International Business Machines Corporation

Ofer Haim Biller

Oded Sofer

David Rozenblat

Boris Rozenberg

Eitan D Farchi

Peter Bak

Yair Allouche

Ravid Sagy

Aviad Cohen

Rosa Miroshnikov

Rotem Blinder

Adir Even

Tal Daniel

Mazal Yakoobov

An example system includes a processor to monitor activity on a database server to generate an events stream. The processor can convert the events stream into a time series that approximates activity load at the database server using an exponential smoothing. The processor can also send the time series to a streaming analytics engine.

Approximating activity loads in databases using smoothed time series

In some examples, a system for decorating network traffic flows with outlier scores includes a processor and a memory device to store traffic flows received from a network. The processor is configured to receive a set of traffic flows from the memory device and generate a tree model to split the traffic flows into clusters of traffic flows. Each cluster corresponds with a leaf of the tree model. The processor is further configured to generate machine learning models for each of the clusters of traffic flows separately. For a new traffic flow, the processor is configured to identify a specific one of the machine learning models that corresponds with the new traffic flow, compute an outlier score for the new traffic flow using the identified specific one of the machine learning models, and decorate the new traffic flow with the outlier score.

Cluster-based outlier scoring of network traffic

A computer-based system and method for classifying users of a database including obtaining an activity rate time series describing activity level of a database user versus time, extracting features from the activity rate time series, the features including a measure of repetition in the activity level, mean activity load and a percentage of the time in which the user is active, and determining a type of the database user based on the extracted at least one feature. The measure of repetition in the user activity is calculated by performing a Fourier transform on the activity rate time series to produce a transformed series; detecting spikes in the transformed series; and measuring a percentage of information in the transformed series which is included in the spikes.

Classifying users of a database

A computer-based system and method for classifying data in real-time for data streaming may include: capturing a plurality of data packets flowing between a data source machine and a data client; searching at least one of the data packets for tokens associated with sensitive information; if tokens associated with sensitive information are not found in a data packet: allowing the data packet to flow between the data source machine and the data client; and sending the data packet to a comprehensive security analysis; and if tokens associated with sensitive information are found in the data packet: preventing the data packet form flowing between the data source machine and the data client; and sending the data packet to a comprehensive security analysis.

Sensitive data identification in real time for data streaming

A computer-based system and method for optimizing execution of regular expression rules, each including one or more sub-rules, may include: testing, by a processor, the sub-rules against a data sample; measuring, by a processor and based on the testing, the probability for every sub-rule that it appears in the data sample, and the processing time of each sub-rule; and finding, by a processor, an order of execution of at least a subset of the sub-rules to shorten the total execution time of validating the regular expression rules, based to the probability and the execution time of each of the sub-rules.

Classification by optimizing regular expression rules

In a present invention embodiment, time series data is received including information pertaining to a corresponding attribute of monitored activity on a processing device. An upper bound of the time series data is determined based on a weighted combination of a prior upper bound and a current value derived from the time series data. Greater weight is provided to greater values in the time series data based on an exponent applied to the prior upper bound and the current value and an effect of older values in the time series data decays over time based on a smoothing factor applied to exponential values of the prior upper bound and the current value. The upper bound is applied to a profile of an entity, and abnormal activity on the processing device is detected based on a comparison of the upper bound to a corresponding bound of the profile.

Detecting abnormal database activity

In some examples, a system for detecting unauthorized user actions can include a processor to identify a plurality of objects and at least one user event to be monitored. The processor can also map the plurality of objects and the at least one user event to separate hyperplanes of a multi-dimensional visualization and apply at least one force to the plurality of objects. Additionally, the processor can detect a malicious user based on a movement of at least one of the objects as a result of applying the at least one force, and execute a security command to prevent the malicious user from accessing data.

Detecting unauthorized user actions

A computer-implemented method, computerized apparatus and computer program product for hierarchical objects linkage data visualization. A visualization of linkage data comprising a plurality of connections between a set of source objects and a set of target objects is obtained with respect to a predetermined level of hierarchy defined over attributes of at least one of the sets, wherein attributes of the objects and connections therebetween are represented in the visualization as nodes and links of a bipartite graph respectively. A spatial layout of links of a node is modified based on a relative position of each neighbor node thereof in an adjacent level, wherein neighboring nodes represent attributes of one or more objects which share in common an attribute represented by the node, wherein the relative position is determined based on a visualization restricted to the neighboring nodes so as to obtain a position preserving layout.

Hierarchical objects linkage data visualization

In some examples, a system for detecting unauthorized data access can include a processor to detect a suspicious operation to be executed by the system and review a plurality of highlights corresponding to the suspicious operation. The processor can also determine that a predefined cyber security image corresponding to the highlights and the suspicious operation does not exist and generate the predefined cyber security image based on a plurality of sub-cyber security images. Furthermore, the processor can store the predefined cyber security image in a cyber security image repository and prevent the suspicious operation from being executed.

Unauthorized data access detection based on cyber security images

In some examples, a system or detecting unauthorized user actions can include a processor to identify a plurality of objects and at least one user event to be monitored. The processor can also map the plurality of objects and the at least one user event to separate hyperplanes of a multi-dimensional visualization and apply at least one force to the plurality of objects. Additionally, the processor can detect as malicious user based on a movement of at least one of the objects as a result of applying the at least one force, and execute a security command to prevent the malicious user from accessing data.

Methods, computing systems and computer program products implement embodiments of the present invention that include assigning, to multiple users, respective sets of original roles for accessing data stored on a computer system, and performing, in response to requests from the users, multiple operations on the data. While performing the multiple operations on the data, a transaction log is generated that includes a plurality of entries, each of the entries storing attributes of a given operation. Based on the entries in the log file, a respective set of learned roles for respective users is identified, and the respective sets of the learned roles are assigned to the respective users.

Evidence-based role based access control

Embodiments are directed to a computer-based system for tuning roles. The system includes a memory and a processor system communicatively coupled to the memory. The processor system is configured to receive at least one database access log file and existing role definitions of the system. For each role, the processor system is further configured to create an existing user to permission assignment (EUPA) based at least in part on the existing role definitions of the system. For each role, the processor system is further configured to identify logical sessions in the at least one database access log file and create a demonstrated user to permission assignment (DUPA) formed at least in part from data of the identified logical sessions. For each role, the processor system is further configured to create a final user to permission assignment (FUPA) including a function of the EUPA and the DUPA.

Growing community of inventors

Midreshet Ben Gurion, Israel

Ofer Haim Biller