International Business Machines Corporation

Ron Williams

Bruno Dos Santos Silva

David Louis Kaminsky

Jeb R Linton

Sridhar R Muppidi

Hyman David Chantz

Doga Tav

Naeem Altaf

Cheng-Ta Lee

Bradley E Harris

Satya Sreenivas

Chao-Min Chang

Bo-Yu Kuo

Sanjay Nadhavajhala

Darrel Haswell

John Walter Morris

A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Inline detection and prevention of adversarial attacks

A method for a multi-factor authentication, the method receives results of an initial authentication of a user. Responsive to confirming the initial authentication, an image of a secondary set of authentication options is presented. An option selection is received from the user, wherein the selection is determined by tracking eye movement of the user over the image that includes the set of second factor authentication options. User facial activity is tracked corresponding to the selection made from the secondary set of authentication options. The monitored facial activity is compared to a pre-established authentication condition to determine whether a match exists with the selected secondary set of authentication options, and responsive to facial activity monitored matching the authentication condition pre-established by the user and corresponding to the selection made from the secondary set of authentication options, authentication of the user is confirmed.

Second factor authentication of electronic devices

Methods and systems for artificially intelligent security incident and event management using an attention-based deep neural network and transfer learning are disclosed. A method includes: collecting, by a computing device, system and network activity events in bulk; forming, by the computing device, a corpus using the collected system and network activity events; correlating, by the computing device, discrete events of the system and network activity events into offenses; adding, by the computing device, additional features to the corpus representing the offenses and disposition decisions regarding the offenses; training, by the computing device, a deep neural network using the corpus; and tuning, by the computing device, the deep neural network for a monitored computing environment using transfer learning.

Artificially intelligent security incident and event management

A security incident is detected at a first location; a risk of the security incident is evaluated. A first security scores is generated for the first location. A set of security scores are generated for a set of alternative locations; the set of security scores excludes the first security score. A second security score within the set of security scores is determined to be the best security score among a plurality of security scores; the plurality of security scores comprises the set of security scores and the first security score. A workload associated with the first location is migrated to a second location, where the second location is associated with the second security score.

Security evaluation for computing workload relocation

Growing community of inventors

Austin, TX, United States of America

Ron Williams