International Business Machines Corporation

Oded Sofer

Ofer Haim Biller

Boris Rozenberg

Alexander Pyasik

Yifat Yulevich

David Rozenblat

Guy Galil

Rosa Miroshnikov

Allon Adir

Ehud Aharoni

Itai Gordon

Oded Margalit

Ilan D Prager

Lev Greenberg

Shlomit Avrahami

Leonid Gorelik

Yakir Keisar

Or Bar-Yaacov

Tali Finelt

Peter Bak

Yair Allouche

Roza Miroshnikov

Adir Even

Rotem Blinder

Mazal Yakoobov

Zamir Paltiel

Benazeer Daruwalla

Tal Daniel

Guy Gonen

An example system includes a processor to monitor activity on a database server to generate an events stream. The processor can convert the events stream into a time series that approximates activity load at the database server using an exponential smoothing. The processor can also send the time series to a streaming analytics engine.

Approximating activity loads in databases using smoothed time series

A computer-based system and method for classifying users of a database including obtaining an activity rate time series describing activity level of a database user versus time, extracting features from the activity rate time series, the features including a measure of repetition in the activity level, mean activity load and a percentage of the time in which the user is active, and determining a type of the database user based on the extracted at least one feature. The measure of repetition in the user activity is calculated by performing a Fourier transform on the activity rate time series to produce a transformed series; detecting spikes in the transformed series; and measuring a percentage of information in the transformed series which is included in the spikes.

Classifying users of a database

Automated classification of sensitive data in a database, which includes: Retrieving a catalog of a database. Sampling record values from at least some of the columns. Generating a map of probable associations between different columns of tables of the database. Applying a machine learning classifier to the sampled record values, to classify the columns of the sampled records into multiple data classes, some being sensitive data classes. Classifying columns of non-sampled record values according to the classification of the sampled record values, based on the map. Searching all objects of the database for existence of record values of the classified columns, to output value and field name pairs. Scoring the pairs according to a measure of their repetitiveness in the output. Increasing the score of the pairs whose field names are similar. Based on the scores, indicating which fields of the database are likely to include sensitive data.

Automated sensitive data classification in computerized databases

A computer-based system and method for classifying data in real-time for data streaming may include: capturing a plurality of data packets flowing between a data source machine and a data client; searching at least one of the data packets for tokens associated with sensitive information; if tokens associated with sensitive information are not found in a data packet: allowing the data packet to flow between the data source machine and the data client; and sending the data packet to a comprehensive security analysis; and if tokens associated with sensitive information are found in the data packet: preventing the data packet form flowing between the data source machine and the data client; and sending the data packet to a comprehensive security analysis.

Sensitive data identification in real time for data streaming

A computer-based system and method for optimizing execution of regular expression rules, each including one or more sub-rules, may include: testing, by a processor, the sub-rules against a data sample; measuring, by a processor and based on the testing, the probability for every sub-rule that it appears in the data sample, and the processing time of each sub-rule; and finding, by a processor, an order of execution of at least a subset of the sub-rules to shorten the total execution time of validating the regular expression rules, based to the probability and the execution time of each of the sub-rules.

Classification by optimizing regular expression rules

In a present invention embodiment, time series data is received including information pertaining to a corresponding attribute of monitored activity on a processing device. An upper bound of the time series data is determined based on a weighted combination of a prior upper bound and a current value derived from the time series data. Greater weight is provided to greater values in the time series data based on an exponent applied to the prior upper bound and the current value and an effect of older values in the time series data decays over time based on a smoothing factor applied to exponential values of the prior upper bound and the current value. The upper bound is applied to a profile of an entity, and abnormal activity on the processing device is detected based on a comparison of the upper bound to a corresponding bound of the profile.

Detecting abnormal database activity

Techniques for detecting network intrusions are disclosed. An example intrusion detection system includes a storage device to store audit data generated by a network traffic analyzer in accordance with an audit policy that determines an auditing level. The system also includes a processor to receive a case defined by a case definition, wherein the case definition comprises a plurality of symptoms and each symptom is defined by a separate symptom definition. The processor performs queries of the audit data in accordance with each of the symptoms to generate captured symptom data. The symptoms are scored based on the captured symptom data to generate symptom scores, and the symptom scores are summed to generate a case score. If the case score exceeds an alert threshold specified by the case definition, the processor issues an alert.

