International Business Machines Corporation

Kyndryl, Inc.

Quartz Auto Technologies LLC

Matthias Seul

Tim Uwe Scheideler

Arjun Udupi Raghavendra

Erik Rueger

Thomas Allen Snellgrove

Andreas Kuehmichel

Artemiy Aleksandrovich Solyakov

Tobias Ephraim Dannat

Tim Scheideler

Claudius Link

Itzhack Goldberg

Thorsten Muehge

Marcus Breuer

Volker Vogeley

Dominik W Brugger

Boas Betzler

Stefan Alexander

Alexander Neef

Petra Sabine Buehrer

Johannes Noll

Gideon Zenz

Markus Ludwig

Thomas Pohl

Andrea Giovannini

Dirk Harz

Keira Louise Hopkins

Marco H Kroll

Ivan James Reedman

Martin Tröster

Lloyd Wellington Mascarenhas

Nicolo′ Sgobba

Marc Noske

Arielle Tovah Orazio

Brian Din

Christopher Pepin

Volker G A Vogeley

Carsten Dietrich

Stefan Walter

Tiziano Airoldi

Alexandr Pavlovich Korchemniy

Jens Thamm

Jason Zhong

Hanna Puhoffa

Methods, computer program products, and systems are presented. The methods include customer specific information exchange and an adjustment of the privacy level of this information. For this purpose an abstraction layer and an obfuscation module are introduced. Using a 'fraud vector' a risk assessment is performed on the obfuscated transaction data.

System and method for enforcing granular privacy controls during transaction fraud screening by a third party

A computer-implemented method for protecting a processing environment from malicious incoming network traffic may be provided. The method comprises: in response to receiving incoming network traffic comprising a data packet, performing a packet and traffic analysis of the data packet to determine whether said data packet is non-malicious and malicious, and processing of the data packet in a sandbox environment. Furthermore, the method comprises: in response to detecting that the data packet is non-malicious based on the packet and traffic analysis, releasing the processed data packet from the sandbox environment for further processing in the processing environment, and in response to detecting that the data packet is malicious based on the packet and traffic analysis discarding the data packet.

Deep packet analysis

Load testing a service having a plurality of different states is provided. A multitude of simulated users accessing the service are divided into a plurality of cohorts. Simulated users within a given cohort share a similar personality type. A load test of the service is performed by applying a set of service requests from each respective cohort to the service. In response to a percentage of simulated users of each cohort encountering a particular state in the service, a user response is determined for the percentage of simulated users within each cohort at that particular state based on a probabilistic user behavior model corresponding to a personality type of each cohort such that user responses at that particular state are distributed in accordance with the probabilistic user behavior model. Distributed user responses at that particular state are applied to the load test in accordance with the probabilistic user behavior model.

Adaptive, speculative, agent-based workload generation

A processor may detect a risk on a local machine. The processor may determine that the risk warrants a heightened-level remediation. The processor may connect the local machine to a cloud-based desktop environment. The processor may perform the heightened-level remediation on the local machine. The processor may merge data from the cloud-based desktop environment to the local machine in response to the heightened-level remediation being performed.

Automated seamless recovery

A method for providing protection of a computing resource constrained device against cyberattacks may include collecting threat intelligence data in form of indicators of compromise (IoC). The indicators may include cyberattack chain related data. The method may also include determining a relevance of the cyberattack chain for the device, measuring a utilization of security measures in terms of their detection of the respective IoCs and their respective responses to the IoCs, measuring a resource consumption of the security measures, and determining a benefit value for at least one the security measure expressed by its utilization and a relevance value of the IoCs detected with it.

Adaptive security for resource constraint devices

A computer system with access to remote files stored on a remote system can predict that a portion of a remote file is likely to be necessary. The computer system may download the portion of the remote file to a local file and update metadata of the local file to reflect the downloaded portion.

Predictive provisioning of cloud-stored files

A method for processing security events by applying a rule-based alarm scheme may be provided. The method includes generating a rule index of rules and an indicator of compromise index for each of the rules. The method includes also processing the incoming security event by applying the rules, increasing a current rule counter relating to a triggered rule, and increasing a current indicator of compromise counter pertaining to the triggered rule. Furthermore, the method includes generating a pseudo security event from received data about known attacks and related indicators of compromise, processing the pseudo security events by sequentially applying the rules, increasing a current rule counter of pseudo security events, and increasing a current indicator of compromise counter for pseudo security events, and sorting the rules and sorting within each rule the indicator of compromise values in the indicator of compromise index.

System and method for SIEM rule sorting and conditional execution

Methods, computer program products, and systems are presented. The methods include, for instance: obtaining passenger information of one or more passenger traveling within a transportation network; and providing one or more output based on a processing of the passenger information.

Adjusting vehicle timing in a transportation network

A computer-implemented method for dynamically identifying security threats comprising a cyber-attack chain composed of a sequence of partial cyber-attacks represented by attack patterns may be provided. The method comprises receiving a sequence of security events, determining, a first cyber-attack pattern by applying a set of predefined rules for detecting an indicator of compromise of a first partial cyber-attack of the cyber-attack chain&#x2014;thereby, identifying a specific cyber-attack chain&#x2014;and determining a type and an attribute in the pattern of the first partial cyber-attack. The method comprises further configuring at least one rule for a downstream partial cyber-attack in the specific cyber-attack chain based on the type and the attribute in the attack pattern of the first partial cyber-attack, and adding the at least one configured rule to the set of predefined rules to be used by the correlation engine for dynamically identifying security threats to information technology systems.

Adaptive rule generation for security event correlation

A computer-implemented method for managing access rights to a knowledge graph is provided. The method comprises splitting, for each user system, its respective portion of the knowledge graph into a plurality of knowledge subgraphs, encrypting each of the knowledge subgraphs, and generating a plurality of private summary graphs. The method also comprises maintaining a collaboration graph comprising one vertex per user system and edges representing collaborations between the users, mapping all private subgraphs of all user systems to one public summary graph, each vertex of the public summary graph comprises less data than the related vertex of the related private summary graphs and wherein none of the vertices of the summary graph comprises any encryption or decryption key, and granting access to a selected knowledge subgraph from a first user system to a second user system.

Encrypted knowledge graph

Embodiments of the present invention provide systems, methods, and computer program products for processing responses from services (e.g., content providers) and managing content tailoring by services and/or recommender systems used by those services. Embodiments of the present invention can afford users with the ability to control the diversity of content in responses provided by services based one or more detected themes of the responses. Furthermore, embodiments of the present invention may be used to provide users with enriched responses from services, without needing cooperation of those services.

Management of content tailoring by services

Automatic file transfer is provided. A file is obtained utilizing a file generating application on a mobile device in response to an input from a user. The mobile device connected to a network. The file is automatically transferred from the mobile device to a target service via the network utilizing a high-speed file transfer application running on the mobile device such that high-speed transfer of the file from the mobile device to the target service is enabled even though the file generating application does not support the high-speed transfer.

High-speed transfer of data from device to service

User bioelectrical authentication is provided. A bioelectrical configuration signature of a user in physical contact with a hardware token is received, via a token reader, during a low range radio frequency user authentication process to permit a secure transaction by the user. The bioelectrical configuration signature of the user is utilized as part of the low range radio frequency user authentication process to authenticate the user to perform the secure transaction.

Bioelectrical authentication

Growing community of inventors

Kassel, Germany

Matthias Seul