International Business Machines Corporation

General Electric Company

Ge Medical Systems Israel, Ltd

International Business Machines Corproation

Lev Greenberg

Allon Adir

Omri Soceanu

Ehud Aharoni

Jerome Stephen Arenson

Ariel Farkash

Michael Masin

Boris Rozenberg

Dov Murik

Evgeny Shindin

Henry Broodney

Yanfeng Du

Fady Copty

David Ruimi

Oded Sofer

Hayim Shaul

Gilad Ezov

Daniel Rubin

Rosa Miroshnikov

Roza Miroshnikov

Asaf Polakovski

Baruch Rosner

John Eric Tkaczyk

Xiaoye Wu

Oded Margalit

Micha Gideon Moffie

Abigail Goldsteen

Nir Drucker

Omer Y Boehm

Oded Meirav

Reuven Levinson

Evgeny Drapkin

Ramy Masalha

Sigal Asaf

Dolev Dotan

Galit Naveh

Shalom Rosenberg

Ofer Pinhasi

A method, a neural network, and a computer program product are provided that optimize training of neural networks using homomorphic encrypted elements and dropout algorithms for regularization. The method includes receiving, via an input to the neural network, a training dataset containing samples that are encrypted using homomorphic encryption. The method also includes determining a packing formation and selecting a dropout technique during training of the neural network based on the packing technique. The method further includes starting with a first packing formation from the training dataset, inputting the first packing formation in an iterative or recursive manner into the neural network using the selected dropout technique, with a next packing formation from the training dataset acting as an initial input that is applied to the neural network for a next iteration, until a stopping metric is produced by the neural network.

Neural network training with homomorphic encryption

An example system includes a processor that can obtain a circuit describing operations of sequential secure computation code. The processor can modify the circuit based on a cost function. The processor can partition the circuit into a number of sub-circuits. The processor can assign the number of the sub-circuits to different processors for execution.

Partitioning circuits for execution of sequential secure computation code on multiple processors

A method for automatically migrating infrastructure as code (IaC) from a first cloud infrastructure platform to a second cloud infrastructure platform is provided. The method may include receiving an original IaC comprising a first type of coding language. The method may further include using natural language processing to map a connection between the first type of coding language and a second type of coding language. The method may further include based on the mapped connection, using the NLP to automatically generate a partial translation of the first type of coding language to the second type of coding language. The method may further include using a machine learning algorithm to correct at least one inaccuracy in the partial translation. The method may further include generating a complete translation and implementing a second IaC on the second cloud infrastructure platform based on the complete translation.

Migrating infrastructure as code between different cloud providers

Embodiments of the present systems and methods may provide techniques to distinguish between data categories. For example, a method implemented in a computer system may comprise obtaining, at the computer system, a plurality of data strings in different categories, each category having a same string pattern, determining a loose string format and a set of restrictions based on at least one string pattern, classifying the plurality of data strings to respective different categories based on a loose string format of the data strings and on the restrictions on the data strings of the different categories using a classification score indicating utilizing restriction information of other categories when determining the matching of a category, and decreasing the classification score if a mean restriction matching proportion is not part of a category or is a threshold amount above an expected mean restriction matching proportion.

Exploitation of domain restrictions for data classification

The present invention relates to novel techniques for monitoring changes to source code of Infrastructure as Code systems to detect attempted anomalous changes and block such changes from the code. For example, a method may comprise learning a security architecture and history of an infrastructure as code system to be deployed in at least one cloud account, monitoring changes to source code of the infrastructure as code system that are made before deployment of the infrastructure as code system to detect an anomaly, determining whether the detected anomaly affects regulated resources of the infrastructure as code system, and blocking changes to the source code of the infrastructure as code system that produce the detected anomaly that affects regulated resources of the infrastructure as code system.

User and entity behavior analytics of infrastructure as code in pre deployment of cloud infrastructure

An efficient packing method that will optimize use of the homomorphic encryption ciphertext slots, trading-off size, latency, and throughput. Technology for working with tensors (multi-dimensional arrays) in a system that imposes tiles, that is, fixed-size vectors. An example of a system that imposes tiles are homomorphic encryption schemes, where each ciphertext encrypts a vector of some fixed size. The tensors are packed into tiles and then manipulated via operations on those tiles. Also, syntax for notation for describing packing details. This technology interprets the tiles as multi-dimensional arrays, and combines them to cover enough space to hold the tensor. An efficient summation algorithm can then sum over any dimension of this tile tensor construct that exists in the physical or logical addressing space of a computer data memory.

