International Business Machines Corporation

Other

Napatech A/s

Intelliden, Inc.

Visionael Corporation

Wayne Francis Tackabury

Doga Tav

Cesar Augusto Rodriguez Bravo

Russell L Couturier

William Alexander Bird

Michael Milde Lilja

Peter Dahl Ekner

Thomas D Silliman

Alex Omo Agerholm

Philip Due Soeberg

Martin Oberhofer

Sushain Pandit

Ivan Matthew Milman

John Richard Feezell

Calvin Stacy Powers

Michael Allen Haag

Arthur B Mellor

Jonathan S Wolf

Christopher B Anderson

Robin M Whitworth

Brian A Del Vecchio

Craig M Trim

Edgar Adolfo Zamora Duran

Ronald B Williams

Bruno Dos Santos Silva

Jason Flood

Daniel L Tonelli

Aidan Butler

Patrick Hourigan

A method, apparatus and computer system to identify threats on a TCP/IP-based network. The approach leverages a set of reference patterns (or 'network spectrals') associated with one or more defined Indicators of Compromise (IoCs). At least one reference pattern is time-bounded and profiles a network traffic pattern using a set of session data (e.g., volume, direction, traffic metadata) that is payload-neutral and may be derived in part by time-series compression of at least one non-varying encoding interval. Network traffic data associated with a traffic pattern under test is received and encoded to generate a test spectral. A stream-based real-time comparison is performed to determine whether the test spectral matches against any of the reference spectrals. Responsive to identifying a match, a given remediation or mitigation action is then taken. A reference spectral may represent a bi- or multi-directional flow, and the multi-directional flow may involve multiple entities.

Fast identification of offense and attack execution in network traffic patterns

A computer-implemented method for anomaly detection in a data processing system comprising a processor and a memory comprising instructions which are executed by the processor. The method includes receiving a plurality of real-time airflow patterns acquired by a plurality of airflow alerters, wherein each real-time airflow pattern corresponds to a different airflow alerter; comparing each real-time airflow pattern with a predetermined airflow pattern, wherein each real-time airflow pattern corresponds to a different predetermined airflow pattern; when there is any real-time airflow pattern different from the corresponding predetermined airflow pattern, identifying a group of airflow alerters among the plurality of airflow alerters, wherein a real-time airflow pattern of each airflow alerter in the group is different from the corresponding predetermined airflow pattern; and identifying a location of an anomaly based on the group of airflow alerters.

Anomaly detection based on airflow alerters

A computer-implemented method for anomaly detection in a data processing system comprising a processor and a memory comprising instructions which are executed by the processor, the method including: receiving, by the processor, a real-time airflow pattern detected from an airflow alerter, wherein the real-time airflow pattern is generated by a heating, ventilation, and air conditioning (HVAC) system in a particular facility; comparing, by the processor, the real-time airflow pattern to a predetermined airflow pattern for the HVAC system; and when the real-time airflow pattern is different from the predetermined airflow pattern, receiving, by the processor, an alert message indicating an anomaly from the airflow alerter.

Anomaly detection based on airflow measurement

An access revocation system for removing user data from a service provider device includes a processing device and a memory storing instructions for performing an access revocation method. The method includes receiving user data from a user device via a data channel, storing the user data in a data storage module, and receiving an access revocation message via a request channel separate from the data channel. The method also includes decrypting the access revocation message and performing at least one action defined by the access revocation message, the at least one action including scrubbing of user data from the data storage module.

Access revocation messaging mechanism

Embodiments are directed to a method of transferring data between a customer site and a benchmarking site, including: receiving, from the customer site, encrypted packet data, wherein the packet data is encrypted using a first key of a key pair; storing the encrypted packet data, by the processor, in a first cache at the benchmarking site; decrypting the encrypted packet data in the first cache, by the processor, using a second key of the key pair; storing decrypted packet data, by the processor, in a second cache at the benchmarking site; indexing the decrypted packet data in the second cache; storing indexed packet data as a dataset in a permanent storage device; and performing a benchmarking session on the indexed packet data.

Secure data transfer architecture for benchmarking

A method, apparatus and computer program product for managing security threats to a distributed network. A set of events are aggregated from a plurality of event sources in the network for each of a set of security threats to the network. A magnitude of a characteristic of each of the set of security threats is determined. Each of the set of security threats is represented as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic. A security action is taken based on the determined magnitude of one of the set of security threats.

