International Business Machines Corporation

Peter Otto Mierswa

Russell Holden

John Douglas Curtis

Olgierd Stanislaw Pieczul

Mark Alexander McGloin

Daniel C Gurney

Alan D Eldridge

Chester E Ryder, Iii

Vinod R Seraphin

Michael J Kerrigan

Kenneth E Brunsen

Phillipe A Loher

Steven E Read

Nikolaus K Brauer

Michael I Killoran

Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of 'legitimate' behavior is defined for accessor classes, preferably along with actions to be taken in the event an accessor exceeds those limits. A set of accessor 'usage profiles' are generated. Typically, a profile comprises information, such as a &#x201c;request time window,&#x201d; one or more &#x201c;constraints,&#x201d; and one or more &#x201c;actions.&#x201d; A request time window defines a time period over which request usage is accumulated and over which constraints are applied. A constraint may be of various types (e.g., number of transactions, defined resource usage limits, etc.) to be applied for the usage monitoring An action defines how the system will respond if a particular constraint is triggered. By applying the constraints to accessor requests, over-utilization of compute resources is enabled.

Preventing application-level denial-of-service in a multi-tenant system

Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of 'legitimate' behavior is defined for tenant applications or application classes, preferably along with actions to be taken in the event a request to execute an application is anticipated to exceed defined workflow limits. A set of application profiles are generated. Typically, a profile comprises information, such as a request defined by one or more request variables, one or more 'constraints,' one or more &#x201c;request mappings,&#x201d; and one or more &#x201c;actions.&#x201d; A constraint is a maximum permitted workload for the application. A request mapping maps a request variable to the constraint, either directly or indirectly. The profile information defines how a request is mapped to a workload to determine whether the request is in policy or, if not, what action to take.

Pre-processing system for minimizing application-level denial-of-service in a multi-tenant system

A request is received by a first computer. The first computer delegates the first request to a second computer. The second computer attempts to process the first request and identifies an imminent fault as a result of the attempt. The second computer sends a message to the first computer indicating an imminent fault as a result of the attempted processing of the first request. The first computer sends a message to a third computer indicating that a second request matching the first request should not be processed.

Heuristic failure prevention in software as a service (SAAS) systems

A method of managing network security can include receiving a user input comprising a user name and a password, determining whether the input user name potentially corresponds to a plurality of user accounts, determining whether the password is valid, and determining whether each of the user accounts is locked. The method can include selecting a security response to the user input based upon whether the input user name potentially corresponds to the plurality of user accounts, whether the password is valid, whether each of the user accounts is locked, and outputting the security response.

Network security management for ambiguous user names

Growing community of inventors

Sterling, MA, United States of America

Peter Otto Mierswa