International Business Machines Corporation

Mohammadreza Barouni Ebrahimi

Obidul Islam

Samaneh Bayat

Iosif Viorel Onut

Vishwanath Ramaswamy

Ebrahim Bagheri

Zeinab Noorian

A computer-implemented method identifies strings of data from a database. One or more processors receive data as an input string. The processor(s) generate a first binary code using a binary locality sensitive hashing of k-grams in the input string, where the binary locality sensitive hashing on the k-grams in the input string is derived from a first set of bi-grams in the input string, a second set of bi-grams in the input string, and a quantity of intersecting bi-grams from the first set of bi-grams and the second set of bi-grams. In response to receiving a search request for a particular string, the processor(s) generate a second binary code using a binary locality sensitive hashing on the particular string, and search a database in a query process. The processor(s) then rank and return a set of similar strings found in the database.

Matching strings in a large relational database

Mechanisms are provided for accessing security vulnerability issue information. The mechanisms monitor security analyst interactions with security vulnerability issues via the security management system to generate analyst interaction log data, and generate one or more security analyst models corresponding to one or more security analysts by performing a machine learning operation on the analyst interaction log data. The mechanisms generate an analyst-issue model based on the one or more security vulnerability issue models and the one or more security analyst models, and generate an issue recommendation for a security analyst based on the analyst-issue model.

Recommending the most relevant and urgent vulnerabilities within a security management system

A method for ambiguity resolution in retrieving security information. A unified representation model utilizing the security information mined from a group of sources is generated by a computer system, wherein the unified representation model represents terms in the security information using vectors that describe locations in space for the terms. Distances between the terms indicate correlations between the terms, and the terms are for security concepts in the security information. The computer system represents the security concepts utilizing a group of weighted graphs that identifies semantic-relatedness between the terms utilizing the vectors in the unified representation model, wherein the group of weighted graphs enables interpreting queries with reduced ambiguity. The computer system interprets a seed query utilizing the group of weighted graphs. The computer system retrieves a portion of the security information utilizing the seed query interpreted utilizing the group of weighted graphs.

Ambiguity resolution system and method for security information retrieval

A method prevents source code from using an unsecure application program interface (API) due to a change to the source code. One or more processors and/or a user identify changes in source code. The processor(s) and/or user associate the changed code with affected APIs that are used by the changed code, and identify which commands are utilized by the changed code. The processor(s) and/or user determine that at least one command utilized by the changed code causes the source code to use an unsecure API. In response to determining that the at least one command utilized by the changed code causes the source code to use the unsecure API, the processor(s) and/or user modify the changed code to prevent the source code from using the unsecure API.

Security scanning of application program interfaces that are affected by changes to source code

A computer-implemented method searches a database for a particular string. One or more processors receive data as an input string, and then identify multiple k-grams in, unique characters in, and a length of the input string. The one or more processors perform binary locality sensitive hashing on the k-grams, the unique characters, and the length for the input string, and then sum the binary locality sensitive hashings to create a first addition vector, which is used to generate a first binary vector. The same process is performed on a particular string being requested to generate a second binary vector. The one or more processors then search the database for the particular string that was requested using the second binary vector in a large scale hamming distance query process that determines a hamming distance between the first binary code and the second binary code.

A computer-implemented method improves the security of a system. One or more processors identify changes in source code, resulting in changed code in the source code. The one or more processors associate the changed code with affected application program interfaces (APIs) that are used by the changed code, and then manipulate parameters within the affected APIs based on the changes in the source code. The one or more processors execute a dynamic security scan on only the affected APIs using the manipulated parameters, in order to identify security vulnerabilities in only the affected APIs. The one or more processors then modify the source code to remove the security vulnerabilities in only the affected APIs, thus improving the security of the system on which the source code is running.

A processor determines whether a DOM includes a repetitive pattern of a combination, formed by a tag of a leaf node and a tag of a parent node of the leaf node. Determining the repetitive pattern of the combination, the processor identifies a first inner cluster is identified by collapsing multiple instances of the repetitive pattern into a single instance. The processor generates a LSH signature for the single instance of the repetitive pattern. The processor determines an outer cluster, based on grouping one or more inner clusters, as part of a section rooted at a source node of the DOM, in which the source node is a parent node of the one or more inner clusters. Determining that a pair of outer clusters are near repetitive, the processor limits web content exploration to one of the pair of outer clusters.

Growing community of inventors

Ottawa, Canada

Mohammadreza Barouni Ebrahimi