Packing arbitrary tensors into tiles with descriptive shapes

Embodiments may provide distance computations on homomorphic and/or functional encrypted vectors while detecting whether the resulting distance has wrapped around due to the vectors having elements not in an allowed range. A method of user authentication processing may comprise receiving and storing enrollment information from a client computer system, the enrollment information comprising a template of authentication data and at least one additional encrypted vector, receiving an additional template to be used to authenticate the user from the client computer system, authenticating the user using the received additional template using the stored template and the stored at least one additional encrypted vector, and determining that authentication is successful when the received additional template matches the stored template and is valid based on the stored at least one additional encrypted vector.

Ensure valid range of values of a vector for distance calculations using homomorphic encryption or functional encryption

Embodiments may provide techniques to detect cyber-security events in IoT data traffic that provide improved detection accuracy and preservation of privacy. For example, in an embodiment, a method may be implemented in a computer comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method may comprise collecting a plurality of messages to and from at least one device, extracting metadata features from the collected plurality of messages, generating a time window, determining additional features based on the extracted metadata features present during the time window, detecting behavioral patterns of the at least one device based on the collected plurality of messages, clustering the determined additional features and the detected behavioral patterns present during the time window, and detecting at least one anomaly or type of anomaly using the clustered determined additional features and the detected behavioral patterns.

Method for privacy preserving anomaly detection in IoT

A data manager determines an appropriate number of clusters for continuous data using unsupervised learning. The data manager selects an appropriate number of clusters based on at least one temporal stability measure between continuous data from at least two time intervals.

Cluster evaluation in unsupervised learning of continuous data

Embodiments of the present systems and methods may provide techniques for encryption of location information, while preserving a format and semantics of the information. For example, in an embodiment, a computer-implemented method for encrypting data may comprise receiving location data and generating encrypted data from the received location data, wherein the encrypted data preserves the format and semantics of the received location data.

Method and system for semantic preserving location encryption

A computer implemented method of authenticating a user based on comparison of biometric data authentication process parameters measured during a biometric authentication process against a biometric signature authentication process model of the user, comprising receiving sensory data captured by one or more sensors operated to capture biometric data of a user during a biometric authentication process conducted to verify a biometric signature of the user, calculating a deviation of values of a plurality of authentication process parameters measured during analysis of the sensory data from the values of corresponding reference authentication process parameters retrieved from a biometric signature authentication process model of the user and authenticating the user based on verification of the biometric signature and according to the deviation.

Biometric authentication anomaly detection

Embodiments of the present invention may provide the capability to identify security breaches in computer systems from clustering properties of clusters generated based on monitored behavior of users of the computer systems by using techniques that provide improved performance and reduced resource requirements. For example, behavior of users or resources may be monitored and analyzed to generate clusters and train clustering models. Labeling information relating to some user or resource may be received. When users or resources are clustered and when a cluster contains some labeled users/resources then an anomaly score can be determined for a user/resource belonging to the cluster. A user or resource may be detected to be an outlier of at least one cluster to which the user or resource has been assigned, and an alert indicating detection of the outlier may be generated.

Identifying security breaches from clustering properties

Embodiments of the present invention may detect, identify, and notify of email phishing attacks. For example, a method may comprise constructing at least one behavioral model for an organization based on features extracted from a plurality of email messages and based on information relating to the organization, including analyzing behavioral patterns of emails in the organization, analyzing a plurality of new email messages using the behavioral model to determine non-binary scores representing analysis of features of the messages, including behavioral patterns of the new emails in the organization with regard to the features, determining whether any of the plurality of new email messages are malicious email messages based on the non-binary scores for the new email messages indicating that the new email messages deviate from the behavioral patterns of emails in the organization included in the behavioral model, and transmitting a notification that a message is a malicious email message.

Method and system for email phishing attempts identification and notification through organizational cognitive solutions

Embodiments of the present systems and methods may provide data watermarking without reliance on error-tolerant fields, thereby providing for the incorporation of watermarks in data that was not considered suitable for watermarking. For example, in an embodiment, a computer-implemented method for watermarking data may comprise inserting watermark data into a field that requires format-preserving encryption.

Method for watermarking through format preserving encryption

Setting a budget of alerts for single or multiple risk score types, adjusting a working threshold based on the set budget, wherein adjusting the working threshold is done by defining an reference threshold for an alert, providing a history of recorded risk scores within a budget sliding interval window and adjusting the working threshold such that a number of alerts which would have been provided by the recorded risk scores is calculated to stay within the set budget, and using the adjusted working threshold to normalize and optionally combine incoming risk scores so as to determine whether an incoming risk score should receive an alert.

Growing community of inventors

Haifa, Israel

Lev Greenberg