International Business Machines Corporation

Ronald B Williams

Cheng-Ta Lee

Hyun Kyu Seo

Sridhar R Muppidi

Damir Anthony Jamsek

George Robert Blakley, Iii

Kimberly DaShawn Simon

Diana Jeanne Arroyo

Iosif Viorel Onut

Elizabeth Ann Holz

Joni E Saylor

Paul Anthony Ashley

June-Ray Lin

Guo Qiang Li

Ashish Kundu

Nataraj Nagaratnam

Dimitrios Pendarakis

Sreekanth Ramakrishna Iyer

He Huang

Jian Lin

Tian Cheng Liu

Stefan Berger

Doga Tav

Russell L Couturier

Matthew Elsner

Gideon Zenz

Lun-Pin Yuan

Jeb R Linton

Paul Sherwood Taylor

Wayne Francis Tackabury

Ilgen Banu Yuceer

John William Court

Paul Coccoli

Michael Hanner

Gregory Lyle Galloway

Michael Josiah Bolding

Steven Ashley Mazur

Matthew Joseph Kubilus

Joseph Karl Vossen

Yun Pan

Matthias Bartelt

Lidiya Mekbib Tilahun

Archana Kumari

Xuejie Yu

Manuel Hauptmann

According to one embodiment, a method, computer system, and computer program product for preventing intrusions on a network is provided. The present invention may include generating a sandbox environment responsive to detecting an attacker in the network, wherein the sandbox environment comprises dynamically generated data tailored to the target of the attacker; and moving the attacker to the sandbox environment.

Highly collaborative deceptive network alliance

A tiered machine learning-based infrastructure comprises a first machine learning (ML) tier configured to execute within an enterprise network environment and that learns statistics for a set of use cases locally, and to alert deviations from the learned distributions. Use cases typically are independent from one another. A second machine learning tier executes external to the enterprise network environment and provides further learning support, e.g., by determining a correlation among multiple independent use cases that are running locally in the first tier. Preferably, the second tier executes in a cloud compute environment for scalability and performance.

Distributed machine learning for anomaly detection

Unauthenticated client access to an application (e.g., a SaaS-based web application) that employs unauthenticated API endpoints is monitored and protected by an access control system and method that leverages a neural network. The neural network is trained to recognize user behaviors that should be deemed to be 'inappropriate' according to a policy. Using the neural network, the system provides effective discrimination with respect to unauthenticated user behavior, and it enables access controls to be more effectively enforced with respect to users that are not using the application according to an enterprise security policy. By training the neural network to recognize pattern(s) behind regular user behavior, the approach enables robust access control with respect to users that are unauthenticated. More generally, the approach facilitates access control based in whole or in part on API interactions with an application where the identity of the individuals making that access are unknown or necessarily ascertainable.

Detecting inappropriate activity in the presence of unauthenticated API requests using artificial intelligence

A technique for network attack tainting and tracking includes monitoring data packets received from a network for a malicious request. Responsive to detecting a malicious request, a forensic token is created having information pertaining to the malicious request that is configured to be stored by a source of the malicious request and discoverable regarding involvement of the source in the malicious request. The forensic token is injected into a response message, and the response message is then transmitted to the source of the request as a response to the request.

Network attack tainting and tracking

A technique for secure data storage and access during transition operations includes retrieving an encrypted instance of a data object from a data store. The retrieved encrypted instance of the data object is stored in a cryptcache. The encrypted instance in the cryptcache is decrypted to a cleartext instance of the data object and stored as the cleartext instance of the data object in a clearcache. The clearcache instance of the data object is secured by controlling an access window defining an amount of time the cleartext instance of the data object is accessible in the clearcache.

Secure data storage and access during transition operations

A machine learning-based technique for user behavior analysis that detects when users deviate from expected behavior. In this approach, a set of user groups are provided, preferably based on information provided from a user registry. A set of training data for each of the set of user groups is then obtained, preferably by collecting security events generated for a collection of the users over a given time period (e.g., a last thirty (30) days). A machine learning system is then trained using the set of training data to produce a model that includes a set of clusters in user behavior model, wherein a cluster is a learned user group that corresponds to a defined user group. Once the model is built, it is used to identify users that deviate from their expected group behavior. In particular, the system compares a current behavior of a user against the model and flags anomalous behavior. The user behavior analysis may be implemented in a security platform, such as a SIEM.

