International Business Machines Corporation

Michal S Paluch

Piotr Kania

Piotr P Godowski

Tomasz Andrzej Stopa

Szymon Kowalczyk

Tomasz Hanusiak

Pawel K Gocek

Andrzej Pietrzak

Bartlomiej Tomasz Malecki

Tomasz L Prudzic

Patryk M Walawender

Erik Rueger

Marcel Butucea Panait

Slawomir T Mezyk

Marcin D Gierlak

Konrad K Skibski

Szymon M Brandys

Pawel Slowikowski

Nicolo′ Sgobba

Krystian N Chmiel

Grzegorz Poniewozik

Monika Grabska

Nadiya Kochura

Artur Zezula

Marcin Labenski

David Warren Knapp, Jr

Michal Maciej Zalas

Karol Cisowski

Tomasz Ploskon

Jaroslaw Musial

William Carbone

Jiri Grunseisen

Oleksii Tosov

A computer-implemented method obtains information about an external computer system having a connection to a computer system. The method may comprise receiving a request from the external computer system. In response to categorizing the external computer system as a potential threat responsive to the request, a computer file is generated responsive to the request. The computer file comprises instructions which are designed for obtaining the information about the external computer system if the instructions are executed on a processor of the external computer system. Furthermore, data is provided responsive to the request. The data is sent together with the computer file to the external computer system. The information about the external computer system, which is generated responsive to the instructions of the computer file, is received by the computer system for preserving it for a later use for developing measures for protecting the computer system.

Tracking a potential attacker on an external computer system

A method is provided for rate limiting in a network. The method comprises receiving a traffic flow from the network. In a supervised learning phase, and determining if the traffic flow matches a pretrained network flow model. If so, the method comprises designating the traffic flow as a classified traffic flow according to the pretrained network flow model. The method further comprises advancing to a grouping phase, conditioned upon the traffic flow not matching pretrained network flow models. In the unsupervised learning phase, the method comprises designating the traffic flow as a classified traffic flow. In the grouping phase that follows the supervised learning phase and the unsupervised learning phase, the method comprises using side information about the traffic flows to assign related traffic flows into traffic flow groups, identifying a particular traffic flow group from the traffic flow groups as being an offending traffic flow group.

Adaptive network control of traffic flows in a secure network

Containerized software discover and identification can include discovering a plurality of container remnants by electronically scanning portions of computer memory of at least one computer system of one or more of computing nodes, the portions of computer memory being allocated to persistent storage of computer data, and each container remnant containing computer data providing a record of system-generated execution attributes generated in response to execution of one or more containerized applications. One or more inactive container remnants unutilized by a currently running containerized application can be identified among the plurality of container remnants. Each inactive container remnant can be categorized, the categorizing being based on system-generated execution attributes contained in each inactive container remnant. Based on the categorizing, a previously run containerized application can be identified by reference to a database comprising data whose structures map identities of containerized applications to patterns of execution attributes.

Containerized software discovery and identification

One or more computer processors responsive to a hypervisor data request, generate an encrypted set of hypervisor data indicating hypervisor hardware details using a plurality of respective asymmetric encryption keys to tag the generated set of encrypted hypervisor data with a timestamp at a time of encryption. The one or more computer processors decrypt the tagged set of encrypted hypervisor data utilizing a software asset manager and the plurality of respective asymmetric encryption keys determined valid based on a threshold time period and the tagged timestamp. The one or more computer processors validate the set of decrypted hypervisor data utilizing corresponding checksums to determine whether the set of encrypted hypervisor data was successfully decrypted. The one or more computer processors sanitize the validated hypervisor data based on a corresponding software license.

Secure virtual machine software management

One or more processors receive resource type and capability information and activity information of workloads of a domain. A first model is generated and trained to map the resource information to the activity information of domain workloads. The activity information is decomposed into a set of activity core elements (ACEs). The one or more processors generate a second model, wherein the second model is trained to predict a set of resource types and resource capabilities of the respective resource types, based on an input of the first set of ACEs decomposed from the activity information of the workloads of the domain. The one or more processors receive a second set of ACEs that are decomposed from activities associated with an unprecedented workload, and the one or more processors generate a predicted set of resources to perform the second set of ACEs.

