International Business Machines Corporation

Klaus Julisch

Matthias Schunter

Marc Dacier

Reto Josef Hermann

Guenter Karjoth

Rhys D Ulerich

David Perry Greene

Georg Ochs

Andreas Wespi

Birgit Baum-Waidner

Jonathan Michael Seeber

Anil Jagdish Chawla

Aaron Edward Fredrick Rankin

Aaron Edward Rankin

Rhys Ulerich

A method for automated network deployment of cloud services into a network is suggested. The method includes receiving a certain cloud service with a certain resource protection template specifying an isolation policy for isolating zones in the network, receiving certain customer protection parameters specifying customer needs regarding protection in the network, providing security requirements by matching the received resource protection templates and the received customer protection parameters, and automatically deploying the certain cloud service into the network by using the provided security requirements.

Automated network deployment of cloud services into a network

Given a new user U or a user whose role in the organization changed, an automated method of the present disclosure in one aspect determines the new or revised access permissions the user should have. In one aspect, the method of the present disclosure automatically determines access rights based on the access rights held by similar users. This general idea, including a formalization of similarity between users, the details of how access rights are determined, and an algorithm to test if the presented methods are safe to use are provided.

Method and apparatus for automated assignment of access permissions to users

A method and system is designed for processing alarms, that have been triggered by a monitoring system such as an intrusion detection system, a firewall, or a network management system, comprising the steps of entering the triggered alarms into an alarm log, evaluating similarity between alarms, grouping similar alarms into alarm clusters, summarizing alarm clusters by means of generalized alarms, counting the covered alarms for each generalized alarm and forwarding generalized alarms for further processing if the number of alarms covered satisfies a predetermined criterion. In the event of high rates of alarm messages, possibly containing many false alarms, a system administrator will therefore not be confronted with a flood of messages with little significance. Instead, only generalized alarms, more meaningful and smaller in number, are presented. The method can further comprise copying the alarm log to a cluster log and for each generalized alarm in the cluster log counting the number of covered alarms that are identical to the generalized alarm or more specific than the generalized alarm, and, if the number of covered alarms exceeds a predetermined minimum number, then terminating the loop. A heuristic is used to select an attribute of the alarms of the cluster log and for each alarm thereof the selected attribute is replaced by a more general attribute. A taxonomy on the attributes can be used to define the similarity between the alarms. The forwarded generalized alarm can furthermore be investigated in order to identify a root cause.

Method, computer program element and a system for processing alarms triggered by a monitoring system

A peripheral device includes an interface configured to communicate with a computer, the peripheral device; logic configured to perform an integrity verification of an operating system of the computer; and a display configured to display a result of the integrity verification. A method for integrity verification of a computer using a peripheral device includes connecting the peripheral device to the computer; sending a challenge from the device to the computer; computing attestation data using the challenge and information stored in the computer, retrieving the attestation data from the computer by a client program running on the computer; sending the attestation data to the peripheral device; and verifying the attestation data by the peripheral device.

Integrity verification using a peripheral device

A computer implemented method and system for analysing a first set of data records where each data record comprises attribute values for one or more attributes, by expanding the first set of data records into a second set of data records by creating for at least one of the attributes of the first set of data records at least two redundant attributes with corresponding redundant attribute values, assigning different generalization rules to the at least two redundant attributes, and performing a generalization of the second set of data records by means of an attribute-oriented induction (AOI)-algorithm.

Computer-implemented method, computer program and system for analyzing data records by generalizations on redundant attributes

A method and system is designed for processing alarms, that have been triggered by a monitoring system such as an intrusion detection system, a firewall, or a network management system, comprising the steps of entering the triggered alarms into an alarm log, evaluating similarity between alarms, grouping similar alarms into alarm clusters, summarizing alarm clusters by means of generalized alarms, counting the covered alarms for each generalized alarm and forwarding generalized alarms for further processing if the number of alarms covered satisfies a predetermined criterion.

An apparatus, a method, and a computer program are provided for distinguishing relevant security threats. With conventional computer systems, distinguishing security threats from actual security threats is a complex and difficult task because of the general inability to quantify a 'threat.' By the use of an intelligent conceptual clustering technique, threats can be accurately distinguished from benign behaviors. Thus, electronic commerce, and Information Technology systems generally, can be made safer without sacrificing efficiency.

Method and system for distinguishing relevant network security threats using comparison of refined intrusion detection audits and intelligent security analysis

Growing community of inventors

Bonstetten, Switzerland

Klaus Julisch