International Business Machines Corporation

Oleg Blinder

Tamer Salman

Akram Bitar

Ronen Levy

Omri Soceanu

Micha Gideon Moffie

Nitzan Peleg

Omer Y Boehm

A computer-implemented method, according to various approaches, includes causing a predetermined HRL agent to perform, in a controlled environment, execution of a first potentially malicious API call against a predetermined API. Performing execution of the first potentially malicious API call against the predetermined API includes: causing a first sub-agent of a first stage of an architecture of the HRL agent to make a first selection for defining a first portion of a first API call. Performing execution of the first potentially malicious API call against the predetermined API furthermore includes causing a second sub-agent of a second stage of the architecture of the HRL agent to make a second selection for defining a second portion of the first API call, and issuing the first API call to the predetermined API. First reward-based feedback is provided to the first sub-agent and the second sub-agent.

Using hierarchical reinforcement learning (HRL) to identify application programming interfaces (API) vulnerabilities

Systems for generating attack event logs are disclosed. An example system includes a storage device for storing an event log template. The system also includes a processor to receive a selection of the event log template, and receive an attack description comprising user instructions to fabricate synthetic log entries according to a format defined in the event log template. The attack description includes variables and rules for determining values for the variables. The processor generates the attack event log by determining values that satisfy the rules and writing the values into selected fields of the event log template.

Techniques for cyber-attack event log fabrication

Methods, computing systems and computer program products implement embodiments of the present invention that include receiving a request to fabricate, for a database including multiple tables, a respective target number of data records for each of the tables, and receiving one or more intra-database rules for the multiple tables. Examples of the intra-database rules include cross-record rules and cross-table rules. Upon identifying one or more referential integrity constraints for the multiple tables, the respective target number of data records for each of the multiple tables are fabricated in response to the request. In embodiments of the present invention, the fabricated data records comply with the one or more referential integrity constraints and the one or more intra-database rules.

Database table data fabrication

Methods, computing systems and computer program products implement embodiments of the present invention that include defining multiple data fabrication rules, each of the data fabrication rules including a fabrication time and a data operation. a simulation of a software application is initiated, the simulation including a sequence of simulation times, and upon detecting, during the simulation, one or more first given fabrication rules having respective fabrication times matching one or more first simulation times, fabricated data is generated in response to performing the respective data operation of each of the detected one or more first given fabrication rules. Upon detecting, during the simulation, a second given fabrication rule whose fabrication time matches a second simulation time subsequent to the one or more first simulation times, the data operation of the second given fabrication rule is performed on a subset of the fabricated data.

Growing community of inventors

Haifa, Israel

Oleg Blinder