International Business Machines Corporation

Citibank, N.a.

Oded Margalit

Ehud Aharoni

Yair Allouche

Ravid Sagy

Eitan D Farchi

Danny Harnik

Allon Adir

Dmitry Sotnikov

Omer Y Boehm

Yousef Shajrawi

Michael Vinov

Uri Kahana

Max Leibovich

Mickey Hovel

Ilia Shevrin

Robert J Baseman

Noam Slonim

Oded Sofer

Adam D Ticknor

Raminderpal Singh

Hong Lin

Fateh A Tipu

Yossi Gilad

Ramona Kei

Michal Rosen-Zvi

Kevin MacKey

Timothy M McCormack

Dennis Potashnik

Kat I Ronen

Itzhack Goldberg

Jonathan Amit

David Darden Chambliss

Haggai Roitman

Harry R McGregor

Christopher B Moore

Sergey Marenkov

Chaim Koifman

Ron Asher

Mattias Marder

David Konopnicki

Nir Halowani

Lev Greenberg

Lilia Demidov

Doron Cohen

Amir Nahir

Alexander Ivrii

Udi Barzelay

Dalit Naor

Dror Porat

Ophir Azulai

Alexandra Shulman-Peleg

David Amid

Yehuda Naveh

Eitan Menahem

Ateret Anaby-Tavor

Dafna Sheinwald

Boris Rozenberg

Gil Eliezer Shurek

Michal Shmueli-Scheuer

Andrey Finkelshtein

Hana Chockler

Dmitry Pidan

George Goldberg

Ron Peleg

Yaron Wolfsthal

Ofer Shir

Gil Vernik

Sitvanit Ruah

Shmulik Regev

Arie Matsliah

Ilia Averbouch

Rosa Miroshnikov

Shahar Chen

David Asulin

Yael Ben-Haim

Tom Weiss

Yaniv Bouhadana

Shay Davidpur

Elroi Luria

Dina Vaingolts

Joseph Tal

Gadi Aleksandrowicz

A model checking system configures a formal compliance document with remediation actions to correct security conflicts in an IAM system. The system applies a model checker on an abstract model of the IAM system to identify security conflicts and identifies remediation actions from the formal compliance document. The system applies the model checker after applying the first remediation action and determines whether the first remediation action creates another security conflict. If a remediation action is identified that does not create a new security conflict, then the system applies the identified remediation action. The formal compliance document is updated accordingly. When an operator revises code for a policy change, the system will apply the model checker on an abstract model of the IAM system with the code revision to identify security conflicts. If new security conflicts are not created in the simulation, then the system may deploy the code revision.

Security remediation

A model checking system detects violations and conflicts in security and verification policies by running model checking processes. The system detects privilege escalation attacks in misconfigured identification and access management ('IAM') policies by modeling security policy documents and IAM actions as logical formulas and then running model checking on the model. The system translates non-Boolean variables, such as string variables, into Boolean variables in order to apply an SAT model checker. The model checker also determines whether a policy violation can be achieved in a finite number of steps by elevating privileges of some compromised principal over multiple iterations of the model checking process, or proves absence thereof.

Security policy validation

An identity verification system enables peer-to-peer authentication in a potentially insecure channel by leveraging a secure channel communication. The system authenticates a user via an identity verification application. The system provides a validation code to the user. The user communicates the validation code to a counterparty of the peer-to-peer communication. The system receives a request to authenticate the counterparty with the validation code and counterparty authentication data. The system authenticates the counterparty and sends the user the authentication of the counterparty. Alternatively, the user device communicates a request to generate a secure code for participants in a first insecure group application session. The user device selects an authenticated counterparty to receive the secure code from a list of authenticated counterparties. The user creates a second application session using the secure code as a password. Unauthenticated counterparties would not receive the secure code and are restricted from the new session.

Peer-to-peer authentication with a secure channel communication

Systems and methods provide a platform for threat information sharing. A method comprises transmitting an access permission request to a blockchain network. The request asks for access to cyber threat information stored in at least one cyber threat information storage system. The information may come from a plurality of organizations. The blockchain network may include a blockchain ledger storing access control information from the plurality of organizations. Upon receipt of a reference to an access permission token generated by the blockchain network using at least one smart contract, a transaction request to the cyber threat information server may be sent. In response to the transaction request including the reference to the access permission token, the requested cyber threat information may be retrieved from the cyber threat information server.

Threat information sharing based on blockchain

An example system includes a processor to monitor a user interface to generate activity logs including step-flows. The processor is to extract features and common variables from unstructured data in the activity logs and generate structured log events based on the extracted features and the common variables. The processor is to generate a workflow model based on the structured log events. The processor is to automate or assist workflow based on the generated workflow model.