Dynamic gathering of attack symptoms

A computer-based system and method for monitoring of movement of data in a computer network, including: parsing a message, the message including one of a data access command sent to a computer database and a response to a data access command, to extract a template, metadata and data of the data access command, examining the template, metadata and data of the message to identify messages related to movement of data that is classified as sensitive, and generating a flow graph indicative of new locations of the sensitive data. Policy rules may be applied to the new locations of the sensitive data to monitor access to the new location.

Dynamic monitoring of movement of data

An example system includes a processor to monitor a user interface to generate activity logs including step-flows. The processor is to extract features and common variables from unstructured data in the activity logs and generate structured log events based on the extracted features and the common variables. The processor is to generate a workflow model based on the structured log events. The processor is to automate or assist workflow based on the generated workflow model.

Assisting and automating workflows using structured log events

A system and method for dynamically determining a trust level of an end-to-end link of a computer database, including: in a preparation stage: capturing a first set of messages of an end-to-end link; compressing a skeleton of each message of the first set of messages to generate a construct of each message of the first set of messages, the skeleton includes the message without a value field; creating a characteristic histogram of the constructs of the first set of messages; and during an operation stage: capturing a second set of messages of the end-to-end link; compressing a skeleton of each message of the second set of messages to generate a construct of each of the second set of messages; creating a work histogram of the constructs of the second set of messages; and determining a trust level of the end-to-end link by comparing the work histogram with the characteristic histogram.

Dynamically determining a trust level of an end-to-end link

In some examples, a system for detecting unauthorized user actions can include a processor to identify a plurality of objects and at least one user event to be monitored. The processor can also map the plurality of objects and the at least one user event to separate hyperplanes of a multi-dimensional visualization and apply at least one force to the plurality of objects. Additionally, the processor can detect a malicious user based on a movement of at least one of the objects as a result of applying the at least one force, and execute a security command to prevent the malicious user from accessing data.

Detecting unauthorized user actions

Detecting malware attacks is described herein. A computer-implemented method may include receiving, via a processor, events from a plurality of activity monitors. The method also include extracting, via the processor, a plurality of behavioral features from the received events. The method may further include detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data using a machine learning technique, wherein the private data includes private enterprise attack findings. The method may also include executing, via the processor, an ad hoc protection improvement based on the detected malware attack.

Detecting malware attacks using extracted behavioral features

A computer-implemented method, computerized apparatus and computer program product for hierarchical objects linkage data visualization. A visualization of linkage data comprising a plurality of connections between a set of source objects and a set of target objects is obtained with respect to a predetermined level of hierarchy defined over attributes of at least one of the sets, wherein attributes of the objects and connections therebetween are represented in the visualization as nodes and links of a bipartite graph respectively. A spatial layout of links of a node is modified based on a relative position of each neighbor node thereof in an adjacent level, wherein neighboring nodes represent attributes of one or more objects which share in common an attribute represented by the node, wherein the relative position is determined based on a visualization restricted to the neighboring nodes so as to obtain a position preserving layout.

Hierarchical objects linkage data visualization

Embodiments of the present invention may provide the capability to identify security breaches in computer systems from clustering properties of clusters generated based on monitored behavior of users of the computer systems by using techniques that provide improved performance and reduced resource requirements. For example, behavior of users or resources may be monitored and analyzed to generate clusters and train clustering models. Labeling information relating to some user or resource may be received. When users or resources are clustered and when a cluster contains some labeled users/resources then an anomaly score can be determined for a user/resource belonging to the cluster. A user or resource may be detected to be an outlier of at least one cluster to which the user or resource has been assigned, and an alert indicating detection of the outlier may be generated.

Identifying security breaches from clustering properties

In some examples, a system for detecting unauthorized data access can include a processor to detect a suspicious operation to be executed by the system and review a plurality of highlights corresponding to the suspicious operation. The processor can also determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist and generate the predefined cyber security image based on a plurality of sub-cyber security images. Furthermore, the processor can store the predefined cyber security image in a cyber security image repository and prevent the suspicious operation from being executed.

Growing community of inventors

Midreshet Ben Gurion, Israel

Oded Sofer