International Business Machines Corporation

Business Machines Corporation

Pao-Chuan Liao

June-Ray Lin

Ying-Chen Yu

Ci-Hao Wu

Yu-Siang Chen

Hsiao-Yung Chen

Jia-Sian Jhang

Shr-an Su

Vincent Y Deng

Chia-Ru Chang

Yung Wen Yw Deng

A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Automated identification of malware families based on shared evidences

An approach to workflow management in response to a detected security incident in a computer system. The approach may include an inference driven response based on prior artifacts. The inference driven response may predict the condition of the system and the outcomes of actions in response to the security incident. The predictions made by the inference drive response may be based on a machine learning model. The inference driven response may pause or prevent scheduled actions of the system based on the predictions. The inference driven response may continue to monitor the system and dynamically update its predictions for the condition of the system. In response to the updated predictions, the inference driven response may cancel or execute the previously scheduled actions of the system.

Reasoning based workflow management

Embodiments of the present invention relate to a method, system and computer program product for compacting data in a distributed storage system. According to the method, a query request is received from a client, wherein the query request comprises information of a previous query request of the client. A first query result of the query request and a second query result of the previous query request are retrieved. A delta data and a first indicator are sent to the client in response to the first query result being different from the second query result, wherein the delta data is the data of the first query result excluding the data comprised in both first and second query results, and the first indicator indicates the data comprised in both the first and the second query results.

Deduplicated data transmission

Administering reward schemes. A first reward scheme is predefined by a computer system, the first reward scheme defining a first reward event. A second reward scheme is obtained externally by the computer system, the second reward scheme defining a second reward event. In response to an action by a user, the computer system determines whether the first reward event or the second reward event has been triggered. If the first reward event has been triggered, the computer system calculates a first reward for the user according the first reward scheme and if the second reward event has been triggered, the computer system calculates a second reward for the user according the second reward scheme. The second reward scheme may be obtained by, and shared to, the computer system as an inheritance of rules within an organization.

Administering reward schemes

Growing community of inventors

Taipei, Taiwan

Pao-Chuan Liao