International Business Machines Corporation

Micha Gideon Moffie

Ariel Farkash

Abigail Goldsteen

Gilad Ezov

Ron Shmelkin

Ayman Jarrous

Omer Y Boehm

Igor Gokhman

Sigal Asaf

Mattias Marder

Tamer Salman

Lev Greenberg

Boris Rozenberg

Shlomit I Shachor

Oleg Blinder

Natalia Razinkov

Yehoshua Sagron

Gal Peretz

A computer-implemented method, according to various approaches, includes causing a predetermined HRL agent to perform, in a controlled environment, execution of a first potentially malicious API call against a predetermined API. Performing execution of the first potentially malicious API call against the predetermined API includes: causing a first sub-agent of a first stage of an architecture of the HRL agent to make a first selection for defining a first portion of a first API call. Performing execution of the first potentially malicious API call against the predetermined API furthermore includes causing a second sub-agent of a second stage of the architecture of the HRL agent to make a second selection for defining a second portion of the first API call, and issuing the first API call to the predetermined API. First reward-based feedback is provided to the first sub-agent and the second sub-agent.

Using hierarchical reinforcement learning (HRL) to identify application programming interfaces (API) vulnerabilities

An example system includes a processor to automatically generate a regular expression automaton matching a textual pattern of a received format. The regular expression automaton is a superset of the format. The processor can automatically generate a multi-dimensional filter to be applied to input data based on the generated regular expression automaton.

Data classification using dynamically filtered formats

A method, a structure, and a computer system for expanding database column names. Exemplary embodiments may include identifying glossary terms that sufficiently syntactically match a column name, extracting partial expansions from the glossary terms, selectively combining a set of the partial expansions, and storing the combined set of partial expansions in association with the column name.

Expanding database column names

An example system includes a processor to receive a value formatted using a composite subtraction format. The processor can determine an interval of a number of intervals that corresponds to the received value using minuend rank. The processor can then calculate rank of the value based on the position of the value within the determined interval.

Ranking instances of composite subtraction format using ranked intervals

A method comprising: obtaining multiple glossary terms each comprising one or more words; generating multiple fuzzy tokens from each word of each of the glossary terms; calculating a similarity score for each of the fuzzy tokens, the similarity score denoting a similarity between the respective fuzzy token and its respective word; obtaining multiple input terms to be matched with the multiple glossary terms; separating each of the input terms into multiple input tokens; generating multiple n-grams from each of the input tokens; comparing the n-grams with the fuzzy tokens, to output a list of matching n-grams and fuzzy tokens; based on the list of matching n-grams and fuzzy tokens, identifying, from the glossary terms, candidate glossary term matches for each of the input terms; and calculating one or more scores that quantify the match between each of the candidate glossary term matches and its respective input term.

Fuzzy matching of obscure texts with meaningful terms included in a glossary

An example system includes a processor to generate regular expressions representing textual pattern facets of sub-formats of a composite format, and a regular expression representing a composite textual pattern of the composite format based on sub-format and composition type. The processor can search the data using generated regular expression representing composite textual patterns to detect occurrences of candidate matches. The processor can recursively match and validate the detected occurrences with the composite format and hierarchically match and validate sub-formats in the detected occurrence. The processor can mask in place the detected occurrence of the composite format in the data using ranking-based integer format preserving masking.

Searching, matching, and masking of composite formats

An example system includes a processor to receive an instance of a composite format comprising a masking restriction. The processor can generate a mask for the instance of the composite format based on the masking restriction. The processor can output the generated mask.

Generating masks for formats including masking restrictions

A method, apparatus and a product for data generalization for predictive models. The method comprising: obtaining a training dataset that comprises a plurality of training instances and predicted labels thereof, wherein each training instance is a valuation of a set of features, wherein the set of features comprises a feature having a domain, wherein the predicted label of each training instance is a label predicted thereto by a predictive model; training an auxiliary model using the training dataset; based on the auxiliary model, determining an alternative set of features that is a generalization of the set of features, wherein the alternative set of features comprises a generalized feature having a generalized domain, wherein each value in the generalized domain corresponds to one or more values in the domain; obtaining a generalized instance having a valuation of the alternative set of features; and determining a label for the generalized instance.

