International Business Machines Corporation

Open Tv Corporation

Arkose Labs Holdings, Inc.

Globalfoundries Inc.

Suresh N Chari

Ian M Molloy

Ashish Kundu

Youngja Park

Josyula R Rao

Wilfried Teiken

Kapil Kumar Singh

Dimitrios Pendarakis

Taesung Lee

Ted A Habeck

Heqing Huang

Dong Su

Pankaj Rohatgi

Sridhar R Muppidi

Christopher Gates

Pau-Chen Cheng

Benjamin J Edwards

Helmut Scherzer

Hasini Gunasinghe

Todd Eric Kaplinger

Marc Philippe Stoecklin

Lawrence H Koved

Vincenzo Valentino DiLuoffo

Anees Abdul Shaikh

Elaine Rivette Palmer

Paul Ashley Karger

Zhongshu Gu

Michael Steiner

Stephen Carl Gates

Tal D Rabin

David Claude Toll

Gang Chen

Vincent Louis Dureau

Sambit Sahu

Kang-Won Lee

Douglas Lee Schales

Reiner Sailer

Raymond Byars Jennings, Iii

Xin Hu

Hugo M Krawczyk

Francisco Phelan Curbera

David Alson George

Jialong Zhang

Abhishek Malvankar

Matthew Jason Duftler

Xiaokui Shu

Rania Yousef Khalaf

Steven J Szymanski

Paula K Austel

Wietse Z Venema

Jean Rene Menand

Matthias Kaiserwerth

Benjamin E Andow

Florian F Rosenberg

Willliam J Rippon

Steven Szymanski

An example operation may include one or more of connect to a blockchain network of an ecosystem comprised of a plurality of consumer nodes, generate a universal unique identifier (UUID) associated with a user data attribute, execute a query request for the user data attribute associated with the UUID, derive a disclosure level from the query request, execute a smart contract to commit to a blockchain ledger, a monetary value associated with the user data attribute, negotiate a transaction with the consumer node to access the user data attribute and record an agreement result onto the a blockchain ledger.

Identity ecosystem

Anomalous control and data flow paths in a program are determined by machine learning the program's normal control flow paths and data flow paths. A subset of those paths also may be determined to involve sensitive data and/or computation. Learning involves collecting events as the program executes, and associating those event with metadata related to the flows. This information is used to train the system about normal paths versus anomalous paths, and sensitive paths versus non-sensitive paths. Training leads to development of a baseline 'provenance' graph, which is evaluated to determine 'sensitive' control or data flows in the &#x201c;normal&#x201d; operation. This process is enhanced by analyzing log data collected during runtime execution of the program against a policy to assign confidence values to the control and data flows. Using these confidence values, anomalous edges and/or paths with respect to the policy are identified to generate a &#x201c;program execution&#x201d; provenance graph associated with the policy.

Policy-based detection of anomalous control and data flow paths in an application program

Automatically generating audit logs is provided. Audit log statement insertion points are identified in components of an application based on a static code analysis identifying start and end operations on sensitive data in the components of the application. The application is instrumented with audit log statements at the audit log statement insertion points in the components of the application. Audit logs of monitored sensitive data activity events in the application are generated using the audit log statements at the audit log statement insertion points in the components of the application.

Automatic audit logging of events in software applications performing regulatory workloads

A method for anomaly detection on a system or application used by a plurality of users includes providing an access to a memory device storing user data samples of a usage of the system or application for all users of the plurality of users. A target user is selected from among the plurality of users, using a processor on a computer, with data samples of the target user forming a cluster of data points in a data space. The data samples for the target user are used to generate a normal sample data set as training data set for training a model for an anomaly detection monitor for the target user. A local outlier factor (LOF) function is used to generate an abnormal sample data set for training the anomaly detection monitor for the target user.

Automatic generation of training data for anomaly detection using other user's data samples

An example operation may include one or more of receiving, by a blockchain node or peer of a blockchain network, attribute data for a user profile, creating blockchain transactions to store attribute hashes and metadata to a shared ledger, receiving a user profile query from an identity consumer, creating blockchain transactions to retrieve attribute hashes and metadata corresponding to the query, reconstructing the user profile from the metadata, responding to the query by providing attribute data to the identity consumer, and creating and storing hashes of the attribute data and metadata to the shared ledger.

