International Business Machines Corporation

Hewlett-packard Development Company, L.p.

Nitzan Peleg

Moshe Klausner

Yuval Sherman

Eliezer Levy

Indrajit Poddar

Alain Charles Azagury

Tal Drory

Amir Bar-Or

Michael Rodeh

Erez Hadad

Sadek Jbara

Alexey Miroshkin

Igor Khapov

Ilsiyar I Gaynutdinov

Grigori Chtrasberg

Yaakov Yaari

Omri Soceanu

David Konopnicki

Hansjorg Zeller

Ronen Itshak Kat

Ayman Jarrous

Dov Murik

Omer Y Boehm

Bilha Mendelson

Oleg Blinder

Boaz Ben-Zvi

Omer-Yehuda Boehm

Systems for generating attack event logs are disclosed. An example system includes a storage device for storing an event log template. The system also includes a processor to receive a selection of the event log template, and receive an attack description comprising user instructions to fabricate synthetic log entries according to a format defined in the event log template. The attack description includes variables and rules for determining values for the variables. The processor generates the attack event log by determining values that satisfy the rules and writing the values into selected fields of the event log template.

Techniques for cyber-attack event log fabrication

A software container image that includes components dependent on a first computer instruction set architecture (ISA) is ported to enable a container to execute using the container image on a computer having a second ISA different from the first. Porting the container image entails replacing components of the container image not compatible with the second ISA with equivalent components compatible with the second ISA. The porting is performed, in some instances, dynamically as part of running a container with the container image on a computer implementing the second ISA.

ISA-ported container images

A method, computer program product, and computer system are provided. A processor receives an executable file for execution by an operating system, where the executable file includes a plurality of sections in a first order. A processor determines a second order that indicates a loading order for the plurality of sections, where the second order is distinct from the first order. A processor loads the plurality of sections of the executable file into a plurality of locations in memory of a device based on the second order. A processor resolves one or more memory references for the plurality of sections based on the plurality of locations in memory. A processor executes the plurality of sections of the executable file in the plurality of locations in memory.

Compiler assisted protection against arbitrary code execution

A method, computer program product and/or system is disclosed. According to an aspect of this invention, one or more processors receive an indirect jump instruction comprising a target address offset and a maximal offset value. One or more processors determine whether the target address offset is valid by comparison of the target address offset and the maximal offset value and one or more processors execute a jump operation based on whether the target address offset is valid. In some embodiments of the present invention, the jump operation comprises one or more processors executing an instruction located at a target address referenced by the target address offset if the target address offset is valid. In some embodiments, the jump operation further comprises one or more processors raising an exception if the target address offset is not valid.

Mitigation of code reuse attacks by restricted indirect branch instruction

Input is received during runtime of a program. The input is a return instruction address of a called function and a return target address of the program. A determination is made whether the instruction immediately prior to the return target address is a call to the called function. If the instruction immediately prior to the return target address is not a call to the called function, a notification is transmitted that return-oriented programming is suspected.

Runtime return-oriented programming detection

An aspect includes performance profiling of an application. A processor executes an instruction stream of the application including instructions that are dynamically grouped at run-time. The processor monitors for an event associated with sampled instructions. A sampled instruction is associated with other events that include instruction grouping information. A number of the instructions in a group that includes the sampled instruction is determined as a group size. The monitored event is tracked as separate events with respect to each of the sampled instruction and one or more other instructions of the group. Subsequent monitored events are tracked as the separate events for each of the instructions from additional groups having various group sizes formed from a sequence of the instructions. An execution count for the sequence of the instructions is generated based on accumulating the separate events over a period of time.

Basic block profiling using grouping events

A method comprising: counting each occurrence of a hardware event by a Performance Monitoring Counter of a hardware processor during the execution of a target program code; orderly and continuously storing in a buffer of a Taken Branch Trace (TBT) Facility of said hardware processor a predefined TBT size of last taken branches of said target program code during its execution; every time said counting equals a sampling rate, triggering sampling of said buffer, to receive a TBT comprising current said predefined TBT size of last taken branches; constructing a full branch trace for each said TBT based on said target program code; extracting a predefined Chopped Branch Trace (CBT) size of last branches from each said full branch trace, to receive a chopped branch trace for said each TBT; and incrementally storing each said chopped branch trace to generate an edge profile of said target program code.

Hardware-based edge profiling

Batch processing machines, systems and methods are provided. The method comprises copying target data from a target location to a first data storage medium, wherein the target data stored in the first data storage medium is utilized by a batch process; executing the batch process; checkpointing state information for the batch process at one or more time intervals while the batch process is executing; determining whether a data record in the target data stored in the target location was updated while the batch process was executing; and reinstating the batch process from a point in time prior to an earliest point in the batch process when a representation of an updated data record in the target data in the target location was accessed by the batch process.

Restarting a batch process from an execution point

A method, apparatus and product for data prefetching. The method comprising: prefetching data associated with a load instruction of a computer program, wherein the prefetching is performed in anticipation to performing the load instruction, whereby the data is retained in the cache; detecting whether the prefetched data of the prefetching is invalidated after the prefetching commenced and prior to performing the load instruction; and adaptively determining whether to modify the prefetching data operation associated with the load instruction in response to the detection.

Modifying data prefetching operation based on a past prefetching attempt

A computer implemented method, apparatus, and computer program product for generating an optimization insensitive behavior profile. In one embodiment, a source identifier is assigned to each instruction in an original control flow graph representing a program code prior to optimization. The identifiers identify a basic block associated with the instruction or a group of basic blocks. A source identifier in the set of source identifiers is assigned to instructions in an optimized control flow graph representing the program code after optimizing the program code. The instructions in the optimized control flow graph are mapped to the original control flow graph using the set of source identifiers to form a mapping transformation. Behavior profile data associated with the optimized program code is moved to basic blocks in the original control flow graph using the mapping transformation to form the optimization insensitive behavior profile.

Detecting change in program behavior for adaptive code optimization

A disclosed embodiment relates to a system for populating an index table. The system comprises a component that decomposes a spatial object into a set of object pairs, a component that employs a value associated with the object pairs to sort the set of object pairs into a sequence of object pairs, a component that uses a sliding border analysis to create a subset of the sequence of object pairs depending upon a position of the object pair in the sequence of object pairs, and a component that populates the index table with the subset of object pairs.

Method and apparatus for populating an index table

The disclosed embodiments relate to an apparatus for performing query operations. The apparatus comprises a base table having spatial objects, an index table having data entries that are associated with the spatial objects. A module that is adapted to perform the query operation is configured to convert a query window into values, create a scan range for each of the values with a begin range value, an end range value, and a stop condition, scan the data entries for each of the scan range to identify one of the end range value and the stop condition, and return a result based upon the data entries that are within the scan range for each of the values.

Growing community of inventors

Haifa, Israel

Nitzan Peleg