International Business Machines Corporation

Rory F Bray

Jason David Keirstead

William Alexander Bird

Ben A Wuest

Michael S Hume

Declan J Wilson

Cezar P Grzelak

Dwight E Spencer

Christopher A LeMesurier

Jody D Brownell

Jamie A R Wheaton

Christopher Ian Collins

Steven W R Jones

Methods and apparatus, including computer program products, implementing and using techniques for network modeling and device configuration. A security information and event manager is configured to receive log data from third party devices connected to a network. A notification is received each time a specific third party device generates a predetermined event in response to traffic at the specific third party device. The notification includes event information inferring network topology information, which network topology information includes third party device location information, firewall event information, source and destination networks. In response to receiving this information, a state of each third party device is generated, using inferred information over a predetermined period. An access control list is generated for each third party device, by using the inferred information over the predetermined period.

Network modeling and device configuration based on observed network behavior

A mechanism is provided for reparsing unsuccessfully parsed event data. Responsive to determining that one or more unsuccessfully parsed event data items exist for a log source, each unsuccessfully parsed event data item of the one or more unsuccessfully parsed event data items is reparsing using an updated device support module associated with the log source. Responsive to the device support module successfully reparsing the unsuccessfully parsed event data item thereby forming a successfully parsed event data item, the successfully parsed event data item is added to a historical record of events associated with the log source. Responsive to the device support module failing to successfully reparse the unsuccessfully parsed event data item, the unsuccessfully parsed event data item is retained in an unsuccessfully parsed event data item data structure.

Reparsing unsuccessfully parsed event data in a security information and event management system

A method, system and computer-usable medium are disclosed for injecting functionality into a security intelligence platform, comprising: providing the security intelligence platform with a plurality of backend endpoints; generating a modification to the security intelligence platform according to an application framework, the modification comprising metadata associated with functionality, the metadata corresponding to a predefined format; and, merging the modification with the security intelligence platform via a secure container system container.

Security systems GUI application framework

A method, system and computer-usable medium are disclosed for identifying risk within an information technology (IT) environment, comprising: analyzing characteristics of a user accessing a system within an IT environment; associating a risk profile with the user based upon the characteristics of the user; determining when the user accesses a system within the IT environment; maintaining a user risk profile record of all systems within the IT environment accessed by the user, the user risk profile record continuing to be associated with the system after access by the user ceases; and, identifying a risk level for all systems within the IT environment based upon the user risk profile record.

User activity modelling, monitoring, and reporting framework

According to one exemplary embodiment, a method for detecting malware in a network stream to at least one host computer is provided. The method may include initializing a browser profile corresponding with a first website having a first website source and a first plurality of content features. The method may include recording the first plurality of content features and a trusted source based on the first website source. The method may include scanning the network stream for a second content feature within a second plurality of content features associated with a second website. The method may include determining if the second content feature matches a first content feature. The method may include determining if the second plurality of content features is consistent with the first plurality of content features. The method may include determining if a second website source matches the trusted source. The method may include generating an alert.

Endpoint traffic profiling for early detection of malware spread

An illustrative embodiment of a method for firewall rule use counting receives log messages comprising one or more log data sets from each firewall rule in a particular network whose counts are to be tracked in a log collector, generates a network trie for each reference database in a set of databases and a device source trie and a device destination trie for each firewall device in a plurality of devices of the particular network, a source port and protocol list and a destination port and protocol list for each respective device, a unique object for each log data set received; a mapping database comprising an entry for each log data set received associated with the unique object; and feeds each entry in the mapping database through a topology model to also generate a reference to a unique firewall rule on a respective device in the plurality of devices. A count associated with the unique firewall rule is incremented using a count of logs stored associated with the respective unique object and a report is generated.

Growing community of inventors

Rothesay, Canada

Rory F Bray