International Business Machines Corporation

Kyndryl, Inc.

Srinivas Babu Tummalapenta

HuyAnh Dinh Ngo

Adam Lee Griffin

Aankur Bhatia

Gary I Givental

Adam J Paquin

Hamza Yaswi

Bradford O Brooks

Nikhilkumar V Shah

Wesley A Khademi

Paul A Ragone

Kevin Shen

Peyton Duncan

Shikhar Kwatra

Jason T Wertz

Dylan J Boday

Seng Chai Gan

Carlos E Aguilera

HuyAnh D Ngo

Jonathan Bees

Rhonda L Childress

Heather Maria Hinton

Sai Zeng

Grant Douglas Miller

Neil Ian Readshaw

Steven A Bade

Muhammed Fatih Bulut

Michael Elton Nidd

Milton H Hernandez

Robert Wilhelm

John Kurian

Robert Filepp

Hariharan N Venkitachalam

George E Stark

Daniel S Riley

Steven Ocepek

Dorothea W Wiesmann

Thomas S Wallace

Louis Stephen Sickenius

Michelle Rivers

Marcus Ian Watkins

Chadwick M Baatz

Johathan Bees

Juan A Martinez Castellanos

M Krishnakant Achary

Rashmiranjan Pradhan

Ritesh Kumar

According to one embodiment, a method, computer system, and computer program product for anomaly detection is provided. The embodiment may include receiving login event data of a customer. The embodiment may include labeling each login request of the event data as non-anomalous or anomalous. The embodiment may include performing aggregate feature extraction for each login request. The embodiment may include filtering data of anomalous login requests from data of non-anomalous login requests. The embodiment may include training an autoencoder machine learning model using the data of non-anomalous login requests to learn non-anomalous login request behavior. The embodiment may include passing the data of anomalous login requests through the trained autoencoder ML model to obtain enriched data. The embodiment may include training a classifier model using the enriched data to identify anomalous login requests and output a classification with confidence value.

Realtime identity attack detection and remediation

A method protects a computer asset by identifying a particular signature, which is software that causes a particular gateway to block an intrusion from reaching a particular computer asset, and installs the particular signature on the particular gateway, thus protecting the computer asset from the intrusion.

Protecting computer assets from malicious attacks

A method controls a modification of an adjustable device. A system establishes a circle of trust for a plurality of devices, where at least one of the plurality of devices is an adjustment control device for adjusting an adjustable device. Operations of the adjustment control device are controlled via a blockchain, where the blockchain must approve the adjustment control device before an adjustment of the adjustable device is performed by the adjustment control device. The system receives an approval from the blockchain for the adjustment control device to adjust the adjustable device, and the adjustment control device adjusts the adjustable device in response to receiving the approval from the blockchain.

Secure environment device management

Systems and techniques that facilitate automated health-check risk assessment of computing assets are provided that can generate a baseline health-check risk score that corresponds to non-compliance of a computing asset with a stipulated control, and can adjust the baseline health-check risk score based on a weakness factor of the stipulated control, an environmental factor of the computing asset, a criticality factor of the computing asset, and a maturity factor of the computing asset.

Automated health-check risk assessment of computing assets

An example operation may include one or more of receiving storage requests endorsed by blockchain peers of a blockchain, selecting a group of the endorsed storage requests to be stored together and ordering the group of endorsed storage requests with respect to each other based on timestamps, encoding the group of ordered and endorsed storage requests into an image, and storing the encoded image within a data section of a block of the blockchain.

Image encoding for blockchain

An approach is provided that receives a set of actual hardware power consumption details and a set of software activity details with all of the details pertaining to the use of a computer system at a first time. Based on the set of software activity details, the approach determines a set of expected hardware power consumption details. The set of actual hardware power consumption details are compared to the set of expected hardware power consumption details. If the comparison identifies variances between the actual and expected data, then a security threat is flagged and threat responses are performed.

