International Business Machines Corporation

Michael J Ryan

Claude N Warren, Jr

John O'Malley

Andrew Lavelle

Dara P Murphy

Emile-Hugo Spir

Mark Edward Molander

Shah Mohammad Rezaul Islam

Francesca Curzi

Orla M Prendergast

A computer receives one or more security alerts. The computer selects a subset of the one or more security alerts for processing. The computer executes one or more queries automatically, based on the subset of the one or more security alerts. The computer identifies one or more related processes, wherein the one or more related processes are related to information contained within the subset of the one or more security alerts. The computer displays a full flow of a malware attack, wherein the full flow includes the information contained within the subset of the one or more security alerts and the one or more related processes.

Endpoint detection and response attack process tree auto-play

A method and system for comparing at least two structured data files. A computer polls at least one network device for data files. The computer determines a structural difference between a first data file and a second data file and creates at least one patch file based on the structural difference. The computer extracts at least one span from the at least one patch file, wherein the at least one span is defined by a starting point byte and a length measured in bytes and creates an ordered listing. The computer performs a lexer operation using the at least one span as a limiting criterion to limit an output of the lexer to statements that include the at least one span. The computer outputs the statements indicating changes in a configuration between said first and second data files.

Span limited lexical analysis

Resolving software patch issues is provided. Recorded activities performed by users to resolve an issue with a patch applied to an application on a group of client devices are compared. A set of common user activities are identified within the recorded activities performed by the users. A subset of highest ranking common user activities is selected from the set of common user activities. A fix for the issue with the patch is generated based on the subset of highest ranking common user activities. Corrective action based on the fix is taken to resolve the issue with the patch on a client device, the client device experiencing the issue resolved by users on the group of client devices.

Cognitive analysis and resolution of erroneous software patches

Managing application changes is provided. Devices within a plurality of devices are grouped to form a set of devices based on configuration data corresponding to the devices. An application change is deployed to a subset of the set of devices in response to determining that the application change is available. Performance data corresponding to the application change is collected from the subset of devices over a predefined time period. The application change is deployed to a remainder of devices in the set of devices in response to the performance data indicating a positive application change to the subset of devices increasing a level of performance of the subset of devices greater than an increased performance threshold level.

Automatic patch management

Computer-implemented methods are provided for storing records in and retrieving records from a sharded table of a sharded database. The sharded database comprises a plurality of database shards. The database shards are each configured to store a subset of records of the sharded table. The database shards are also each associated with a respective Bloom filter. Records are inserted into the sharded table by generating a respective representation of the sharding key of the record to be stored for use with each of a plurality of the respective Bloom filters. Hamming distances between current values of each of the plurality of Bloom filters and the respective representation of the sharding key for use with that Bloom filter are then calculated and a database shard for storing the record is selected from amongst those database shards based on the calculated Hamming distances.

Database sharding

Computer program products and systems are provided for storing records in and retrieving records from a sharded table of a sharded database. The sharded database comprises a plurality of database shards. The database shards are each configured to store a subset of records of the sharded table. The database shards are also each associated with a respective Bloom filter. Records are inserted into the sharded table by generating a respective representation of the sharding key of the record to be stored for use with each of a plurality of the respective Bloom filters. Hamming distances between current values of each of the plurality of Bloom filters and the respective representation of the sharding key for use with that Bloom filter are then calculated and a database shard for storing the record is selected from amongst those database shards based on the calculated Hamming distances.

An approach for predictive translation. The approach monitors one or more audio inputs, wherein monitoring the one or more audio inputs includes collecting a plurality of audio input data from one or more audio input devices. The approach determines one or more user triggers, wherein determining includes detecting the one or more user triggers from the one or more of audio input devices. Responsive to detecting the one or more user triggers, the approach determines whether the one or more audio inputs match one or more stored phrases. Responsive to a determination that the one or more audio inputs match at least one of the one or more stored phrases, the approach presents one or more cues to the user via the audio input device.

Assisted language learning

A mechanism is provided in a data processing system for performing a system upgrade. Responsive to receiving selection of one or more virtual machines to upgrade with an upgrade package, the mechanism identifies a plurality of upgrade phases. The mechanism configures the plurality of upgrade phases and generates a pre-upgrade snapshot of each of the one or more virtual machines. The mechanism performs each upgrade phase in the plurality of upgrade phases to form an upgraded virtual machine and performs one or more upgrade validation tests on the upgraded virtual machine. Responsive to the one or more upgrade validation tests succeeding, the mechanism reverts back to the pre-upgrade snapshot.

Effective migration and upgrade of virtual machines in cloud environments

A method and system presents a plurality of selections to a user for updating a system configuration from the choices of: an immediate mode, a scheduled queued mode, a queued mode, and an optimized activation mode. The immediate mode activates all change requests immediately. The scheduled queued mode queues all change requests and activates the change requests at a predetermined time. The queued mode queues all change requests and activates the change requests after receiving a triggering event. The optimized activation mode analyzes the system usage to determine and optimally vary the mode among the immediate mode, the scheduled queued mode, and the queued mode.

Growing community of inventors

Claregalway, Ireland

Michael J Ryan