Detection of user behavior deviation from defined user groups

A data model extends or supplements an entity/resource association to include a 'quality' of that association, where the quality is defined by an ordered set of relative values/characteristics. In an example scenario, an entity/resource association is augmented to include a quality characteristic that is defined by a tuple that is preferably an ordered set of relative values. The number of values and their designations in the data model will depend on nature of the underlying entity/resource association. When entity/resource associations are annotated to include relative quality values in this manner, much more useful comparisons of apparently similar entity/resource associations may be carried out.

Identifying, categorizing and recording a quality of an entity/resource association

A method for analyzing past user sessions for malicious intent. A security incident is detected by a computer system. Responsive to detecting the security incident, a forensic investigation is triggered by the computer system using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product.

Automatic user session profiling system for detecting malicious intent

A method, computer system, and a computer program product for a monitor security process is provided. The present invention may include configuring monitors in a chain configuration where sensors communicate with the monitors. The present invention may include receiving a first set of information from the sensor to a primary and backup monitor based on an event. The present invention may include broadcasting the information from the primary and backup monitor to a plurality of monitors and logging the information. The present invention may include receiving a second set of information from within the chain of monitors. The present invention may include determining that the sets of information conflict. The present invention may include marking at least one temporary log within the plurality of temporary logs as conflicting. The present invention may include determining that a conflicting threshold has been exceeded and then generate an audit and recovery plan.

Secured event monitoring leveraging blockchain

A technique for network attack tainting and tracking includes monitoring data packets received from a network for a malicious request. Responsive to detecting a malicious request, a payload is created that is digitally signed. The digitally signed payload is encrypted and injected into a response message, and the response message is then transmitted to a source of the request as a response to the request.

A method and system are provided that, in turn, provide a secure policy audit in a shared enforcement environment. The method includes providing an auditing component in a software defined network. The method further includes receiving, by the auditing component, a first auditing event from a first component in the software defined network and a related auditing event from a second component in the software defined network. The method also includes analyzing, by the auditing component, the first auditing event and the related auditing event against an enforcement of an access policy criteria for the software defined network. The access policy criteria requires auditing events from at least two enforcement points in the software defined network. The first and second component form the at least two enforcement points. The method additionally includes determining, by the auditing component, one of a compliance and a non-compliance with the access policy criteria.

Secure policy audit in shared enforcement environment

'Multi-tenant awareness' is added to a set of one or more packet processing devices in a Software Defined Network (SDN) having a controller. For each of one or more tenants, information in a table associates network protocol address attributes with an Internet Protocol (IP) address unique to the tenant. The table is associated with a multiple-layer translation layer being managed by the SDN controller. As a data packet traverses the translation layer, network protocol address attributes are translated according to values in the table to enable logical routing of the packet (to a given PPD. This translation occurs dynamically (or 'on-the-fly') as packets are &#x201c;on route&#x201d; to their destination. By implementing a multi-layer network address translation (NAT), one layer may be used to translate network protocol address source attributes, while a second layer may be used to translate network protocol address destination attributes.

Adding multi-tenant awareness to a network packet processing device on a software defined network (SDN)

Mechanisms are provided for correlating security vulnerability detection across multiple applications. The mechanisms perform a security vulnerability analysis of first source code of a first application, and identify, based on results of the security vulnerability analysis, a security vulnerability in a first portion of the first source code. The mechanisms associate characteristics of the security vulnerability with the first portion, and correlate the characteristics of the security vulnerability with second source code of a second application based on the association of the characteristics of the security vulnerability with the first portion. In addition, the mechanisms generate an output to a computing device of a consumer or contributor associated with the second source code identifying a presence of the security vulnerability in the second source code based on the correlation.

Amalgamating code vulnerabilities across projects

Growing community of inventors

Austin, TX, United States of America

Ronald B Williams