International Business Machines Corporation

Kyndryl, Inc.

Matthias Seul

Tim Uwe Scheideler

Arjun Udupi Raghavendra

Andrea Giovannini

Lloyd Wellington Mascarenhas

Petr Novotny

Doga Tav

Arielle Tovah Orazio

Shikhar Kwatra

Nitin Gaur

Dulce Beatriz Ponceleon

Michael Fan Wang

Spencer Thomas Reynolds

Ivan James Reedman

Christopher Pepin

Daniel Silveira

Zvonimir Fras

Mehran Khan

Siddharth Mehta

Yash Kedia

Kin Fong

Tyler Lisowski

Francisco Javier Rodriguez

Dennis Warne

Kodie Glosser

A computer-implemented method for digital fingerprint obfuscation is disclosed. The computer-implemented method includes training a machine learning model to classify web traffic data into one or more personas. The computer-implemented method further includes identifying, using the trained machine learning model, a particular persona of a user based, at least in part, on a user's real traffic data generated during a current user session. The computer-implemented method further includes generating synthetic traffic data based, at least in part, on the identified particular persona of the user.

Method to randomize online activity

The exemplary embodiments disclose a method, a computer system, and a computer program product for detecting malware. The exemplary embodiments may include aggregating known malware patterns by storing malware patterns and related malware categories of the malware patterns. The exemplary embodiments may additionally include training a first machine-learning system, comprising a generator portion and a discriminator portion, by using the known malware patterns and the related malware categories as training data. The exemplary embodiments may also include generating additional synthetic code patterns by feeding random code samples to the trained first machine-learning system. The exemplary embodiments may further include training a second machine-learning system by using benevolent code patterns and the generated additional synthetic code patterns as training data. The exemplary embodiments may include determining a statistical distribution of predicted malicious code patterns and related categories, and determining a quality value of the training of the second machine-learning system.

Self-learning and adapting cyber threat defense

According to one embodiment, a method, computer system, and computer program product for crowd density analysis with multiple regions is provided. The embodiment may include identifying three or more local measurement nodes. The embodiment may also include defining one or more bins, each bin comprising at least three local measurement nodes from the three or more local measurement nodes. The embodiment may further include mapping one or more regions corresponding to a bin from the one or more bins. The embodiment may also include identifying a device in a region. The embodiment may further creating a profile corresponding to the identified device. The embodiment may also include calculating a population density based on a number of created profiles in a region from the one or more regions.

Crowd density analysis with multiple regions

A display case is provided. The display case includes a transparent display for viewing an object through the transparent display and a watermarking engine configured to display a watermark on the transparent display.

Display case with transparent display for watermarking

Described are techniques for multi-tenant security. The techniques include detecting malicious activity on a compromised application in a multi-tenant host. The techniques further include automatically performing a live migration of each tenant of the multi-tenant host to a respective single-tenant host. The techniques further include mitigating the malicious activity on the compromised application that is migrated to a single-tenant host, and automatically performing another live migration of each benign tenant to a new multi-tenant host.

Multi-tenant security

According to one embodiment, a method, computer system, and computer program product for population density approximation is provided. The embodiment may include identifying a device as entering a preconfigured distance of a preconfigured area, whereby the preconfigured area is one of a plurality of preconfigured areas. The embodiment may also include gathering device-identifying information corresponding to the device. The embodiment may further include creating a profile for each device using the device-identifying data. The embodiment may also include correlating device movements across the plurality of preconfigured areas using the profile associated with each device. The embodiment may further include calculating a population density based on the correlated device movements.

Approximating population density and post-incident scenario analysis

A method for processing security events by applying a rule-based alarm scheme may be provided. The method includes generating a rule index of rules and an indicator of compromise index for each of the rules. The method includes also processing the incoming security event by applying the rules, increasing a current rule counter relating to a triggered rule, and increasing a current indicator of compromise counter pertaining to the triggered rule. Furthermore, the method includes generating a pseudo security event from received data about known attacks and related indicators of compromise, processing the pseudo security events by sequentially applying the rules, increasing a current rule counter of pseudo security events, and increasing a current indicator of compromise counter for pseudo security events, and sorting the rules and sorting within each rule the indicator of compromise values in the indicator of compromise index.

System and method for SIEM rule sorting and conditional execution

A computer-implemented method for managing access rights to a knowledge graph is provided. The method comprises splitting, for each user system, its respective portion of the knowledge graph into a plurality of knowledge subgraphs, encrypting each of the knowledge subgraphs, and generating a plurality of private summary graphs. The method also comprises maintaining a collaboration graph comprising one vertex per user system and edges representing collaborations between the users, mapping all private subgraphs of all user systems to one public summary graph, each vertex of the public summary graph comprises less data than the related vertex of the related private summary graphs and wherein none of the vertices of the summary graph comprises any encryption or decryption key, and granting access to a selected knowledge subgraph from a first user system to a second user system.

Encrypted knowledge graph

A computer-implemented method, system and computer program product for protecting against application programming interface (API) attacks. A connection is established between an API user and an API provider. The established connection is then monitored to assess connection security and trustworthiness of the connection as well as trustworthiness of the API user and/or API provider. A score is then generated for each factor used in assessing the connection security and trustworthiness of the connection as well as the trustworthiness of the API user and/or API provider based on the monitoring. A level of risk for an API attack with respect to the API user and/or API provider is then generated based on such scores. An action (e.g., blocking traffic) is then performed with respect to the API user and/or API provider based on the level of risk for an API attack with respect to the API user and/or API provider, respectively.

Protecting against API attacks by continuous auditing of security compliance of API usage relationship

A system for determining code ancestry. The system includes: a memory; and a processor communicatively coupled to the memory. The processor is configured to perform a method comprising: receiving a source code file; parsing a plurality of functions out of the source code file; generating fuzzy fingerprints from the plurality of functions; and storing the fuzzy fingerprints in a graph database.

Software code analysis using fuzzy fingerprinting

A system may receive a string of characters, identify two or more sub-strings of the string, compare the two or more sub-strings to one or more reserve values from a database of reserve values, identify a first sub-string of the two or more sub-strings that contains one of the one or more reserve values, identify a second sub-string of the two or more sub-strings with a sensitive value, and obfuscate the second sub-string and not obfuscating the first sub-string.

Obfuscating intelligent data while preserving reserve values

A node in a blockchain network may generate a secret information proof, generate a private/public key pair, encrypt the secret information proof with the private/public key pair, and submit the proof to a blockchain network.

Provable trade secrets on blockchain networks

Aspects of the present invention disclose a method, computer program product, and system for detecting a malicious process by a selected instance of an anti-malware system. The method includes one or more processors examining a process for indicators of compromise to the process. The method further includes one or more processors determining a categorization of the process based upon a result of the examination. In response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, the method further includes one or more processors executing the process in a secure enclave. The method further includes one or more processors collecting telemetry data from executing the process in the secure enclave. The method further includes one or more processors passing the collected telemetry data to a locally trained neural network system.

Malware detection by distributed telemetry data analysis

A computer system controls access to data. A secure container that is based on an image file is instantiated at an endpoint device of a user, wherein the secure container includes encrypted data corresponding to the user. An access request to the secure container is authenticated by verifying credentials of the user. In response to verifying the credentials of the user, access to the data is granted. Access to the data is controlled by decrypting and enabling access to a portion of the data, wherein additional portions of the data are decrypted and made accessible based on user behavior.

Growing community of inventors

Pleasant Hill, CA, United States of America

Matthias Seul