International Business Machines Corporation

Markus Ludwig

Johannes Noll

Marc Noske

Matthias Seul

Volker Vogeley

Dirk Harz

Matthias Bartelt

Uwe Küllmar

Marc-André Isenberg

Volker G A Vogeley

Martin Steigemann

A method for identification of malicious internet content and campaigns is provided. The method extracts a cryptocurrency indicator within a compromised data set and inserts the cryptocurrency indicator into a threat intelligence database. The method identifies a set of cryptocurrency transactions associated with the cryptocurrency indicator. From the cryptocurrency indicator and the set of cryptocurrency transactions, the method generates a transaction graph with a set of features representing the set of cryptocurrency transactions. The method modifies the threat intelligence database with at least a portion of the transaction graph.

Cryptocurrency transaction pattern based threat intelligence

A network-accessible cyber-threat security analytics service is configured to receive and respond to requests that originate as name queries to a Domain Name System (DNS) service. Threat intelligence information provided by the service is organized into threat intelligence zones that correspond to zones exposed via the DNS service. Upon receipt of a DNS query, the query having been generated by an application seeking access to threat intelligence data exposed by the service, the query is translated into a DNS zone-specific API request based on the type of threat intelligence information sought. The zone-specific API request is then used to retrieve the requested threat intelligence information from a threat intelligence database. The requested threat intelligence information is then returned to the application by being encoded as part of a response to the DNS query. In this manner, the DNS protocol is leverage to facilitate highly-efficient access and retrieval of threat intelligence information.

Threat intelligence information access via a DNS protocol

Mechanisms are provided to implement a malicious activity response system (MARS) that automatically identifies and handles malicious activities within the data processing system. The MARS identifies threat intelligence associated with characteristics of malicious activity. The MARS forms a hypothesis for the malicious attack to identify a malicious attack that is occurring. The MARS identifies a trap for use in isolating the malicious activity; deploys the trap and automatically reconfiguring a network associated with the data processing system such that the malicious activity is routed to the trap thereby isolating the malicious activity, observes a behavior of the malicious activity within the trap; and extracts features associated with the malicious activity in the trap. The MARS then utilizes the extracted features to improve an operation of the malicious activity response system in handling future malicious activity.

Cognitive malicious activity identification and handling

A processor attracts and harvests spam messages. The processor simulates a message relay server. The processor receives one or more messages for the message relay server. The processor relays a message that is included in the one or more messages based on a determination that a pattern of the message matches a first identification pattern for probe messages. The processor captures a second message that originated from an IP address of the relayed probe message. The processor processes the one or more messages and the second message to generate an identification pattern that identifies potential spam messages.

Method and system for preemptive harvesting of spam messages

Growing community of inventors

Breuna, Germany

Markus Ludwig