International Business Machines Corporation

Omer Y Boehm

Yousef Shajrawi

Eitan D Farchi

Oded Margalit

Michael Vinov

Omri Soceanu

Micha Gideon Moffie

Allon Adir

Ehud Aharoni

Roy Levin

Fady Copty

Lev Greenberg

Nitzan Peleg

Boris Rozenberg

Dov Murik

Eyal Kushnir

Shlomit I Shachor

Oleg Blinder

Anat Hashavit

Natalia Razinkov

A technique for privacy-preserving homomorphic inferencing using a neural network having an activation function, such as a non-linear high-degree polynomial. The network is trained to learn input features of an input feature vector together with their associated inverses. During inferencing, an encrypted data point is received at the network. The data point comprises an input feature vector that has been extended with a set of one or more additional feature values, the set of one or more additional feature values having been generated by applying a normalized inverse function to respective one or more features in the feature vector. Homomorphic inferencing is performed on the encrypted data point using the machine learning model to generate an encrypted result, which is then returned. By applying the normalized inverse function, the high-degree polynomial can use any value of an input feature during inferencing, whether the value is within or outside of a particular input range.

Non-linear approximation robust to input range of homomorphic encryption analytics

A computer-implemented method, according to various approaches, includes causing a predetermined HRL agent to perform, in a controlled environment, execution of a first potentially malicious API call against a predetermined API. Performing execution of the first potentially malicious API call against the predetermined API includes: causing a first sub-agent of a first stage of an architecture of the HRL agent to make a first selection for defining a first portion of a first API call. Performing execution of the first potentially malicious API call against the predetermined API furthermore includes causing a second sub-agent of a second stage of the architecture of the HRL agent to make a second selection for defining a second portion of the first API call, and issuing the first API call to the predetermined API. First reward-based feedback is provided to the first sub-agent and the second sub-agent.

Using hierarchical reinforcement learning (HRL) to identify application programming interfaces (API) vulnerabilities

A method comprising: obtaining multiple glossary terms each comprising one or more words; generating multiple fuzzy tokens from each word of each of the glossary terms; calculating a similarity score for each of the fuzzy tokens, the similarity score denoting a similarity between the respective fuzzy token and its respective word; obtaining multiple input terms to be matched with the multiple glossary terms; separating each of the input terms into multiple input tokens; generating multiple n-grams from each of the input tokens; comparing the n-grams with the fuzzy tokens, to output a list of matching n-grams and fuzzy tokens; based on the list of matching n-grams and fuzzy tokens, identifying, from the glossary terms, candidate glossary term matches for each of the input terms; and calculating one or more scores that quantify the match between each of the candidate glossary term matches and its respective input term.

Fuzzy matching of obscure texts with meaningful terms included in a glossary

A method for automatically migrating infrastructure as code (IaC) from a first cloud infrastructure platform to a second cloud infrastructure platform is provided. The method may include receiving an original IaC comprising a first type of coding language. The method may further include using natural language processing to map a connection between the first type of coding language and a second type of coding language. The method may further include based on the mapped connection, using the NLP to automatically generate a partial translation of the first type of coding language to the second type of coding language. The method may further include using a machine learning algorithm to correct at least one inaccuracy in the partial translation. The method may further include generating a complete translation and implementing a second IaC on the second cloud infrastructure platform based on the complete translation.

Migrating infrastructure as code between different cloud providers

A method, computer program product, and computer system are provided. A processor receives an executable file for execution by an operating system, where the executable file includes a plurality of sections in a first order. A processor determines a second order that indicates a loading order for the plurality of sections, where the second order is distinct from the first order. A processor loads the plurality of sections of the executable file into a plurality of locations in memory of a device based on the second order. A processor resolves one or more memory references for the plurality of sections based on the plurality of locations in memory. A processor executes the plurality of sections of the executable file in the plurality of locations in memory.

Compiler assisted protection against arbitrary code execution

Input is received during runtime of a program. The input is a return instruction address of a called function and a return target address of the program. A determination is made whether the instruction immediately prior to the return target address is a call to the called function. If the instruction immediately prior to the return target address is not a call to the called function, a notification is transmitted that return-oriented programming is suspected.

Runtime return-oriented programming detection

Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.

Mitigating ROP attacks

Mitigating return-oriented programming attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement 'if-then-else return,' sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

Mitigating return-oriented programming (ROP) attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement 'if-then-else return,' sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

A method for identifying trends in system faults. During a generating stage, monitoring via a software based performance monitoring unit, a state of a server on a network and generating hardware or software performance information which indicate system faults of the server. During an analysis stage including, creating a dataset from the hardware or software performance information and isolating events from the dataset and categorizing each of the isolated events into a type, each type representing one application program call return. For each event in the dataset, assigning a trend score which decays with time such that recent events receive greater weight in the assigning than less recent events. Finally, performing one or more of: outputting a notification of the trend score, utilizing an optimization unit or triggering operation of a fault system handler for the event, when the trend score is above a threshold.

Growing community of inventors

Haifa, Israel

Omer Y Boehm