Decentralized database identity management system

Managing passwords is provided. A machine training process is performed using a set of existing passwords to train a machine learning component. Members of a set of semantic categories are used to categorize respective passwords in the set of existing passwords. Password strengths corresponding to a set of candidate passwords are evaluated using the machine learning component. A resource is secured with a candidate password having a password strength greater than or equal to a defined password strength threshold level.

Two-level sequence learning for analyzing, metering, generating, and cracking passwords

A computer system extracts features of documents that mention malware programs to determine textual features that correspond to individual ones of the malware programs. The computer system performs analysis of samples of malware programs to determine features corresponding to the samples. The computer system performs clustering using the textual features and using the features that correspond to the samples of the malware programs. The clustering creates clusters of data points, each data point corresponding to an individual one of the malware programs. The clusters contain data points considered by the clustering to be similar. The computer system outputs indications of the clusters to allow determination of whether data points in the clusters correspond to individual ones of specific malwares. Apparatus, methods, and computer program products are disclosed.

Malware clustering approaches based on cognitive computing techniques

Automatically estimating a sensitivity level of an information technology (IT) asset in one aspect may obtain information about an asset. Characteristics of the asset assigned based on the information may be compared with stored characteristics of known sensitive assets. A sensitivity level of the asset may be determined based on the comparing.

Estimating asset sensitivity using information associated with users

A method contains malware within a network resource. A blockchain system establishes a smart contract, on the blockchain system, for a network resource in a computer environment. The smart contract is for an action to be performed on the network resource if a malware is detected on the network resource. In response to malware being detected in the network resource, the blockchain system determines whether a consensus is reached by a plurality of computers on the blockchain system to implement the action to contain the malware based on the smart contract. In response to the consensus being reached by the plurality of computers, the blockchain system transmits, to the network resource, directions to implement the action on the network resource as specified by the smart contract.

Blockchain-based malware containment in a network resource

A processor-implemented method facilitates identity exchange in a decentralized setting. A first system performs a pseudonymous handshake with a second system that has created an identity asset that identifies an entity. The second system has transmitted the identity asset to a third system, which is a set of peer computers that support a blockchain that securely maintains a ledger of the identity asset. The first system transmits a set of pseudonyms to the third system, where the set of pseudonyms comprises a first pseudonym that identifies the first system, a second pseudonym that identifies a user of the second system, and a third pseudonym that identifies the third system. The first system receives the identity asset from the third system, which securely ensures a validity of the identity asset as identified by the first pseudonym, the second pseudonym, and the third pseudonym.

Privacy-preserving identity asset exchange

Mechanisms are provided to implement a single input, multi-factor authentication (SIMFA) system. The SIMFA system receives a user input for authenticating a user via a single input channel and provides the user input to first authentication logic of an explicit channel of the SIMFA system, where in the first authentication logic performs a knowledge authentication operation on the user input. The SIMFA system further provides the user input to second authentication logic of one or more side channels of the SIMFA system, where the second authentication logic performs authentication on non-knowledge-based characteristics of the user input. The SIMFA system combines results of the first authentication logic and the second authentication logic to generate a final determination of authenticity of the user. The SIMFA system generates an output indicating whether the user is an authentic user or a non-authentic user based on the final determination of authenticity of the user.

Single channel input multi-factor authentication via separate processing pathways

Detecting malicious user activity is provided. A profile for a user that accesses a set of protected assets is generated based on static information representing an organizational view and associated attributes corresponding to the user and based on dynamic information representing observable actions made by the user. A plurality of analytics is applied on the profile corresponding to the user to generate an aggregate risk score for the user accessing the set of protected assets based on applying the plurality of analytics on the profile of the user. A malicious user activity alert is generated in response to the aggregate risk score for the user accessing the set of protected assets being greater than an alert threshold value. The malicious user activity alert is sent to an analyst for feedback.

Detecting malicious user activity

A processor-implemented method improves security in a blockchain network of devices by protecting security, privacy and ownership assurance of identity assets, where the blockchain network of devices supports a blockchain. An identity asset provider device establishes co-ownership of an identity asset for an identity asset provider and an entity. The identity asset provider device directs a first member of the blockchain network of devices to associate identities of the identity asset provider and the entity based on their co-ownership of the identity asset by using commitments between the identity asset provider and the entity and based on collaborative proof of ownership of the identity asset using zero knowledge proofs in the blockchain network of devices.

Protection of confidentiality, privacy and ownership assurance in a blockchain based decentralized identity management system

Growing community of inventors

Tarrytown, NY, United States of America

Suresh N Chari