Security threat management framework

Injection attack identification and mitigation includes tracking characteristics of user input by a user to a computer system via input device(s), building and maintaining a user profile based on the tracking and that provides a baseline of expected characteristics of user input, the baseline defined by the tracked characteristics, monitoring input to the computer system in real time as the input is provided to the computer system, identifying, based on the monitoring and on a comparison of characteristics of the monitored input to the baseline of expected characteristics, a potential malicious code injection as part of the monitored input to the computer system, and performing mitigation processing based on identifying the potential malicious code injection.

Injection attack identification and mitigation

Embodiments are disclosed for preventing network attacks. The techniques include generating a usage profile for a computing device that accesses a network. The techniques also include determining a plurality of actual use real-time indicators for a network connection on the network. The techniques further include determining a plurality of expected use real-time indicators for the network connection. Additionally, the techniques include calculating a risk assessment value for the network connection based on the actual use real-time indicators and the expected use real-time indicators. Further, the techniques include performing a security action for the network connection based on the calculated risk assessment value.

Preventing network attacks

A technique for secure data storage and access during transition operations includes retrieving an encrypted instance of a data object from a data store. The retrieved encrypted instance of the data object is stored in a cryptcache. The encrypted instance in the cryptcache is decrypted to a cleartext instance of the data object and stored as the cleartext instance of the data object in a clearcache. The clearcache instance of the data object is secured by controlling an access window defining an amount of time the cleartext instance of the data object is accessible in the clearcache.

Secure data storage and access during transition operations

An access revocation system for removing customer data from a service provider device includes a processing device and a memory storing instructions for performing an access revocation method. The method includes receiving customer data from a customer device via a data channel, storing the customer data in a data storage module, and receiving an access revocation message via a request channel separate from the data channel. The method also includes decrypting the access revocation message and performing at least one action defined by the access revocation message, the at least one action including scrubbing of customer data from the data storage module.

Embodiments are directed to a method of implementing a packet capture ring. The packet capture ring includes a plurality of appliances, and the plurality of appliances includes a first appliance and a second appliance. The first appliance and the second appliance are both attached to a network tap, and the first appliance works as a master appliance. The master appliance ingests packets from the network tap, encapsulates the packets and forwards encapsulated packets in the packet capture ring. The method includes: detecting, by the second appliance, a failure of the first appliance; working, by the second appliance, as the master appliance; and removing, by the second appliance, the first appliance from a forwarding designation list.

Fault-tolerant architecture for packet capture

Embodiments are directed to a packet capture ring that provides a single network tap for packet capture and a series of processors (or appliances) for handling serialization and search request processing in a confederated and highly scalable manner. One such appliance (a 'primary' appliance) maintains a tap port to the network. Each packet capture appliance has a locally attached repository that stores raw packets and a juxtaposed index that allows for retrieval of those packets. The primary appliance sends a single copy of encapsulated packets in opposite directions around the ring to its descendants. A designation is made across the system as to a 'currently designated' appliance for servicing requests for indexing and storage of captured packets. This current designation shifts from appliance to appliance in the system, as a &#x201c;previously designated&#x201d; appliance has its storage capacity filled.

Packet capture ring: reliable, scalable packet capture for security applications

Anonymization of IP addresses of a network while preserving a topology of the network is provided. Information is received regarding a network topology. The information is analyzed to generate a first model of the network topology. The first model is converted into a second model preserving the network topology and obfuscating a mapping of the IP addresses. The second model is utilized to simulate processing of network packets consistent with actual processing of the network packets in the network topology.

Network topology-preserving internet protocol address anonymization

A computer-implemented method for the placing of information assets, including: discovering information about a new or changed information asset; determining one or more characteristics of an ideal location for the information asset; determining one or more characteristics of one or more locations in an information technology environment; determining the compatibility of the information asset with the location(s) by comparing the characteristic(s) of the ideal location to the characteristic(s) of the actual location(s); reporting the compatibility to a user; and optionally suggesting alternative placement locations. The locations may be part of one or more locational schemas.

Growing community of inventors

West Tisbury, MA, United States of America

Wayne Francis Tackabury