International Business Machines Corporation

Sridhar R Muppidi

Nataraj Nagaratnam

Sreekanth Ramakrishna Iyer

Jeffrey Robert Hoy

Paul Anthony Ashley

Damir Anthony Jamsek

Ronald B Williams

George Robert Blakley, Iii

Kimberly DaShawn Simon

Diana Jeanne Arroyo

Mark Vandenwauver

Vikrant Nandakumar

Palanivel Andiappan Kodeswaran

Suresh N Chari

Shalini Kapoor

Sandeep R Patil

Ashish Kundu

Heather Maria Hinton

Yu-Cheng Hsu

Sougata Mukherjea

Anthony Joseph Nadalin

Kapil Kumar Singh

William Alexander Bird

Archana Kumar

Sasikanth Eda

Deepak R Ghuge

Albee Jhoney

Piyush Chaudhary

Srinivas Babu Tummalapenta

Rick M F Wu

Bryan Eric Aupperle

Sulakshan Vajipayajula

Smita J Raut

Dong Su

Bruno Dos Santos Silva

Shajeer K Mohammed

Borna Safabakhsh

Julie Hayes King

Sadanand Rajaram Bajekal

John J Y Hsu

Cheng-Ta Lee

Venkat Raghavan

Srinivas Jandhyala

Priti P Patil

Ron Williams

Chao-Min Chang

Manoj Palat

Eric Joseph Wood

Bo-Yu Kuo

Kaifu Wu

Leanne L Chen

Alexander Phillip Amies

Jonathan Sc Kung

Casey M Plunkett

John Bergeron

Christopher Michael Bauserman

Atul Saxena

M Krishnakant Achary

Rashmiranjan Pradhan

Ritesh Kumar

Kapoor Shalini

According to one embodiment, a method, computer system, and computer program product for anomaly detection is provided. The embodiment may include receiving login event data of a customer. The embodiment may include labeling each login request of the event data as non-anomalous or anomalous. The embodiment may include performing aggregate feature extraction for each login request. The embodiment may include filtering data of anomalous login requests from data of non-anomalous login requests. The embodiment may include training an autoencoder machine learning model using the data of non-anomalous login requests to learn non-anomalous login request behavior. The embodiment may include passing the data of anomalous login requests through the trained autoencoder ML model to obtain enriched data. The embodiment may include training a classifier model using the enriched data to identify anomalous login requests and output a classification with confidence value.

Realtime identity attack detection and remediation

An example operation may include one or more of connect to a blockchain network of an ecosystem comprised of a plurality of consumer nodes, generate a universal unique identifier (UUID) associated with a user data attribute, execute a query request for the user data attribute associated with the UUID, derive a disclosure level from the query request, execute a smart contract to commit to a blockchain ledger, a monetary value associated with the user data attribute, negotiate a transaction with the consumer node to access the user data attribute and record an agreement result onto the a blockchain ledger.

Identity ecosystem

A computer-implemented method, according to one embodiment, includes: determining, for each pair of HCI systems where each pair includes a first HCI system coupled to another HCI system, a federation relationship setting that corresponds to each pair. The federation relationship settings are used to control a flow of data, as well as to control a flow of workload scheduling, between the first HCI system and the other HCI systems in the respective pairs. Moreover, determining a federation relationship setting that corresponds to a pair includes: determining whether a risk score which corresponds to the pair is outside a predetermined range. In response to determining that the risk score is outside the predetermined range, a restrictive federation relationship setting is assigned to the pair, and in response to determining that the risk score is not outside the predetermined range, a permissive federation relationship setting is assigned to the pair.

Utilizing federation relationship settings among different systems

A computer-implemented method, according to one approach, includes: monitoring actions of a user having access to a cluster, and in response to determining that the user has performed a risk event, incrementing a risk score assigned to the user. A determination is also made as to whether the incremented risk score is outside a predetermined range, and in response to determining that the incremented risk score is outside the predetermined range, a snapshot quota assigned to the user is dynamically reduced.

Dynamically throttling snapshot capture rates

A processor may generate an enforcement point. The enforcement point may include one or more adversarial detection models. The processor may receive user input data. The processor may analyze, at the enforcement point, the user input data. The processor may determine, from the analyzing, whether there is an adversarial attack in the user input data. The processor may generate an alert based on the determining.

Inline detection and prevention of adversarial attacks

A framework system is present that provides an end-to-end solution for user on-boarding, storing, securing, configuring, authenticating of the target person (grantee user), and transmittal of digitized documents assets. The framework system is preferably a multi-tenant cloud based system, although other systems may be used. The system processes multiple inputs to cognitively determine implementation (cognitive decision making) of digitized assets to a grantee user or target user without human intervention.

Adaptable access to digital assets

An example operation may include one or more of receiving, by a blockchain node or peer of a blockchain network, attribute data for a user profile, creating blockchain transactions to store attribute hashes and metadata to a shared ledger, receiving a user profile query from an identity consumer, creating blockchain transactions to retrieve attribute hashes and metadata corresponding to the query, reconstructing the user profile from the metadata, responding to the query by providing attribute data to the identity consumer, and creating and storing hashes of the attribute data and metadata to the shared ledger.

Decentralized database identity management system

A processor-implemented method provides a calculated identity confidence score for an identity. The processor(s) in each of a plurality of decentralized identity providers calculate an identity confidence score of an entity. The processor(s) store the calculated identity confidence score in a blockchain. The processor(s) retrieve the calculated identity confidence score from the blockchain. The processor(s) provide the calculated identity confidence score to a requestor, which is a computer-based system that performs an action based on the provided calculated identity score.

Identity confidence score based on blockchain based attributes

A cloud infrastructure is enhanced to provide a context-based security assurance service to enable secure application deployment. The service inspects network and cloud topologies to identify potential security capabilities and needs. Preferably, these options are then surfaced to the user with easy-to-understand, pre-configured templates representing security assurance levels. When a template (e.g., representing a pre-configured assurance level) is selected by the user, the system then applies specific capabilities and controls to translate the user-selected generalized specification (e.g., 'high security') into granular requirements for a specific set of security resources. Preferably, the identification of these security resources is based on system configuration, administration, and information associated with the pre-configured template.

Context-based cloud security assurance system

Administration of a context-based cloud security assurance system

Deployment using a context-based cloud security assurance system

A method, system, and computer usable program product-for context aware data protection are provided. Information about an access context is received in a data processing system. A resource affected by the access context is identified. The identification of the resource may include deriving knowledge about resource by making an inference from a portion of contents of the resource that the access context affects the resource, making an inference that the access context affects a second resource thereby inferring that the resource has to be modified, determining that the access context is relevant to the resource, or a combination thereof. The resource is received. A policy that is applicable to the access context is identified. A part of the resource to modify according to the policy is determined. The part is modified according to the policy and the access context to form a modified resource. The modified resource is transmitted.

Context aware data protection

Cost-based configuration using a context-based cloud security assurance system

Growing community of inventors

Austin, NC, United States of America

Sridhar R Muppidi