International Business Machines Corporation

Yoichi Hatsutori

Futoshi Iwama

Kohichi Kamijoh

Yuichi Nakamura

Hironori Takeuchi

Hitomi Takahashi

Takuya Mishina

Naoto Sato

Fumiko Satoh

Hideo Watanabe

Takaaki Tateishi

Shin Saito

Hisashi Miyashita

A method is provided for reducing memory consumption by a rule engine. The method includes receiving attack trees, each having nodes and edges. Each node represents a security event and is associated with a detection rule for detecting an occurrence thereof. Each edge connects a respective node pair. The method includes assigning a watchpoint to each leaf node. The method includes moving the watchpoint assigned to any leaf node to a next upstream node, responsive to detecting an occurrence of the security event represented by the leaf node. The method includes erasing the watchpoint assigned to all downstream nodes relative to the next upstream node, responsive to the next upstream node being connected to a next downstream node using an edge having an 'OR' join type. Only the rules for nodes currently having the watchpoint assigned are loaded into a memory device during runtime, while excluding rules for remaining nodes.

Using attack trees to reduce memory consumption by rule engines

A system and method for estimating document structure of a document which includes extracting one or more candidate elements describing the document structure from the document and grouping the one or more candidate elements into a group and building one or more trees for the group. Each tree has a root node and a leaf node selected from the candidate elements in the group. The method further includes pruning the one or more trees while leaving a path from the root node to the leaf node, based on whether a text corresponding to the path to the leaf node is accommodated in a single group of words.

Estimation of document structure

A method for emergency communication includes encoding a message for visual display including a message to field and a message from field. The visual display is revealed to a reading device in communication with a broadcast center, which stores the visual display. The messages are decoded and sorted from visual displays at the broadcast center. On an index channel, a time and channel number for when a message body of the message will be broadcast on a message channel is broadcasted. The message body is broadcasted on the message channel.

Peer-to-peer emergency communication using public broadcasting

A computer-implemented method, a computer program product, and a computer system for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

Automatic transformation of security event detection rules

A computer-implemented method and computing device are provided for generating a formal specification of a function. The method includes extracting a set of words from requirements of the function. The method further includes translating the set of words to a set of specification fragments. The method also includes converting the set of the specification fragments to a set of production rules. The method additionally includes constructing multiple prospective specifications from the set of production rules taking into account a syntax of the formal specification. The method further includes validating each of the multiple prospective specifications using input-output examples. The method also includes generating the formal specification of the function from validated ones of the multiple prospective specifications.

Formal specification generation using examples

A computer-implemented method for transformation of security information and event management (SIEM) rules and deploying the SIEM rules in a network of event processors. A computer system or server converts the SIEM rules to formal representations. The computer system or server generates rule abstraction of the formal representations, by using an abstraction function. The computer system or server constructs a finite automaton based on the rule abstraction. The computer system or server eliminates irrelevant transitions in the finite automaton to generate an optimized finite automaton. The computer system or server generates optimized formal rules, based on the optimized finite automaton. The computer system or server converts the optimized formal rules to optimized SIEM rules. The computer or server deploys the optimized SIEM rules in the network of the event processors.

A sparse matrix used in the least-squares method is divided into small matrices in accordance with the number of elements of observation. An observation ID is assigned to each element of observation, a parameter ID is assigned to each parameter, and the IDs are associated with parameters of elements as ID mapping. A system determines positions of nonzero elements in accordance with whether or not ID mapping exists, the correspondence between observation IDs and parameter IDs, and the positions of the small matrices, and selects a storage scheme for each small matrix based thereon. The system selects a storage scheme in accordance with conditions, such as whether or not a target element is a diagonal element, whether or not a term decided without ID mapping exists, and whether or not the same ID mapping is referred to.

Growing community of inventors

Tokyo, Japan

Yoichi Hatsutori