Assisting and automating workflows using structured log events

A method for training thresholds controlling data flow in a plurality of cascaded classifiers for classifying malicious software, comprising: in each of a plurality of iterations: computing a set of scores, each for one of a set of threshold sequences, each threshold sequence is a sequence of sets of classifier output thresholds, each set of classifier output thresholds used to control a flow of data from a first cascaded classifier of the plurality of cascaded classifiers to a second cascaded classifier of the plurality of cascaded classifiers, each score computed when classifying, using the respective threshold sequence, each of a plurality of software objects as one of a set of maliciousness classes; computing a set of new threshold sequences by applying a genetic algorithm to the set of threshold sequences and the set of scores; and using the set of new threshold sequences in a consecutive iteration.

System and method for staged ensemble classification

A method, computer system, and a computer program product for assessing anonymity of a dataset is provided. The present invention may include receiving an original dataset and an anonymized dataset. The present invention may also include preparing a testing dataset and a training dataset for a machine learning algorithm based on the received original dataset and anonymized dataset. The present invention may then include training a machine learning model based on the prepared training dataset. The present invention may further include generating an evaluation score based on the trained machine learning model and the prepared testing dataset. The present invention may also include presenting the generated evaluation score to a user.

Anonymity assessment system

Incremental generation of models with dynamic clustering. A first set of data is received. A first set of clusters based on the first set of data is generated. A respective first set of models for the first set of clusters is created. A second set of data is received. A second set of clusters, based on the second set of data and based on a subset of the first set of data, is generated. A respective second set of models for the second set of clusters, based on a subset of the first set of models and based on the second set of data, is created.

Incremental generation of models with dynamic clustering

Embodiments may provide Digital Rights Management techniques, not to make the reverse engineering process harder, but rather to provide detection of reverse engineering of PCBs, such as by copying of layers of trace layout, so as to enable pursuing legal remedies against the violators. For example, in an embodiment, a method of information encoding may be implemented in a computer comprising a processor, memory accessible by the processor, and computer program instructions stored in the memory and executable by the processor, the method may comprise receiving, at the computer system, information to be encoded in a printed circuit board wiring trace layout and laying out, at the computer system, a plurality of printed circuit board wiring traces so as to encode the received information.

Digital Rights Management for printed circuit boards

A method for defending a computing system against ransomware attacks is disclosed. In one embodiment, such a method includes identifying, on a computing system, files to be protected against ransomware attacks. The method appends a public key to each of the files. Upon receiving a request to modify a specific file, the method reads the public key appended to the file, requests an authentication token from a user, and computes a private key associated with the files. The method combines the public key, authentication token, and private key to generate an unlock key. This unlock key is compared to a validation key. The method authorizes modification of the file in the event the unlock key matches the validation key. A corresponding system and computer program product are also disclosed.

Proactive ransomware defense

Embodiments of the present invention may provide the capability to identify security breaches in computer systems from clustering properties of clusters generated based on monitored behavior of users of the computer systems by using techniques that provide improved performance and reduced resource requirements. For example, behavior of users or resources may be monitored and analyzed to generate clusters and train clustering models. Labeling information relating to some user or resource may be received. When users or resources are clustered and when a cluster contains some labeled users/resources then an anomaly score can be determined for a user/resource belonging to the cluster. A user or resource may be detected to be an outlier of at least one cluster to which the user or resource has been assigned, and an alert indicating detection of the outlier may be generated.

Identifying security breaches from clustering properties

A method, computer system, and a computer program product for identifying a hacked database is provided. The present invention may include generating a marked account using a plurality of data. The present invention may then include initiating a first transaction using the generated marked account. The present invention may also include determining that a second transaction has occurred using the generated marked account. The present invention may further include receiving notification of the second transaction based on determining that the second transaction occurred.

Identifying stolen databases

A computerized method comprising, on a mobile computing device, processing a vehicle integration request made by one or more of (i) the mobile computing device and (ii) a transportation vehicle. The mobile computing device computes a risk assessment value that quantifies a security risk to the transportation vehicle as a result of connecting the mobile computing device to the transportation vehicle, where the computing is based on one or more of a hardware and a software of the mobile computing device. The mobile computing device transmits the risk assessment value to a vehicle computer integrated in the transportation vehicle. The mobile computing device completes a digital data connection with the vehicle computer when the risk assessment value complies with a vehicle access security policy of the vehicle computer.

Secure mobile device integration with vehicles

Growing community of inventors

Ramat Gan, Israel

Oded Margalit