International Business Machines Corporation

Matthew Paul Ouellette

Christopher John Hockings

Jian Lin

Chee Meng Low

Matthew Elsner

Olanrewaju Oluwaseun Okunlola

Michael Josiah Bolding

Christopher C Fraser

Yun Pan

Suhas Venkatesh Kashyap

A machine learning (ML)-based technique for user behavior analysis that detects when users deviate from expected behavior. A ML model is trained using training data derived from activity data from a first set of users. The model is refined in a computationally-efficient manner by identifying a second set of users that constitute a 'watch list.' At a given time, a differential data ingestion operation is then performed to incorporate data for the second set of users into the training data, while also pruning at least a portion of the data set corresponding to data associated with any user included in the first set but not in the second set. These operations update the training data used for the machine learning. The machine learning model is then refined based on the updated training data that incorporates the activity data ingested from the users identified in the watch list.

Adaptive object modeling and differential data ingestion for machine learning

A mechanism is provided in a data processing system comprising at least one processor and at least one memory, the at least one memory comprising instructions executed by the at least one processor to cause the at least one processor to implement an ontology based persistent attack campaign detection engine. In response to a security incident, the mechanism sends the security incident to an incident model microservice executing within the persistent attack campaign detection engine. The incident model microservice extracts artifacts from the incident, maps the artifacts to a graph topology data structure, and stores the graph topology data structure in a graph data storage. An ontology modeling suite executing within the persistent attack campaign detection engine collects security data from a document data storage, builds a security ontology data structure and storing the security ontology data structure in an ontology data storage, and maps concepts from the security ontology data structure to the graph topology data structure. A custom insight engine executing within the persistent attack campaign detection engine performs insights based on the graph topology data structure and outputs results of the insights to a user in human readable form.

Ontology based persistent attack campaign detection

Embodiments can provide a method for accessing an endpoint, including: receiving, from a privileged user, a request for accessing the endpoint; providing, by a user behavior analytics device, a risk score with respect to the privileged user, wherein the risk score is calculated based on at least one action performed by the privileged user. If the risk score is lower than a first predefined value, providing access to the endpoint for the privileged user. If the risk score is higher than a second predefined value, denying the request for accessing the endpoint. If the risk score is between the first predefined value and the second predefined value, performing at least one of: providing, by a privileged identity management server, a multi-factor authentication against the privileged user; and rerouting the request for accessing the endpoint for approval.

Privileged identity authentication based on user behaviors

Growing community of inventors

Fredericton, Canada

Matthew Paul Ouellette