International Business Machines Corporation

Fujitsu Corporation

Naoto Sato

Hiroaki Nakamura

Takuya Mishina

Takaaki Tateishi

Shunichi Amano

Fumiko Satoh

Yoichi Hatsutori

Naoshi Tabuchi

Hiroshi Ishikawa

Michiaki Tatsubori

Shin Saito

Masaharu Sakamoto

Kugamoorthy Gajananan

Fumiko Akiyama

Kohichi Ono

Takaaki Murao

Akira Hirata

Moshe M E Matsa

Scott Boag

Kristoffer H Rose

Osamu Yamano

Yuta Aoki

Lionel A S Villard

A method is provided for reducing memory consumption by a rule engine. The method includes receiving attack trees, each having nodes and edges. Each node represents a security event and is associated with a detection rule for detecting an occurrence thereof. Each edge connects a respective node pair. The method includes assigning a watchpoint to each leaf node. The method includes moving the watchpoint assigned to any leaf node to a next upstream node, responsive to detecting an occurrence of the security event represented by the leaf node. The method includes erasing the watchpoint assigned to all downstream nodes relative to the next upstream node, responsive to the next upstream node being connected to a next downstream node using an edge having an 'OR' join type. Only the rules for nodes currently having the watchpoint assigned are loaded into a memory device during runtime, while excluding rules for remaining nodes.

Using attack trees to reduce memory consumption by rule engines

An example operation may include one or more of defining inputs, converting the inputs into an intermediate representation in Linear Dynamic Logic, and translating the intermediate representation into an executable form of the blockchain smart contract. The inputs include a regular event pattern, a temporal constraint a blockchain smart contract must satisfy, and a list of entries, each entry including an event, a condition, and a sequence of one or more actions.

Smart contract input mapping

An example operation may include one or more of defining a target specification for a blockchain smart contract, obtaining a plurality of reusable smart contracts, and creating the blockchain smart contract. Creating the blockchain smart contract includes combining the plurality of reusable smart contracts and the target specification into a first set of contracts, transforming the first set of contracts into a second set of contracts, selecting a target contract from the second set of contracts, and translating the target contract into an executable form of the blockchain smart contract. The target specification includes a regular event pattern and a temporal constraint the blockchain smart contract must satisfy. Each of the reusable smart contracts includes a reusable event pattern.

Automatic generation of smart contracts

An example operation may include one or more of identifying one or more input smart contracts, identifying a set of composition operations applicable to the one or more input smart contracts and contract specifications, combining the one or more input smart contracts using the set of composition operations, creating a composite smart contract based on the one or more input smart contracts and the set of composition operations, and translating the composite smart contract into an executable blockchain smart contract. The one or more input smart contracts, each includes a contract specification, the contract specification includes a regular event pattern and a temporal constraint the input smart contract must satisfy.

Composition operators for smart contract

Monitoring a process on an Internet of Things (IoT) device is performed by receiving, by the IoT device, a network data transfer from an external device; and receiving, by the IoT device, meta-information of the network data transfer. The meta-information can be generated, based on the network data transfer, by a network monitoring device. Additionally, the IoT device detects a file storing data of the network data transfer based on the meta-information. Further, the IoT device monitors a process relating to the detected file on the IoT device.

Monitoring a process on an IoT device

A computer-implemented method, a computer program product, and a computer system for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

Automatic transformation of security event detection rules

A computer-implemented method for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

To enable visual verification of the suitability of work items that has been recorded, with an application created in accordance with a document centric architecture. The present invention includes: extracting, from a design, a document state that will become a trigger for work activity start and a document state for the result, and, based on matching the triggers and results, diagramming through automatically structuring a flow for the plurality of activities. Specifically, design documents are analyzed and implementations for each activity support system, and extracted the collection of documents that have become the conditions for document states that will become triggers for work start, as well as the document states that will remain as work results.

Method for generating workflow from business specification

A gateway apparatus including a first inter-device interface configured to communicate with a monitoring apparatus; a second inter-device interface configured to communicate with a plurality of base station apparatuses that are subordinate; and a processor configured to generate second configuration information by a protocol conversion of converting first configuration information to a format compatible with the second inter-device interface, when the first configuration information is received from the monitoring apparatus through the first inter-device interface, the processor further configured to transmit the generated second configuration information to the plurality of base station apparatuses through the second inter-device interface.

Gateway apparatus and communications system

Aspects of the present invention provide a solution for compiling data. In an embodiment, an input query is received in a first language. The input query is translated to a nested relational algebra (NRA) in the form of a first intermediate representation (IR), wherein the first IR comprises a high-level functional language including algebraic operators. A set of algorithms of the algebraic operators is implemented to compile at least some of the first IR into a second IR, wherein the second IR comprises a data-flow language. At least one of the first IR and the second IR is compiled into a low-level code.

Compiling nested relational algebras with multiple intermediate representations

The reliability of a composite service having service components is determined, where the composite service can fail only where underlying resources fail. The composite service is represented as a plurality of continuous-time Markov chains (CTMC's). Each CTMC corresponds to a resource. A product of the CTMC's is constructed. The product encompasses composite service states. Steady-state probabilities for the product are determined. Each steady-state probability corresponds to a likelihood that a corresponding state will be a steady state. For each state of the composite service, a reward structure is determined. The reward structure corresponds to a likelihood that the state will successfully use the resources without failure. The reward structure is determined for a given state based on the given state's steady-state probability and based on discrete-time Markov chains (DTMC's) corresponding to the service components. The reliability of the composite service is determined based on the reward structure of each state.

Determining composite service reliability

A base station, to which Orthogonal Frequency Division Multiplexing/Orthogonal Frequency Division Multiple Access is applied, communicates with a mobile terminal according to Time Division Duplex, in which a transmission frame includes a downlink subframe and an uplink subframe. The base station includes multiple antennas; a radio communications part configured to transmit the downlink subframe through a first one of the antennas and to receive an initial ranging code transmitted by the mobile terminal through a second one of the antennas during the transmission of the downlink subframe; and a ranging processing part configured to perform ranging based on the initial ranging code received by the radio communications part.

Base station, mobile terminal, and communications method

The computer program enables a computer to function as: means for transforming a static call graph into a syntax tree having a binary tree structure; means for transforming a protocol state diagram into a stochastic process algebraic form; means for transforming an activity diagram into a stochastic process algebraic form; means for obtaining a stochastic process algebraic form of each of classes by merging the stochastic process algebraic form of the protocol state diagram, and the stochastic process algebraic form of the activity diagram; and means for obtaining a stochastic algebraic form of a whole system from the syntax tree, and from the stochastic process algebraic forms of the classes.

System and method for deriving stochastic performance evaluation model from annotated UML design model

A system, such as hardware or software system having a number of modules, is simulated using multi-tasking computer code. Simulation computer code launches tasks simulating system execution, where each task corresponds to a module. Each task requests a processing delay to a common scheduler. Upon the common scheduler receiving a processing delay request, the common scheduler instructs a scheduling method processor to update a task-remaining time for at least one task. The scheduling method processor updates the task-remaining time for at least one task based at least on a scheduling approach. The common scheduler sends a wait request to a preexisting simulation system to delay a module that corresponds to the task by a length of time, based on the task-remaining time for the task and the scheduling approach. The preexisting simulation system delays the module that corresponds to the task by the length of time of the wait request.

Growing community of inventors

Kawasaki, Japan

Naoto Sato