International Business Machines Corporation

Columbia University

Matthew G Schultz

Michael D Elder

Vaughn Theodore Rokosz

Jason Y Jho

Andrew Lewis Schirmer

Eleazar Eskin

Manasi Bhattacharyya

Erez Zadok

James Patrick Goodwin

Stolfo Salvatore J

Stolfo J Salvatore

A system and methods for detecting malicious executable attachments at an email processing application of a computer system using data mining techniques. The email processing application may be located at the server or at the client or host. The executable attachments are filtered from said email, and byte sequence features are extracted from the executable attachment. The executable attachments are classified by comparing the byte sequence feature of the executable attachment to a classification rule set derived from byte sequence features of a data set of known executables having a predetermined class in a set of classes, e.g., malicious or benign. The system is also able to classify executable attachments as borderline when the difference between the probability that the executable is malicious and the probability that the executable is benign are within a predetermined threshold. The system can notify the user when the number of borderline attachments exceeds the threshold in order to refine the classification rule set.

Systems and methods for detection of new malicious executables

A knowledge Management (KM) tool that allows persons in an organization to more rapidly locate the people and information they need to answer their questions. Identification and visualization of information aggregate founders, including category creators, helps in locating expertise, and additionally helps to reveal and magnify hidden knowledge dynamics within the organization.

System and method for determining founders of an information aggregate

System and methods for detection of new malicious executables

A system and method for evaluating an information aggregate. A metrics database stores document indicia including document attributes and associated person. A query engine responsive to a user request and the metrics database aggregates documents having same, unique attributes in a plurality of information aggregates, and determines the intersections of said information aggregates. A visualization engine displays these intersections selectively with reference to people, documents, usage patterns or categories.

System and method for determining community overlap

A system and method for determining a social network. A metrics database stores virtual object indicia including document attributes, activities, and associated persons. A query engine responsive to a user request and the metrics database infers individual connections to the virtual object by individuals executing the activities. A visualization engine visualizes membership in the social network as including these individuals and the activities connecting them. The query engine further collects a plurality of documents having non-unique values on a first shared attribute into an aggregate, and the visualization engine further filters the social network to include only individuals having membership in the aggregate.

System and method for building social networks based on activity around shared virtual objects

System and method for evaluating an information aggregate. A metrics database stores document indicia including document attributes, associated persons and age of creation. A query engine responsive to a user request and the metrics database aggregates documents having same, unique attributes and calculates therefrom, or from meta data defining the aggregate, an age value of the aggregate. A visualization engine visualizes age values for a plurality of aggregates at a client display.

System and method for examining, calculating the age of an document collection as a measure of time since creation, visualizing, identifying selectively reference those document collections representing current activity

System and method for evaluating an information aggregate. A metrics database stores document indicia including document attributes, associated persons and usage metrics. A query engine collects a plurality of documents having non-unique values on a shared attribute into an information aggregate and tracks usage metrics with respect to the documents. A visualization engine visualizes the usage metrics with respect to a single aggregate, or as a composite or comparison of usage metrics for a plurality of aggregates.

System and method for analyzing usage patterns in information aggregates

Information in a database collection of knowledge resources is evaluated by collecting a plurality of documents having non-unique values on a shared attribute into an information aggregate; assigning to each document an usefulness value; and calculating and visualizing the acceleration of the aggregate as a ratio of a sum of the usefulness values for documents recently included in the information aggregate to a sum of the usefulness values for all documents in the aggregate.

System and method for finding the acceleration of an information aggregate

System and method for evaluating an information aggregate by analyzing categories into which each document of the aggregate is placed. A metrics database stores for each document indicia including associated categories. A query engine is responsive to a user request and the metrics database for aggregating documents having same, unique attributes in an information aggregate and identifying categories associated with documents comprising the information aggregate; and a visualization engine visualizes the category or set of categories, such as by list or distribution frequency, and changes in time over conceptual or physical space.

Growing community of inventors

Ithaca, NY, United States of America

Matthew G Schultz