grants the access request if the group pass count is greater than a predetermined high group pass threshold value.

Method for providing access control to single sign-on computer networks

An apparatus and method for authenticating users on a data processing system is implemented. The present invention provides for aggregating authenticated identities and related authorization information. A security context created in response to a first user logon is saved in response to a second logon. A composite or aggregate security context is created based on the identity passed in the second logon. Access may then be granted (or denied) based on the current, aggregated security context. Upon logout of the user based on the second identity, the aggregate security context is destroyed, and the security context reverts to the context previously saved.

Aggregated authenticated identity apparatus for and method therefor

A method, system, apparatus, or computer program product is presented for morphing a honeypot system on a dynamic and configurable basis. The morphing honeypot emulates a variety of services while falsely presenting information about potential vulnerabilities within the system that supports the honeypot. The morphing honeypot has the ability to dynamically change its personality or displayed characteristics using a variety of algorithms and a database of known operating system and service vulnerabilities. The morphing honeypot's personality can be changed on a timed or scheduled basis, on the basis of activity that is generated by the presented honeypot personality, or on some other basis. The morphing honeypot can also be integrated with intrusion detection systems and other types of computer security incident recognition systems to correlate its personality with detected nefarious activities.

Method and system for morphing honeypot with computer security incident correlation

A method, computer program product, and apparatus for presenting data about security-related events that puts the data into a concise form is disclosed. Events are abstracted into a set data-type. Sets with common elements are grouped together, and summaries of the groups&#x2014;'situations'&#x2014;are presented to a user or administrator.

Presentation of correlated events as situation classes

A system and method for developing network policy document and assuring up-to-date monitoring and automated refinement and classification of the network policy. The system administrator defines an initial policy document that is provided as the initial symbolic classifier. The classification rules remain in human readable form throughout the process. Network system data is fed through the classifier, which labels the data according to whether a policy constraint is violated. The labels are tagged to the data. The user then reviews the labels to determine whether the classification is satisfactory. If the classification of the data is satisfactory, the label is unaltered; However, if the classification is not satisfactory, the data is re-labeled. The re-labeled data is then introduced into a refinement algorithm, which determines what policy must be modified to correct classification of network events in accordance with the re-labeling. The network administrator then inspects the resulting new policy and modifies it if necessary. An updated classifier replaces the previous classifier.

Developing and assuring policy documents through a process of refinement and classification

A method and system for handling a malicious intrusion to a machine in a networked group of computers. The malicious intrusion is an unauthorized access to the machine, such as a server in a server farm. When the intrusion is detected, the machine is isolated from the rest of the server farm, and the machine is reprovisioned as a decoy system having access to only data that is ersatz or at least non-sensitive. If the intrusion is determined to be non-malicious, then the machine is functionally reconnected to the server farm, and the machine is reprovisioned to a state held before the reprovisioning of the machine as a decoy machine.

Defense mechanism for server farm

A method, system, apparatus, or computer program product is presented for morphing a honeypot system on a dynamic and configurable basis. The morphing honeypot emulates a variety of services while falsely presenting information about potential vulnerabilities within the system that supports the honeypot. The morphing honeypot has the ability to dynamically change its personality or displayed characteristics using a variety of algorithms and a database of known operating system and service vulnerabilities. The morphing honeypot's personality can be changed on a timed or scheduled basis, on the basis of activity that is generated by the presented honeypot personality, or on some other basis.

Growing community of inventors

Austin, TX, United States of America

John Michael Garrison