Data generalization for predictive models

An example system includes a processor to receive a graph-based masking policy and a composite payload containing a data object to be masked. The processor is to instantiate a masking engine based on the graph-based masking policy. The processor is to execute the masking engine on the composite payload to generate a masked payload comprising a masked data object. The data object to be masked is masked in place such that the resulting composite payload type is maintained. The processor is to output the masked payload.

Masking composite payloads using policy graphs

A method, computer system, and a computer program product for personal data discovery is provided. The present invention may include determining at least one feature used to train a target machine learning (ML) model. The present invention may also include mapping the determined at least one feature to at least one location of a data store including at least one personal data associated with the determined at least one feature. The present invention may further include retrieving a data record of the at least one personal data associated with the mapped at least one feature from the at least one location of the data store. The present invention may also include determining that the target ML model includes a trace of the retrieved data record. The present invention may further include marking the target ML model as containing the at least one personal data.

Discovery of personal data in machine learning models

An example system includes a processor to receive training data and predictions on the training data of a trained machine learning model to be anonymized. The processor is to generate generalized data from training data based on the predictions of the trained machine learning model on the training data. The processor is to train an anonymized machine learning model using the generalized data.

Training anonymized machine learning models via generalized data generated using received trained machine learning models

Embodiments of the present systems and methods may provide techniques to distinguish between data categories. For example, a method implemented in a computer system may comprise obtaining, at the computer system, a plurality of data strings in different categories, each category having a same string pattern, determining a loose string format and a set of restrictions based on at least one string pattern, classifying the plurality of data strings to respective different categories based on a loose string format of the data strings and on the restrictions on the data strings of the different categories using a classification score indicating utilizing restriction information of other categories when determining the matching of a category, and decreasing the classification score if a mean restriction matching proportion is not part of a category or is a threshold amount above an expected mean restriction matching proportion.

Exploitation of domain restrictions for data classification

A method, apparatus and a product for data generalization for predictive models. The method comprising: based on a labeled dataset, determining a plurality of buckets, each of which has an associated label; determining a plurality of clusters, grouping similar instances in the same bucket; based on the plurality of clusters, determining an alternative set of features comprising a set of generalized features, wherein each generalized feature corresponds to a cluster of the plurality of clusters, wherein a generalized feature that corresponds to a cluster is indicative of the instance being mapped to the corresponding cluster; obtaining a second instance; determining a generalized second instance that comprises a valuation of the alternative set of features for the second instance; and based on the generalized second instance, determining a label for the second instance.

Embodiments of the present systems and methods may provide techniques for verifying the correct application purpose for applications that serve multiple purposes and to determine the correct purpose for each requested data access. For example, in an embodiment, a method for controlling application access to data implemented in a computer comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor may comprise: receiving an application comprising a plurality of application parts, each application part associated with a declared data access purpose and generating a cryptographic certificate for each application part to be certified by determining whether a declared data access purpose for each application part to be certified is correct and the only data access purpose for that part, wherein the declared purpose is included in purpose information associated with each application part to be certified.

Verifying purpose of data usage at sub-application granularity

Automated classification, by: Obtaining an examined document having an examined value appearing therein. Identifying: a location in the examined document at which the examined value appears, and a structure of the examined value. Identifying additional documents of a same type as the examined document, in which values having a same structure as the examined value appear at a same location as in the examined document. Applying a classifier to the examined value and the values in the additional documents, to output a single class to which the examined value and the values in the additional documents belong.

Growing community of inventors

Zichron Yaakov, Israel

Micha Gideon Moffie