International Business Machines Corporation

Reiner Sailer

Douglas Lee Schales

Mihai Christodorescu

Stefan Berger

Ting Wang

Kenneth Alan Goldman

Xin Hu

Ronald Perez

Marc Philippe Stoecklin

Josyula R Rao

Enriquillo Valdez

Trent Ray Jaeger

Marc Ph Stoecklin

Andrew Maxwell White

James R Giles

Dimitrios Pendarakis

Dinesh C Verma

Leendert Peter Van Doorn

Marc Stoecklin

Yangyi Chen

Wietse Z Venema

Suresh N Chari

Lawrence H Koved

Steven A Bade

Arup Acharya

Raymond Byars Jennings, Iii

Srinivasan Parthasarathy

Xiaolan Zhang

Lisa Amini

Kapil Kumar Singh

Pau-Chen Cheng

Ramon Caceres

Mitchell Adam Cohen

Mandis S Beigi

Deepa Srinivasan

Leendert Van Doorn

Trenton Ray Jaeger

Andrew Joseph Davidson

Oliver Verscheure

John L Griffin

Dimitrious Pendarakis

Najwa Aaraj

Dmytro Korzhyk

The present principles are directed to identifying and classifying web traffic inside encrypted network tunnels. A method includes analyzing network traffic of unencrypted data packets to detect packet traffic, timing, and size patterns. The detected packet, timing, and size traffic patterns are correlated to at least a packet destination and a packet source of the unencrypted data packets to create at least one of a training corpus and a model built from the training corpus. The at least one of the corpus and model is stored in a memory device. Packet traffic, timing, and size patterns of encrypted data packets are observed. The observed packet traffic, timing, and size patterns of the encrypted data packets are compared to at least one of the training corpus and the model to classify the encrypted data packets with respect to at least one of a predicted network host and predicted path information.

Identification and classification of web traffic inside encrypted network tunnels

A method includes collecting system calls and call parameters invoked by monitored applications for target computer systems. The system calls and call parameters are received from operating system kernels on the plurality of target computer systems. Sequences of systems calls and call parameters of the monitored applications are correlated among different target computer systems to deduce malicious activities. Remedial action(s) are performed in response to malicious activities being deduced as being malicious by the correlating. Another method includes determining that network activity at a specific time is deemed to be suspicious. Using IP addresses involved in the suspicious network activity, computer system(s) are determined that are sources of the suspicious network activity. Based on the specific time and the determined computer system(s), application(s) are determined that are executing on the determined computer system(s) that are causing the suspicious network activity. Remedial action(s) are performed for the determined computer system(s).

Computer implemented techniques for detecting, investigating and remediating security violations to IT infrastructure

A method, system, and program product for remotely attesting to a state of computing system is provided. Specifically, the present invention allows a remote system to establish trust in the properties of the computer system. The properties to be trusted are expanded from the usual system software layers and related configuration files to novel types of data such as static data specific to the computer system, dynamic data determined at system startup, or dynamic data created as the computer system runs applications.

Method, system, and program product for remotely attesting to a state of a computer system

Embodiments include a network data collection and response system for enhancing security in an enterprise network providing a user-supplied computing device with access to the network. A network data collection and response system tracks network activity of the device and maintains a device inventory recording the device type and configuration information for the device along with a resource utilization profile for the device. The network data collection and response system detects high-risk or unauthorized network activity involving the device through passive monitoring without utilization of a data monitoring agent installed on the device and implements a response action to mitigate the high-risk or unauthorized network.

Network data collection and response system

A distributed feature collection and correlation engine is provided, Feature extraction comprises obtaining one or more data records; extracting information from the one or more data records based on domain knowledge; transforming the extracted information into a key/value pair comprised of a key K and a value V, wherein the key comprises a feature identifier; and storing the key/value pair in a feature store database if the key/value pair does not already exist in the feature store database using a de-duplication mechanism. Features extracted from data records can be queried by obtaining a feature store database comprised of the extracted features stored as a key/value pair comprised of a key K and a value V, wherein the key comprises a feature identifier; receiving a query comprised of at least one query key; retrieving values from the feature store database that match the query key; and returning one or more retrieved key/value pairs.

Distributed feature collection and correlation engine

A method for identifying an unknown user according to a plurality of facets of user activity in a plurality of contexts includes receiving a plurality of priors for the facets with respect to the contexts, receiving a plurality of footprints of known users, aggregating the footprints of the users to determine an ensemble prior, receiving a plurality of network traces relevant to an unknown user in a computer environment, matching the network traces against each of the footprints to determine a plurality of matches, aggregating the matches using the ensemble prior according to the facets and the contexts, and outputting a probable user identity for the unknown user.

User identification using multifaceted footprints

Growing community of inventors

Scarsdale, NY, United States of America

Reiner Sailer