Prediction of proficient resources for performing unprecedented workloads using models

Providing a method for real-time testing and monitoring of a business process management system in order to identify commonly failing parameters. Machine learning methods are used to run multiple rounds of testing of the business process management system to more accurately identify commonly failing parameters and to modify the business process by removing those identified parameters from future rounds of testing.

Real time testing and monitoring for business process management systems

A computer implemented method and related system determine a current load result of a software container executing on a compute node in a container system. In response to determining that the current load result exceeds a predetermined scale-up threshold for the software container, the method adds a first plurality of replicas of the software container to the compute node, where a quantity of the first plurality of replicas is related to the current load result. In response to determining that the current load result is less than a predetermined scale-down threshold for the software container, the method deletes a second plurality of replicas of the software container from the compute node, where a quantity of the second plurality of replicas is related to the current load result.

Service load independent resource usage detection and scaling for container-based system

Provided are a computer program product, system, and method for scanning a computing system to determine a computing system profile and problems to recommend actions to initiate with the computing system. A package is transmitted to the computing system including package code to scan the computing system to determine a computing system profile comprising a computing architecture and installed applications at the computing system. The computing system profile is processed to determine a recommended action to perform with respect to the computing system to improve operations of the computing system based on the computing system profile. A display element is generated in a user interface with information on the recommended action to enable a user of the computing system to implement the recommended action. The package code executes within the computing system without communicating over the network to an external system outside of a computing environment of the computing system.

Scanning a computing system to determine computing profile and problems to recommend an action to initiate with the computing system

Technology for logging application usage based on monitoring of read or change operations on database elements and then using the information from log data to determine application usage states (for example, active, inactive) in time.

Product usage discovery signature based on database table content changes

An image for a containerized application is created. From the image, one or more main processes of the containerized application are identified. The one or more main processes comprise a first subset of a plurality of processes of the containerized application. Within a sandbox environment, the containerized application is started. Based on the started application within the sandbox environment, a second subset of processes within the plurality is determined. The second subset includes one or more dependent processes associated with the first subset. A third subset of processes within the plurality is determined. The third subset excludes the first and second subsets and is associated with a vulnerability list. According to the third subset, a mitigated image for the containerized application is generated.

Automatic vulnerability mitigation

Aspects of the present invention disclose a method for deploying an application in a computing environment receiving an application module, determining values of a first set of metadata for the received application module, determining a classification of the received application module based at least in part on the values of the first set of metadata, and determining whether the received application is deployable in at least an off-premise system based at least in part on the classification.

Machine learning based application deployment

One or more computer processors install a trigger on a primary database. The one or more computer processors, responsive to the trigger activating and a data modification associated with the primary database, format the data modification into a universal format for a plurality of backup databases. The one or more computer processors rotate an active backup database from the plurality of backup databases based on a determined alternating backup period. The one or more computer processors synchronize in real-time the primary database with the active backup database.

Client-less database system recovery

A first computer system is scanned at configured, default time intervals by a software asset management ('SAM') software application installed on the first computer system, wherein the scanning detects other software applications installed on the first computer system. The SAM software application generates a list of the other software applications installed on the first computer system and stores the list on a computer readable storage medium. An override software module triggers the SAM software application to perform an early scan of the first computer system, before a scan of the first computer system that the SAM software application would otherwise perform at a next default scan time. The triggering is in response to information obtained from a source external to the first computer system about a triggering one of the software applications on the list.

Technology for adaptive software discovery scan

Provided are techniques for automated software application license usage. Global detection results that indicate, for each of a plurality of end user computers, one or more installed software applications, one or more running software applications, and a user account. Unique pairs are identified using the global detection results, wherein each pair of the unique pairs comprises a software application name for a software application and a user name for a user. For a unique pair, a query is run against a user registry to get a list of user groups that the user name is a member of, a user group is selected that corresponds to the software application name, and a number of users in the selected user group is designated as a license demand for authorized users for the software application. Then, based on the global detection results and the license demand, one or more recommendations are provided.

Growing community of inventors

Krakow, Poland

Michal S Paluch