International Business Machines Corporation

Ronald O'Neal Edmark

Frank Eliot Levine

John Michael Garrison

Vikki Kim Converse

Kenneth W Blake

Robert John Urquhart

Robert Francis Berry

Riaz Yousuf Hussain

Donald Lawrence Mulvey

Robert J Urouhart

A method and system for tracing profiling information using per thread metric variables with reused kernel threads is disclosed. In one embodiment kernel thread level metrics are stored by the operating system kernel. A profiler request metric information for the operating system kernel in response to an event. After the kernel thread level metrics are read by the operating system for a profiler, their values are reset to zero by the operating system kernel. The profiler then applies the metric values to base metric values to appropriate Java threads that are stored in nodes in a tree structure base on the type of event and whether or not the kernel thread has been reused. In another embodiment non-zero values of thread level metrics are entered on a liked list. In response to a request from a profiler, the operating system kernel reads each kernel thread's entry in the linked list and zeros each entry. The profiler can then update the intermediate full tree snapshots of profiling information with the collection of non-zero metric variables.

Tracing profiling information using per thread metric variables with reused kernel threads

A method, system, apparatus, or computer program product is presented for morphing a honeypot system on a dynamic and configurable basis. The morphing honeypot emulates a variety of services while falsely presenting information about potential vulnerabilities within the system that supports the honeypot. The morphing honeypot has the ability to dynamically change its personality or displayed characteristics using a variety of algorithms and a database of known operating system and service vulnerabilities. The morphing honeypot's personality can be changed on a timed or scheduled basis, on the basis of activity that is generated by the presented honeypot personality, or on some other basis. The morphing honeypot can also be integrated with intrusion detection systems and other types of computer security incident recognition systems to correlate its personality with detected nefarious activities.

Method and system for morphing honeypot with computer security incident correlation

Method and system for tracing profiling information using per thread metric variables with reused kernel threads

A method, system, apparatus, or computer program product is presented for morphing a honeypot system on a dynamic and configurable basis. The morphing honeypot emulates a variety of services while falsely presenting information about potential vulnerabilities within the system that supports the honeypot. The morphing honeypot has the ability to dynamically change its personality or displayed characteristics using a variety of algorithms and a database of known operating system and service vulnerabilities. The morphing honeypot's personality can be changed on a timed or scheduled basis, on the basis of activity that is generated by the presented honeypot personality, or on some other basis.

Method and system for morphing honeypot

A system and method for activating bookmark files on a pervasive computing device is provided. When the pervasive computing device receives geographic coordinates from a global positioning system (GPS), it selects appropriate bookmarks for the user's location. The pervasive computing device compares geographic coordinate data received from the GPS with geographic matching data stored on the pervasive computing device. In addition, actions are taken to perform commands when the user is within the proximity of a location. Scheduling means are provided so that actions are performed during appropriate times. The pervasive computing device further connects to a computer network, such as the Internet, to access data files and to perform commands on external computing devices. If the commands are executed successfully, a success action is performed on the pervasive computing device. On the other hand, if errors were encountered a failure action is performed notifying the user of the error. Further disclosed are a system and a computer program product each providing active geographic-based bookmarks.

System and method for proximity bookmarks using GPS and pervasive computing

A method of monitoring execution performance of a program is provided. A process identifier associated with a process within a program is determined, and a trace output file is created for the process such that the file name of the trace output file contains the process identifier. Trace records are generated in response to events within the process. The trace records associated with the process are then written to the trace output file associated with the process. Multiple processes may then be associated with unique trace output files simultaneously. Using this methodology, multiple instances of JVMs may be executing simultaneously, and each JVM may be generating trace records through a profiler. However, the origin of the trace records, as identified by the process identifier, or PID, of the JVM is used to place the trace information into a file that is identified through the use of the same PID.

Method and system for using process identifier in output file names for associating profiling data with multiple sources of profiling data

A method and system for maintaining a thread-relative metric for trace data using device driver support is provided. A profiling process may detect a current event, and in response to the current event, may request an elapsed metric since a preceding event. The profiling process then receives a thread-relative elapsed metric and may output a trace record for the current event in which is stored a metric equal to the received thread-relative elapsed metric. In response to a notification of an occurrence of the current event, a device driver computes the thread-relative elapsed metric by: determining a current thread; retrieving a stored metric for the preceding event of the current thread; obtaining a current metric; and computing the thread-relative elapsed metric as a difference between the current metric and the stored metric.

Growing community of inventors

Austin, TX, United States of America

Ronald O'Neal Edmark