International Business Machines Corporation

Sulakshan Vajipayajula

Sreekanth Ramakrishna Iyer

Kaushal Kiran Kapadia

Dhilung Hang Kirat

Stephen Cameron Will

Manoj Palat

Nataraj Nagaratnam

Marc Philippe Stoecklin

Youngja Park

Ravi Krishnan Muthukrishnan

Ilgen Banu Yuceer

Sasikanth B Ammanamanchi

Kevin Tabb

Dusi Sarath Chandra

Ian M Molloy

Sridhar R Muppidi

Michael Vu Le

Paul Coccoli

James Brent Peterson

Kartik Srinivasan

Anne Tilstra

A method, system, and computer-usable medium for analyzing security data formatted in STIX&#x2122; format. Data related to actions performed by one or more users is captured. Individual tasks, such as analytics or extract, transform, load (ETL) tasks related to the captured data is created. Individual tasks are registered to a workflow for executing particular security threat or incident analysis. The workflow is executed and visualized to perform the security threat or incident analysis.

Analytics engine for data exploration and analytics

For providing computing resources to a user a liaison service initializes communication for first and second computing resources for the user. The liaison services communicate between the user and the computing resources. The communicating authenticates respective requests by the user for the respective first and second computing resources. Initializing the first and second computing resource services for the user by the liaison service includes providing, to the user via the liaison service, respective first and second account identifiers for the respective first and second computing resource services and includes storing in association with the first and second account identifiers, by the liaison service in a user password vault, respective first and second computing resource key identifiers.

Technology for computing resource liaison

Aspects of the present invention provide for methods that index geographic locations with comparative indicators that are determined from a sentiment analysis of opinion data, wherein the comparative indicators may include sums of different indices that are each determined from sentiment analysis of opinion data.

Location based data mining comparative analysis index

A framework system is present that provides an end-to-end solution for user on-boarding, storing, securing, configuring, authenticating of the target person (grantee user), and transmittal of digitized documents assets. The framework system is preferably a multi-tenant cloud based system, although other systems may be used. The system processes multiple inputs to cognitively determine implementation (cognitive decision making) of digitized assets to a grantee user or target user without human intervention.

Adaptable access to digital assets

Identifying cyber adversary behavior on a computer network is provided. Individual security events are received from multiple threat intelligence data sources. A security incident corresponding to an attack on at least one element of the computer network, the security incident being described by the individual security events received from the multiple threat intelligence data sources, is matched to a defined cyber adversary objective in a structured framework of a plurality of defined cyber adversary objectives and a related technique associated with the defined cyber adversary objective used by a cyber adversary in the attack. A set of mitigation actions is performed on the computer network based on matching the security incident corresponding to the attack on the computer network to the defined cyber adversary objective and the related technique.

Identifying cyber adversary behavior

Data item transfer between mobile devices is provided. Network association and proximity of a plurality of mobile devices of a requested data item by a requesting mobile device are determined using a shared ledger of mobile device inventory data, mobile device network connection data, and mobile device geolocation data. A target mobile device that contains the requested data item, is connected to a same local network as the requesting mobile device, and is geographically located proximate with a threshold to the requesting mobile device is identified based on the determined network association and proximity of the plurality of mobile devices and data in the shared ledger. A transfer of the requested data item from the target mobile device to the requesting mobile device is initiated via the same local network based on mobile device management policies.

Data item transfer between mobile devices

Optimizing ingestion of security structured data into a graph database for security analytics is provided. A plurality of streams of information is received from a plurality of security information sources. Respective subsets of information are ingested from each of the plurality of security information sources to generate small subgraphs of security information. Each of the small subgraphs comply to a schema used by a master knowledge graph. A batch process is performed to ingest a plurality of small subgraphs into the master knowledge graph.

Optimizing ingestion of structured security information into graph databases for security analytics

Prioritizing security incidents for analysis is provided. A set of security information and event management data corresponding to each of a set of security incidents is retrieved. A source weight of a security incident and a magnitude of the security incident are used to determine a priority of the security incident within the set of security incidents. A local analysis of the security incident is performed based on the retrieved set of security information and event management data corresponding to the security incident and the determined priority of the security incident.

Selecting security incidents for advanced automatic analysis

Aspects of the present invention provide devices that index geographic locations with comparative indicators that are determined from a sentiment analysis of opinion data, wherein the comparative indicators may include sums of different indices that are each determined from sentiment analysis of opinion data.

In response to an attempt to install an instance of a container in a production environment, a set of security criteria associated with the container and features of the production environment are compared. Based on the comparison, a determination is made as to whether the features of the production environment satisfy the set of security criteria.

Enforcing security policies for software containers

Embodiments of the present invention provide systems and methods for performing a security analysis on a set of observables by inferring malicious relationships. The method includes receiving a set of observables and structured and unstructured threat data. The method further includes analyzing the observables and the structured and unstructured threat data using cognitive computing, and creating and transferring a subgraph.

Growing community of inventors

Bengaluru, India

Sulakshan Vajipayajula