International Business Machines Corporation

Yifat Yulevich

Alexander Pyasik

Leonid Gorelik

Oded Sofer

Itai Gordon

Ilan D Prager

Anand Ranganathan

Josemina Marcella Magdalen

Shlomit Avrahami

Yakir Keisar

Guy Galil

Abraham Hochmann

Evgeny Chernis

Tali Finelt

Or Bar-Yaacov

Dmitry Shusterman

Boris Melamed

Gidi Weber

Shlomit Becker

Shani Turgeman

Detecting malware attacks is described herein. A computer-implemented method may include receiving, via a processor, events from a plurality of activity monitors. The method also include extracting, via the processor, a plurality of behavioral features from the received events. The method may further include detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data using a machine learning technique, wherein the private data includes private enterprise attack findings. The method may also include executing, via the processor, an ad hoc protection improvement based on the detected malware attack.

Detecting malware attacks using extracted behavioral features

Examples of techniques for generating streaming analytics applications are described herein. An example computer-implemented method includes receiving, via a processor, subject matter requirements in a semi-structured format. The method includes classifying, via the processor, the subject matter requirements based on a predefined taxonomy. The method includes extracting, via the processor, a list of entities from the subject matter requirements based on grammar. The method includes generating a solution based on a glossary and the list of extracted entities. The method includes generating, via the processor, a streaming analytics application based on the solution.

Generating streaming analytics applications using a glossary

Detecting malware attacks is described herein. A computer-implemented method may include receiving, via a processor, events from a plurality of activity monitors. The method also include extracting, via the processor, a plurality of behavioral features from the received events. The method may further include detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data. The method may also include executing, via the processor, an ad hoc protection improvement based on the detected malware attack.

Aspects include detecting that an extract transform load (ETL) job in an ETL system has been submitted for execution. The ETL job can include an input data storage location and an output data storage location. The ETL job is analyzed to predict whether execution of the ETL job will result in sensitive information being made accessible to an unauthorized user. The analyzing can be based on a sensitivity status of contents of the input data storage location and a data lineage of contents of the output data storage location. The ETL job is prevented from executing based on predicting that execution of the ETL job will result in sensitive information being made accessible to an unauthorized user. Execution of the ETL job is initiated based on predicting that execution of the ETL job will not result in sensitive information being made accessible to an unauthorized user.

Real-time data leakage prevention and reporting

Techniques for informing a user about an agreement including agreement terms and trustworthiness of data source are described herein. In some examples, a processor receives agreement document data while the data is in route to a client device. A system receives network sources and content data of the agreement document. The network sources are to be processed by the processor with traffic analytics, and the content data is to be processed with text analytics. The output of these analytics is used to generate an agreement risk event for delivery to the client device with the original agreement document data.

Real-time agreement analysis

Examples of techniques for detecting and preventing sensitive information leaks are described herein. In one example, a method for detection of sensitive information leaks comprises computing, via a processor, a set of rules that identify sensitive information, and sending, via the processor, the set of rules to a dispatcher application using a protocol. The method can also include detecting, via the processor, that at least one data block of the transmitted data matches the set of rules, and executing, via the processor, a corrective action in response to detecting that at least one of the transmitted data blocks matches the set of rules.

Detection and prevention of sensitive information leaks

Examples of techniques for detecting and preventing sensitive information leaks are described herein. In one example, a method for detection of sensitive information leaks includes computing, via a processor, a set of rules that identify sensitive information, and sending, via the processor, the set of rules to a dispatcher application using a protocol. The method can also include detecting, via the processor, that at least one data block of the transmitted data matches the set of rules, and executing, via the processor, a corrective action in response to detecting that at least one of the transmitted data blocks matches the set of rules.

Growing community of inventors

Bazra, Israel

Yifat Yulevich