International Business Machines Corporation

Tanium Inc.

Malwarebytes Corporate Holdco Inc.

Thomas R Gissel

Brian Keith Martin

Christian L Hunt

William Thomas Newport

Jason Robert McGee

Daniel Mark Floyd

Aaron J Tarter

Benjamin Hobbs

Michael L Fraenkel

Hidayatullah Habeebullah Shaikh

Asser Nasreldin Tantawi

Tamar Eilam

Sai Gopala Rathnam

Giovanni Pacifici

Andrew Neil Trossman

Alexander V Konstantinou

Guerney Douglass Holloway Hunt

Raghuram Sri Sivalanka

Marc E Haberkorn

Michael Smith

Thomas W Savage

Atanu Podder

Brian P Morehead

Adam S Hyder

A newly created or modified object is sent to a networked local or remote server for analysis. While the object is being analyzed for vulnerabilities, the object is locked and made inaccessible to users, devices, and networks. If the object is identified as malicious, it may be marked for review, deleted, placed in quarantine, or have its permissions changed so that it cannot cause harm by propagating through the environment. Conversely, if the object is identified as safe, the risk of ransomware attacks may also be mitigated by replicating the object across multiple cloud storage platforms.

Cloud ransomware protection

This application is directed to an integrity monitoring method performed at a computational machine in a linear communication orbit. The computational machine receives a watch list through the linear communication orbit. The watch list identifies objects for which events are to be monitored at the computational machine. While a plurality of events are occurring locally at the computational machine, the computational machine identifies the plurality of events in real-time. The identified events include events for the objects identified by the watch list, and event information for these identified events is stored in a local database of the computational machine. In response to an integrity reporting request received through the linear communication orbit, the computational machine identifies event information for at least some of the objects identified by the watch list in the local database, and returns the identified event information to a server system through the linear communication orbit.

Integrity monitoring in a local network

A respective node in a linear communication orbit receives an instruction packet through the linear communication orbit, where the instruction packet has been propagated from a starting node to the respective node through one or more upstream nodes along the linear communication orbit, and the instruction packet includes an instruction for establishing a direct duplex connection between the respective node and a respective server. In response to receiving the instruction packet, the respective node sends an outbound connection request to the respective server to establish the direct duplex connection. The respective node then uploads local data to the respective server through the direct duplex connection (e.g., in response to one or more queries, instructions, and requests received from the respective server through the direct duplex connection), where the respective server performs analysis on the local data received from the respective node through the direct duplex connection.

System and method for performing event inquiries in a network

A method for evaluating indicators of compromise (IOCs) is performed at a device having one or more processors and memory. The method includes receiving respective specifications of a plurality of IOCs, wherein the respective specifications of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC. The method further includes dynamically determining an order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs, and determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order, instead of an order by which the plurality of IOCs have been received at the device.

Cost prioritized evaluations of indicators of compromise

A remote server dispatches an instruction packet to a node in a network through a linear communication orbit formed by a collection of nodes. The instruction packet propagates from node to node along the linear communication orbit until reaching the node. The instruction packet includes instructions for establishing a direct duplex connection between the node and the remote server. After dispatching the instruction packet to the node through the linear communication orbit, the remote server receives, from the node, a request for establishing the direct duplex connection. In response to receiving the request from the node, the remote server establishes the direct duplex connection. After establishing the direct duplex connection, the remote server issues instructions to the node to upload local data from the node to the remote server through the direct duplex connection.

A method, system and computer program product for decoupling components of a software system at load/compile time to accelerate application startup times. In particular, a software components partitioning (SCP) utility pre-defines a number of (implementation) classes to initiate and facilitate the decoupling process. The SCP utility allows the method names and argument lists to be recorded from a remote interface into a local interface which emulates the remote interface. The local interface is augmented with an annotation to define the remote interface. Additionally, a pre-defined keyword is appended to the name of the local interface to enable the creation of a (pre-defined) classname. Furthermore, when the classname is loaded, an implementation (via a Java implementation class, for example) for the remote class is loaded, and the implementation is associated with a dynamic proxy that implements both the local and remote interfaces, on demand.

Decoupling components of a software system at compile time and load time

System for managing a life cycle of a virtual resource. One or more virtual resources are defined. The one or more defined virtual resources are created. The created virtual resources are instantiated. Then, a topology of a virtual resource is constructed using a plurality of virtual resources that are in at least one of a defined, a created, or an instantiated state.

Method and system for constructing virtual resources

Modules which are running outside of a first application server virtual machine (VM) are enabled to introspect into modules running inside the first VM by notifying a manageable component factory by an application module being executed by a first application server VM of a need to allow a second VM to introspect into and to load class information regarding objects already running in the first VM, wherein the first and second virtual machines are separate virtual machines; registering the already-running object class information to a manageable component server using a descriptor; and loading the registered class information by the second VM from the manageable component server, wherein a tool object or administrative object running in the second VM introspects into and loads the objects already running in the first virtual machine without use of an application programming interface.

Externalized classloader information for application servers

In a method and system for monitoring events occurring at respective servers of a configuration of nodes, a first server located at a first node receives information from a messaging system pertaining to events at servers located at other nodes. The messaging system usefully comprises a highly available (HA) bulletin board or the like. When the first server receives a start event notification pertaining to a second server located at a second node, a direct communication path is established between the first and second servers. The first server identifies events in the second server that affect or are of interest to services of the first server. The first server then registers with the second server, to receive notification through the direct communication path when respective identified events occur.

Method and system for monitoring server events in a node configuration by using direct communication between servers

A method of dynamic performance balancing in a distributed computer system including collecting average service time statistics for application requests distributed from multiple application servers and collecting application server CPU utilization statistics from multiple hosts where each host is associated with at least one of the application servers. In addition, the method includes periodically calculating scaled routing weights from the average service time and CPU utilization statistics and distributing server requests to the application servers in accordance with the scaled routing weights. Also provided is a distributed computer system configured to accomplish dynamic performance balancing as described above, and an article of manufacture for use in programming a distributed computer system containing instructions to accomplish dynamic performance balancing of server requests as described above.

Method and system for performance balancing in a distributed computer system

A process and system for externalizing classloader information to non-application modules such as tool modules that do not reside within the same Application server virtual machine such as a J2EE AppServer JVM. Tools that read and display classloader information typically need to co-reside within the AppServer because of the virtual machine security mechanisms that prevent classes outside the virtual machine itself to introspect the classloaders. This presents a problem for tooling vendors because most server owners do not want anything other than their applications running within the AppServer virtual machine. The invention allows tooling vendors to create a classloader tool that is external to the AppServer virtual machine, and which is running in a completely separate virtual machine, thus having minimal overhead on production systems, but which allows classloading through standard or open (e.g. non-proprietary) interfaces.

Growing community of inventors

Apex, NC, United States of America

Thomas R Gissel