International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Ebay, Incorporated

Phuong Thanh Nguyen

Charles Steven Lingafelt

Norman Clark Strole

Leo Temoshenko

Joseph Edward Bolan

Earl Hardin Booth

Xiaogang Wang

Dongming Hwang

Chien Dinh Vu

Hanzhang Wang

Dominic Nguyen

Bishwaranjan Bhattacharjee

Aleksander A Slominski

Vinod Muthusamy

Keith Manders Campbell

Jeffery Michael Franke

Michael H Nolterieke

Gregory William Dake

Vatche Isahagian

John K Whetzel

Torez Smith

Technologies are disclosed herein for enhancing machine learning ('ML')-based anomaly detection systems using knowledge graphs. The disclosed technologies generate a connected graph that defines a topology of infrastructure components along with associated alarms generated by a ML component. The ML component generates the alarms by applying ML techniques to real-time data metrics generated by the infrastructure components. Scores are computed for the infrastructure components based upon the connected graph. A root cause of an anomaly affecting infrastructure components can then be identified based upon the scores, and remedial action can be taken to address the root cause of the anomaly. A user interface is also provided for visualizing aspects of the connected graph.

Enhancement of machine learning-based anomaly detection using knowledge graphs

A method, system and computer program product for analyzing multidimensional data are disclosed. In embodiments, the method comprises obtaining an original set of data having a sequential order and multiple original dimensions; selecting a topic-based summarization scheme to summarize the original set of data; and applying the selected topic-based summarization scheme to the original set of data to transform the original set of data into a new set of data having fewer dimensions than the original set of data, while preserving, within a defined measure, the sequential order of the original set of data. In embodiments, the selecting a topic-based summarization scheme includes selecting a plurality of topics, each of the topic representing a set of the original dimensions. In embodiments, the applying the topic-based summarization scheme includes performing dimensionality reduction on the original set of data to transform the original dimensions to the topics.

Analyzing multidimensional process traces under edit-distance constraint

A method, system, and/or computer program product establishes a communication session between two entities on a shared network. A request to locate a desired entity on a shared network, which hosts one or more entities that are unknown to a requesting entity, is received from the requesting entity. A desired environment with which the desired entity is associated is selected by the requesting entity. An inquiry packet is broadcast to all entities on the shared network. The inquiry packet, which does not specify a data link layer by which any particular entity communicates with the shared network, includes a request for an identity of any entity on the shared network that is assigned to the desired environment. A response to the inquiry packet provides an identity and data link layer address of the desired entity, thus enabling the establishment of a communication session between the requesting and desired entities.

Establishing communication between entities in a shared network

An apparatus, system, and method are disclosed to failover to a standby server when a primary server is under broadcast storm or denial-of-service ('DoS') attack. A primary attack sensing module is included to monitor a rate of incoming data from a computer network to a primary server and to determine if the rate of incoming data is above a primary data rate threshold. A standby contact module is included to request a standby data rate status from a standby server in response to the primary attack module determining that the rate of incoming data to the primary server is above the primary data rate threshold. The standby server is connected to the primary server over a private network. The standby data rate status includes a determination by the standby server of whether a rate of data received by the standby server is above a standby data rate threshold. A standby receiver module is included to receive a standby data rate status from the standby server over the private network. A switchover module is included to deactivate the primary server and to send a command to activate the standby server as a primary server in response to the received standby data rate status indicating that the rate of data received by the standby server has not exceeded the standby data rate threshold.

Apparatus, system, and method for server failover to standby server during broadcast storm or denial-of-service attack

Autoconfiguration of an IPv6 component in a segmented network including receiving an IPv6 packet; determining whether the received IPv6 packet is a router advertisement or a router solicitation; if the received IPv6 packet is a router advertisement, then retrieving through an out-of-band link a MAC address for the IPv6 component, removing a MAC address of a sending router, inserting in the packet instead an internal MAC address for forwarding packets to the IPv6 component, removing a multicast destination MAC address, inserting in the packet the destination MAC address of the IPv6 component, and forwarding the packet to the IPv6 component as a unicast message; if the received IPv6 packet is a router solicitation, then removing the MAC address of the sending IPv6 component, inserting in the packet instead an external MAC address for forwarding packets to the router, and forwarding the packet to the router as a multicast message.

Autoconfiguration of an IPv6 component in a segmented network

A system and method for an end user to change the operation of a data flow filter mechanism, such as a firewall, that operates to control data flows between a plurality of protected computing devices and one or more non-protected computing devices. With the system and method, an administrator of a sub-network of computing devices may set a client computing device's scope of rules/policies that may be changed by a user of the client computing device, with regard to a data flow filter mechanism. The user of the client computing device, or the client computing device itself, may then log onto the data flow filter mechanism and modify the operation of the data flow filter mechanism within the limits established by the administrator.

System and method for on-demand dynamic control of security policies/rules by a client computing device

A method and system for verifying the availability of a back-up virtual private network IP security (IPSec) tunnel between two network elements by originating a plurality of connection tests between the network elements. The first network element transmits a backup tunnel verification test message to the second network element over the back-up secure tunnel upon receipt of a backup tunnel verification test command. The back-up secure tunnel includes two unidirectional tunnels. The second network element receives the back-up tunnel verification test message over the first back-up unidirectional secure tunnel and transmits a response back to the first network element over the second back-up unidirectional secure tunnel. The number of failures to respond by the second network element to the backup tunnel verification tests performed during an active verification period specified in the backup tunnel verification test command are reported back to the source that initiated the back-up secure tunnel verification test.

System and method to verify availability of a back-up secure tunnel

A method and system for determining the connectivity of a virtual private network IP security (IPSec) tunnel between two network elements by originating a plurality of connection tests between the network elements. The first network element transmits a connectivity test message to the second network element over the secure tunnel upon receipt of an initiate connectivity test command. The secure tunnel includes two unidirectional tunnels. The second network element receives the connectivity test message over the first unidirectional secure tunnel and transmits a response back to the first network element over the second unidirectional secure tunnel. The number of successful responses received from the second network element are accumulated and the results are reported back to the source of the connectivity test command.

System and method to determine connectivity of a VPN secure tunnel

A method and system for monitoring the status of an active secure tunnel between a pair of network elements in a communications network. The first network element originates and transmits an Internet Protocol Security (IPSec) test message to a second network element using a first unidirectional secure tunnel in response to the receipt of an active tunnel monitor command. The second network element receives the IPSec test message and transmits a response back to the first network element using a second unidirectional secure tunnel. The number of times that second network element failed to return a response to an IPSec test message is accumulated during a predetermined time interval and then compared with a threshold value to determine if the active secure tunnel has become disabled.

Growing community of inventors

Cary, NC, United States of America

Phuong Thanh Nguyen