International Business Machines Corporation

Kyndryl, Inc.

Tim Uwe Scheideler

Erik Rueger

Stefan Ravizza

Arjun Udupi Raghavendra

Andrea Giovannini

Matthias Seul

Florian Graf

Thomas Allen Snellgrove

Frederik Frank Flöther

Thorsten Muehge

Petra Sabine Buehrer

Ivan James Reedman

Nils Haustein

Dominic Mueller-Wicke

Boas Betzler

Joerg H Walter

Stefan Mayer

Raphael Waltert

Andre Gaschler

Simon Streit

Oliver Roehrsheim

Tiziano Airoldi

Marc Albrecht

Peter Minig

Avdyl Haxhaj

The exemplary embodiments disclose a method, a computer system, and a computer program product for detecting malware. The exemplary embodiments may include aggregating known malware patterns by storing malware patterns and related malware categories of the malware patterns. The exemplary embodiments may additionally include training a first machine-learning system, comprising a generator portion and a discriminator portion, by using the known malware patterns and the related malware categories as training data. The exemplary embodiments may also include generating additional synthetic code patterns by feeding random code samples to the trained first machine-learning system. The exemplary embodiments may further include training a second machine-learning system by using benevolent code patterns and the generated additional synthetic code patterns as training data. The exemplary embodiments may include determining a statistical distribution of predicted malicious code patterns and related categories, and determining a quality value of the training of the second machine-learning system.

Self-learning and adapting cyber threat defense

A method for processing security events by applying a rule-based alarm scheme may be provided. The method includes generating a rule index of rules and an indicator of compromise index for each of the rules. The method includes also processing the incoming security event by applying the rules, increasing a current rule counter relating to a triggered rule, and increasing a current indicator of compromise counter pertaining to the triggered rule. Furthermore, the method includes generating a pseudo security event from received data about known attacks and related indicators of compromise, processing the pseudo security events by sequentially applying the rules, increasing a current rule counter of pseudo security events, and increasing a current indicator of compromise counter for pseudo security events, and sorting the rules and sorting within each rule the indicator of compromise values in the indicator of compromise index.

System and method for SIEM rule sorting and conditional execution

A computer-implemented method for managing access rights to a knowledge graph is provided. The method comprises splitting, for each user system, its respective portion of the knowledge graph into a plurality of knowledge subgraphs, encrypting each of the knowledge subgraphs, and generating a plurality of private summary graphs. The method also comprises maintaining a collaboration graph comprising one vertex per user system and edges representing collaborations between the users, mapping all private subgraphs of all user systems to one public summary graph, each vertex of the public summary graph comprises less data than the related vertex of the related private summary graphs and wherein none of the vertices of the summary graph comprises any encryption or decryption key, and granting access to a selected knowledge subgraph from a first user system to a second user system.

Encrypted knowledge graph

Methods, computer program products, and systems are presented. The methods include customer specific information exchange and an adjustment of the privacy level of this information. For this purpose an abstraction layer and an obfuscation module are introduced. Using a 'fraud vector' a risk assessment is performed on the obfuscated transaction data.

System and method for enforcing granular privacy controls during transaction fraud screening by a third party

A method includes receiving a first query by a computing device and assigning the first query to a plurality of cognitive engines, wherein each of the plurality of cognitive engines include different characteristics for processing data. The method also includes, responsive to receiving a response from each of the plurality of cognitive engines for the first query, comparing the received responses from the plurality of cognitive engines. The method also included responsive to determining a difference between a first response from a first cognitive engine and a second response from a second cognitive engine is above a predetermined threshold value, performing a response mediation process until the difference is below the predetermined threshold value. The method also includes selecting a first final response from the received responses for the first query and the second query and displaying the first final response to a user.

Cognitive moderator for cognitive instances

Aspects of the present invention disclose a method, computer program product, and system for detecting a malicious process by a selected instance of an anti-malware system. The method includes one or more processors examining a process for indicators of compromise to the process. The method further includes one or more processors determining a categorization of the process based upon a result of the examination. In response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, the method further includes one or more processors executing the process in a secure enclave. The method further includes one or more processors collecting telemetry data from executing the process in the secure enclave. The method further includes one or more processors passing the collected telemetry data to a locally trained neural network system.

Malware detection by distributed telemetry data analysis

A computer-implemented method for protecting a processing environment from malicious incoming network traffic may be provided. The method comprises: in response to receiving incoming network traffic comprising a data packet, performing a packet and traffic analysis of the data packet to determine whether said data packet is non-malicious and malicious, and processing of the data packet in a sandbox environment. Furthermore, the method comprises: in response to detecting that the data packet is non-malicious based on the packet and traffic analysis, releasing the processed data packet from the sandbox environment for further processing in the processing environment, and in response to detecting that the data packet is malicious based on the packet and traffic analysis discarding the data packet.

Deep packet analysis

A method for providing protection of a computing resource constrained device against cyberattacks may include collecting threat intelligence data in form of indicators of compromise (IoC). The indicators may include cyberattack chain related data. The method may also include determining a relevance of the cyberattack chain for the device, measuring a utilization of security measures in terms of their detection of the respective IoCs and their respective responses to the IoCs, measuring a resource consumption of the security measures, and determining a benefit value for at least one the security measure expressed by its utilization and a relevance value of the IoCs detected with it.

Adaptive security for resource constraint devices

A computer-implemented method for dynamically identifying security threats comprising a cyber-attack chain composed of a sequence of partial cyber-attacks represented by attack patterns may be provided. The method comprises receiving a sequence of security events, determining, a first cyber-attack pattern by applying a set of predefined rules for detecting an indicator of compromise of a first partial cyber-attack of the cyber-attack chain&#x2014;thereby, identifying a specific cyber-attack chain&#x2014;and determining a type and an attribute in the pattern of the first partial cyber-attack. The method comprises further configuring at least one rule for a downstream partial cyber-attack in the specific cyber-attack chain based on the type and the attribute in the attack pattern of the first partial cyber-attack, and adding the at least one configured rule to the set of predefined rules to be used by the correlation engine for dynamically identifying security threats to information technology systems.

Adaptive rule generation for security event correlation

A method and a related system for controlling user access to a target node in a knowledge graph may be provided. The method comprises defining a knowledge graph structure limitation for a user, defining a node type depending on the number of edges connecting to the node, determining a condition for an access to the target node, based on the knowledge graph structure limitation relative to the start node and the node type of the target node, upon the user attempting, coming from a start node, to access the target node in the knowledge graph, and granting access to the target node based on the determination.

Growing community of inventors

Schoenenberg, Switzerland

Tim Uwe Scheideler