Threat detection using hardware physical properties and operating system metrics with AI data mining

A system and method for automatic remediation of non-compliance events are provided. In embodiments, a computer-implemented method includes: accessing a compliance profile and a remediation profile, wherein the compliance profile includes compliance data regarding rules for an enterprise and the remediation profile includes remediation data regarding remediation actions to address non-compliance with one or more of the rules; generating mapped data by mapping compliance data in the compliance profile to remediation data in the remediation profile; receiving non-compliance event data from a workload node in a network; extracting information from the non-compliance event data including the workload node associated with the event and a cause of event; determining a remediation action for the event based on the information and the mapped data; and invoking automatic performance of the remediation action at the workload node based on the determined remediation action.

Automatic remediation of non-compliance events

A method, system and computer-usable medium are disclosed for providing a travel network infrastructure. A dedicated Li-F connection is provided for each physical space such as a seat, expected to accommodate a passenger in a travel network such as an airline. A passenger is authenticated according to a physical space occupied by the passenger. If authentication is successful, a secure Li-Fi channel is established for the passenger. The access point of the Li-Fi channel is only leveraged by the passenger and no other passengers.

System and method for credential generation for wireless infrastructure and security

A method provides an intermediate mitigation of a vulnerability in a particular computer system. One or more processors receive a description of a vulnerability of a computer system to a malicious attack. The processor(s) perform an NLP analysis of the description of the vulnerability in order to extract risk information related to the vulnerability, where the risk information includes an identity of a type of vulnerable computer system resource in the computer system. The processor(s) match the vulnerable computer system resource to a computer system resource in a particular computer system, and perform an intermediate mitigation action that reduces a functionality of the computer system resource in the particular computer system until a solution is implemented that both restores the functionality of the computer system resource in the particular computer system and mitigates the vulnerability of the particular computer system to the malicious attack.

Security protection rule prediction and enforcement

A method selectively installs a particular signature on a particular gateway based on the type of signature and the type of computer asset that is protected by that particular gateway. A system and/or analyst receives multiple signatures, where different signatures from the multiple signatures are specific for different types of computer assets. The system and/or analyst identifies and extracts a particular signature, from the multiple signatures, that will protect, if implemented on the appropriate gateway, a particular computer asset. The system and/or analyst identifies the appropriate gateway that protects the particular computer asset, and installs only the extracted particular signature from the multiple signatures on that appropriate gateway.

A method assigns a particular rule for a previous client to a new client for use in executing a security feature on a computer system used by the new client. One or more processors match a new client profile for the new client to a previous client profile for the previous client. The new client profile is based on types of one or more client assets of the new client and an intrusion detection alert history of the new client. The processor(s) assign the particular rule for the previous client to the new client based on the new client profile matching the previous client profile. The processor(s) receive information indicating that a violation of the particular rule has occurred, and execute a security feature of the computer system used by the new client in order to resolve the violation of the particular rule.

Artificial intelligence assisted rule generation

A method identifies and prioritizes anomalies in received monitoring logs from an endpoint log source. One or more processors identify anomalies in the monitoring logs by applying a plurality of disparate types of anomaly detection algorithms to the monitoring logs, and then determine a likelihood that the identified anomalies are anomalous based on outputs of the plurality of disparate types of anomaly detection algorithms. The processor(s) then prioritize the monitoring logs based on the likelihood that the identified anomalies are actually anomalous, and send prioritized monitoring logs that exceed a priority level to a security information and event management system (SIEM).

Detecting and responding to an anomaly in an event log

An approach is disclosed that receives a request from a first device connected to a first network to connect to a second device connected to a second network. In response to verifying that a connection between the first device and the second device is allowed, the approach operates to establish a secure network communications tunnel between the first device and the second device. The secure network communications tunnel is specific to the first and second devices and the first device is inhibited from accessing other devices that are connected to the second network using the secure network communications tunnel. The secure network communications tunnel is then terminated in response to a detection of a security event.

Secure communication tunnels specific to network resource

An example operation may include one or more of retrieving a predefined image from a storage, encoding data attributes to be stored on a blockchain into one or more image layers of the predefined image to generate an encoded image, generating a data block comprising the encoded image including the data attributes which are encoded into the one or more image layers, and storing the data block via a hash-linked chain of data blocks on a distributed ledger.

Multi-layered image encoding for data block

Growing community of inventors

Broomfield, CO, United States of America

Srinivas Babu Tummalapenta