International Business Machines Corporation

Szymon Kowalczyk

Michal S Paluch

Piotr P Godowski

Tomasz Hanusiak

Andrzej Pietrzak

Marcel Butucea Panait

David Warren Knapp, Jr

Oleksii Tosov

Lukasz Józef Matyasik

Kacper Krzyżak

Jiri Grunseisen

A computer-implemented method obtains information about an external computer system having a connection to a computer system. The method may comprise receiving a request from the external computer system. In response to categorizing the external computer system as a potential threat responsive to the request, a computer file is generated responsive to the request. The computer file comprises instructions which are designed for obtaining the information about the external computer system if the instructions are executed on a processor of the external computer system. Furthermore, data is provided responsive to the request. The data is sent together with the computer file to the external computer system. The information about the external computer system, which is generated responsive to the instructions of the computer file, is received by the computer system for preserving it for a later use for developing measures for protecting the computer system.

Tracking a potential attacker on an external computer system

An example operation may include one or more of identifying a pod that is within a namespace of a host platform, reading a file from a metadata storage of the pod, wherein the file that includes software definition data of the pod, identifying a field within the configuration data of the pod that contains an invalid entry based on a comparison of a value stored in the field to a predefined list of annotations, and in response to the identification of the invalid field, generating and store a log entry into a log of the pod which identifies the invalid field.

System and method for validation and correction of metadata in containerized software enviornments

A method is provided for rate limiting in a network. The method comprises receiving a traffic flow from the network. In a supervised learning phase, and determining if the traffic flow matches a pretrained network flow model. If so, the method comprises designating the traffic flow as a classified traffic flow according to the pretrained network flow model. The method further comprises advancing to a grouping phase, conditioned upon the traffic flow not matching pretrained network flow models. In the unsupervised learning phase, the method comprises designating the traffic flow as a classified traffic flow. In the grouping phase that follows the supervised learning phase and the unsupervised learning phase, the method comprises using side information about the traffic flows to assign related traffic flows into traffic flow groups, identifying a particular traffic flow group from the traffic flow groups as being an offending traffic flow group.

Adaptive network control of traffic flows in a secure network

Containerized software discover and identification can include discovering a plurality of container remnants by electronically scanning portions of computer memory of at least one computer system of one or more of computing nodes, the portions of computer memory being allocated to persistent storage of computer data, and each container remnant containing computer data providing a record of system-generated execution attributes generated in response to execution of one or more containerized applications. One or more inactive container remnants unutilized by a currently running containerized application can be identified among the plurality of container remnants. Each inactive container remnant can be categorized, the categorizing being based on system-generated execution attributes contained in each inactive container remnant. Based on the categorizing, a previously run containerized application can be identified by reference to a database comprising data whose structures map identities of containerized applications to patterns of execution attributes.

Containerized software discovery and identification

One or more computer processors responsive to a hypervisor data request, generate an encrypted set of hypervisor data indicating hypervisor hardware details using a plurality of respective asymmetric encryption keys to tag the generated set of encrypted hypervisor data with a timestamp at a time of encryption. The one or more computer processors decrypt the tagged set of encrypted hypervisor data utilizing a software asset manager and the plurality of respective asymmetric encryption keys determined valid based on a threshold time period and the tagged timestamp. The one or more computer processors validate the set of decrypted hypervisor data utilizing corresponding checksums to determine whether the set of encrypted hypervisor data was successfully decrypted. The one or more computer processors sanitize the validated hypervisor data based on a corresponding software license.

Secure virtual machine software management

A computer implemented method and related system determine a current load result of a software container executing on a compute node in a container system. In response to determining that the current load result exceeds a predetermined scale-up threshold for the software container, the method adds a first plurality of replicas of the software container to the compute node, where a quantity of the first plurality of replicas is related to the current load result. In response to determining that the current load result is less than a predetermined scale-down threshold for the software container, the method deletes a second plurality of replicas of the software container from the compute node, where a quantity of the second plurality of replicas is related to the current load result.

Service load independent resource usage detection and scaling for container-based system

Provided are a computer program product, system, and method for scanning a computing system to determine a computing system profile and problems to recommend actions to initiate with the computing system. A package is transmitted to the computing system including package code to scan the computing system to determine a computing system profile comprising a computing architecture and installed applications at the computing system. The computing system profile is processed to determine a recommended action to perform with respect to the computing system to improve operations of the computing system based on the computing system profile. A display element is generated in a user interface with information on the recommended action to enable a user of the computing system to implement the recommended action. The package code executes within the computing system without communicating over the network to an external system outside of a computing environment of the computing system.

Scanning a computing system to determine computing profile and problems to recommend an action to initiate with the computing system

An image for a containerized application is created. From the image, one or more main processes of the containerized application are identified. The one or more main processes comprise a first subset of a plurality of processes of the containerized application. Within a sandbox environment, the containerized application is started. Based on the started application within the sandbox environment, a second subset of processes within the plurality is determined. The second subset includes one or more dependent processes associated with the first subset. A third subset of processes within the plurality is determined. The third subset excludes the first and second subsets and is associated with a vulnerability list. According to the third subset, a mitigated image for the containerized application is generated.

Automatic vulnerability mitigation

A first computer system is scanned at configured, default time intervals by a software asset management ('SAM') software application installed on the first computer system, wherein the scanning detects other software applications installed on the first computer system. The SAM software application generates a list of the other software applications installed on the first computer system and stores the list on a computer readable storage medium. An override software module triggers the SAM software application to perform an early scan of the first computer system, before a scan of the first computer system that the SAM software application would otherwise perform at a next default scan time. The triggering is in response to information obtained from a source external to the first computer system about a triggering one of the software applications on the list.

Technology for adaptive software discovery scan

Provided are techniques for automated software application license usage. Global detection results that indicate, for each of a plurality of end user computers, one or more installed software applications, one or more running software applications, and a user account. Unique pairs are identified using the global detection results, wherein each pair of the unique pairs comprises a software application name for a software application and a user name for a user. For a unique pair, a query is run against a user registry to get a list of user groups that the user name is a member of, a user group is selected that corresponds to the software application name, and a number of users in the selected user group is designated as a license demand for authorized users for the software application. Then, based on the global detection results and the license demand, one or more recommendations are provided.

Determining software application license usage

An example operation may include one or more of detecting a web session within an open window of a web browser on a user device, monitoring for user activity on the user device with respect to the web browser, determining there has been a lack of user activity with respect to the web browser for a predetermined amount of time based on the monitoring of the user activity, and temporarily concealing content within the open window of the web browser in response to the lack of user activity.

Growing community of inventors

Cracow, Poland

Szymon Kowalczyk