International Business Machines Corporation

Takuya Mishina

Yuji Watanabe

Naoto Sato

Ai Ishida

Sanehiro Furuichi

Fumiko Akiyama

Fumiko Satoh

Yoichi Hatsutori

John David Wilson

Takaaki Tateishi

Hiroshi Horii

Kazuhito Akiyama

Sachiko Yoshihama

Michiharu Kudo

Hitomi Takahashi

Masayoshi Teraguchi

Takayuki Kushida

Norie Iwasaki

Masami Tada

Akira Saito

Toshiro Takase

Kugamoorthy Gajananan

Takahide Nogayama

Hiroaki Uetsuki

Yasuharu Katsuno

Kohichi Ono

Atsumi Ikebe

Operation testing without side effects may be enabled by a method including preparing a copy of a directory set of at least a part of a host system disk, creating a link to a file in a first directory in the host system disk, in a second directory of the copy of the directory set, wherein the second directory corresponds in position to the first directory in the directory set, and starting a non-privileged system using a disk image including the copy of the directory set and the created link.

Side-effect resistant operation testing

A method is provided for reducing memory consumption by a rule engine. The method includes receiving attack trees, each having nodes and edges. Each node represents a security event and is associated with a detection rule for detecting an occurrence thereof. Each edge connects a respective node pair. The method includes assigning a watchpoint to each leaf node. The method includes moving the watchpoint assigned to any leaf node to a next upstream node, responsive to detecting an occurrence of the security event represented by the leaf node. The method includes erasing the watchpoint assigned to all downstream nodes relative to the next upstream node, responsive to the next upstream node being connected to a next downstream node using an edge having an 'OR' join type. Only the rules for nodes currently having the watchpoint assigned are loaded into a memory device during runtime, while excluding rules for remaining nodes.

Using attack trees to reduce memory consumption by rule engines

Techniques for analyzing data based on the vulnerability of the corresponding device are provided. A plurality of devices are classified into a plurality of groups based on respective measures of vulnerability associated with each device, and a respective weighting factor is determined for each respective group of the plurality of groups based at least in part on a number of devices included in the respective group. An evidentiary value of data received from a first device of the plurality of devices is modified, based on the respective weighting factor associated with the first device. Further, a probable state of a physical environment is determined, based in part on the data received from the first device.

Processing and evaluating data based on associated device vulnerability

A computer-implemented method is provided for ensuring a particular service level provided by multiple devices. The method includes maintaining, by a database, complementation parameters for a set of device groups. Each of the device groups includes at least two devices such that one of the two devices can complement at least one functionality of another one of the at least two devices in a same one of the device groups. The method further includes monitoring, by a processor operatively coupled to the database, the devices in the device groups to detect device malfunctions. The method also includes, responsive to a detection of a malfunctioning device from among the device groups, ensuring, by the processor, the particular service level by changing complementation parameters of a corresponding one of the devices paired with the malfunctioning device.

Ensured service level by mutual complementation of IoT devices

A system prevents divulgation of sensitive data in two snapshots, taken at different times, of one or more systems. The system identifies a set of files from among file pairs. Each file pair is formed from a respective file that includes a difference with respect to each of the two snapshots. The system performs a pattern reducing process that removes, from the set, any file having, as the at least one difference, a predetermined non-sensitive difference between respective executions of a pre-determined system operation. The system performs a commonality reducing process that removes, from the set, any file having, as the at least one difference, a common difference between different system users. The system annotates data in remaining files in the set as potentially being sensitive data. The predetermined non-sensitive difference is determined using a Sandbox host. The common difference is determined using an actual one of the systems.

Privacy annotation from differential analysis of snapshots

Monitoring a process on an Internet of Things (IoT) device is performed by receiving, by the IoT device, a network data transfer from an external device; and receiving, by the IoT device, meta-information of the network data transfer. The meta-information can be generated, based on the network data transfer, by a network monitoring device. Additionally, the IoT device detects a file storing data of the network data transfer based on the meta-information. Further, the IoT device monitors a process relating to the detected file on the IoT device.

Monitoring a process on an IoT device

A method is provided for preventing divulgation of sensitive data in two snapshots, taken at different times, of one or more same systems in a cloud environment. The method identifies a set of files from among file pairs. Each file pair is formed from a respective file that includes at least one difference with respect to each snapshot. The method performs a pattern reducing process that removes, from the set of files, any of the files having, as the difference, a predetermined non-sensitive difference between respective executions of a pre-determined system operation. The method performs a commonality reducing process that removes, from the set of files, any files having, as the difference, a common difference between different users. The method annotates data in remaining files in the set as potentially being the sensitive data, subsequent to the reducing processes. The two snapshots include at least one Sandbox-based image.

A computer-implemented method, a computer program product, and a computer system for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

Automatic transformation of security event detection rules

A method is provided for preventing divulgation of sensitive data in two snapshots, taken at different times, of one or more same systems in a cloud environment. The method includes identifying a set of files from among a plurality of file pairs. Each file pair is formed from a respective file that includes at least one difference with respect to each snapshot. The method includes performing a pattern reducing process that removes, from the set of files, any of the files having, as the difference, a predetermined non-sensitive difference between respective executions of a pre-determined system operation. The method includes performing a commonality reducing process that removes, from the set of files, any files having, as the difference, a common difference between different users. The method includes annotating data in remaining files in the set of files as potentially being the sensitive data, subsequent to the reducing processes.

Systems and methods for network access control, including sending a service request from an on-premise system to one or more offloaded front-end services on one or more offloading servers. The requests by the offloaded services to access back-end services in one or more on-premise systems are monitored, and access requests by the offloaded services for unauthorized back-end services are denied. The service request is redirected and locally executed to generate logs of the back-end services used to perform the service request if the access requests are denied. A permission mapping in a firewall between the offloaded services and the logged back-end services is updated to permit future access requests by the offloaded services.

Permission based access control for offloaded services

A computer-implemented method for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

A method is for handling an anomaly in an industrial control system (ICS) connected to a network with a plurality of other ICSs and an anomaly analyzer. An ICS receives status data from its own industrial process, and stores this status data as normal pattern data. The ICS transmits its own status data to one or more other ICSs. The ICS receives an indication from the anomaly analyzer that the ICS is suspected of having an anomaly. The ICS transmits alternate status data based on the normal pattern data stored during non-suspect operation, and stores the status data received from its own industrial process as real status data. In response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmits the stored real data, and switches back to transmitting its own status data to one or more other ICSs.

Anomaly detection system, anomaly detection method, and program for the same

An anomaly detection system for detecting an anomaly within a network as a first embodiment in order to provide an anomaly detection system, anomaly detection method, and program for the same. An anomaly detection system which has a plurality of industrial control systems (hereinafter 'ICS's) which are connected to the network, an integrated analyzer which receives the operational status of each ICS as monitoring data in order to identify an ICS for which an anomaly is suspected so as to perform an anomaly assessment, a receiving unit provided for each ICS which receives data from other ICSs, a transmission unit which transmits data to other ICSs and transmits the monitoring data to the integrated analyzer, a security policy which includes recording of data and generation rules, and a wrapper which refers to the security policy in order to control the data so as to transmit the same to other ICSs.

Growing community of inventors

Kanagawa, Japan

Takuya Mishina