International Business Machines Corporation

Sony Corporation

Elpida Memory, Inc.

Globalfoundries Inc.

Akebono Brake Industry Co., Ltd.

Nihon Tokushu Toryo Co., Ltd.

Hitachi, Ltd.

Mazda Motor Corporation

Asahi Glass Company, Limited

Japan Aviation Electronics Industry, Limited

Covestro Deutschland Ag

Nkk Corporation

Ps4 Luxco S.a.r.l.

Union Tool Company

Kabushiki Kaisha Toshiba

Yuji Watanabe

Masayuki Numao

Hirokuni Kitahara

Kugamoorthy Gajananan

Fumiko Akiyama

Takaaki Tateishi

Ruriko Kudo

Hisashi Tanie

Takuya Mishina

Madoka Yuriyama

Miki Ishikawa

Ai Ishida

Mitsuaki Katagiri

Ichiro Anjo

Koji Hosokawa

Satoshi Shimada

Akira Koseki

Toshiro Takase

Toru Nagano

Yuta Tsuboi

Takahide Nogayama

Yoshinobu Ishigaki

Ai Yoshino

Scott Ross Trent

Hiroaki Ikeda

Yasuyuki Suzuki

Hiroyuki Ohta

Akira Sato

Fumio Watanabe

Hideto Shimazu

Hiroshi Mochikawa

Akira Sakai

Naohiko Uramoto

Osamu Imaki

Miki M Enoki

Takeo Yoshizawa

Giichi Matsuo

Susumu Okawa

Masayoshi Kojima

Nae Hisano

Minoru Sekine

Shinya Naoi

Koji Okushima

Yoshinori Aoki

Yasuhiro Noro

Yasuyuki Miyazaki

Alisa Arno

Pablo Salvador Loyola Heufemann

Raymond H P Rudy

Masayoshi Mizutani

Pablo Loyola

Soichi Aoyama

Eiichi Kawase

Toshio Watanabe

Masanori Takasaki

Toshiaki Asano

Keita Hirose

Shinji Nishikawa

Yasuyuki Endoh

Shinichiro Sado

Shuntaro Suzuki

Nobuyuki Iwatate

Naozumi Kawanishi

Chiharu Watanabe

Hiroyuki Hayashi

Yuki Sugawara

Takuro Arai

Hiroaki Ido

Takanori Yumoto

Kazuki Murata

Asako Shinoka

Saeko Kinami

Hirofumi Takeuchi

Shinsuke Kataoka

Mitsuhito Ino

Toshinao Fujita

Takahiro Shimoo

Naruo Den

Hidenori Anai

Hideyuki Miyaji

Nobuyoshi Hamura

Shinji Yurino

Bunnosuke Ushioda

Takeo Yumoto

Yoshinori Watanabe

Tetsutaro Ohori

Kazutaka Sato

Koji Suwa

Takashi Yoneuchi

Masayuji Numao

A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple initially mutable containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method also includes designating, by the hardware processor, a particular external command, from among external container commands stored in a database, as having a correspondence to an initial process, responsive to the initial process matching at least one respective process resulting from executing the particular external command.

Correspondence of external operations to containers and mutation events

Methods and systems for verifying a resource definition include simulating an original resource definition to identify at least one change that is made to the original resource definition by a management service. A signature of a received resource definition is generated, omitting portions of the received resource definition that correspond to the at least one identified change. The signature of the received resource definition is compared to a signature of the original resource definition to find a match and to verify the received resource definition. The received resource definition is implemented, responsive to finding the match.

Cluster resource signature verification

A system for controlling access to cluster resources is provided. The system includes one or more processors; and memory operatively coupled to the one or more processors, wherein the one or more processors and the memory form a cluster of computer resources that includes an admission controller configured to receive requests and determine if the request is authorized, a request history database that stores the request information received by the admission controller from a plurality of users, a role design advisor that is configured to adjust permissions for the plurality of users based on a pattern of usage identified from the request history database, and an alert system that communicates an alert to an administrator that a request outside the pattern of requests for the user has been received by the admission controller, wherein the admission controller, request history database, and role design advisor control access to the cluster resources.

Role design advisor

A computer-implemented method for assessing latent security risks in Kubernetes clusters is provided including selecting a service account from a plurality of service accounts defined in namespaces of a cluster, binding a role to the selected service account based on predetermined role-binding data, and determining if the role meets at least one of a first, second, and third conditions based on predetermined role data defining permitted operations for roles, the first condition being that the role can receive secret tokens for pods within a namespace of the namespaces, the second condition being that the role can perform execution operation to other pods, and the third condition being that the role can create DaemonSet, Deployment, StatefulSet, and additional pods on the namespace.

Assessing latent security risks in Kubernetes cluster

Provided is a material having an excellent sound-absorbing performance which can be easily applied to the desired area at the operation site and which can effectively prevent sound leakage. The material includes an open-cell soft polyurethane foam prepared from a 2-part reactive urethane resin composition prepared from a polyisocyanate component and a polyol-containing component,

2-part reactive urethane resin composition and method for producing thereof

Guided character string alteration can be performed by obtaining an original character string and a plurality of altered character strings, traversing the original character string with a first Long Short Term Memory (LSTM) network to generate, for each character of the original character string, a hidden state of a partial original character string up to that character, and applying, during the traversing, an alteration learning process to each hidden state of a partial original character string to produce an alteration function for relating partial original character strings to partial altered character strings.

Guided character string alteration

A method is provided for determining command-to-process correspondence. The method includes identifying, by the hardware processor, initial processes resulting from executions of container immutability change events for each of multiple containers in a cluster, based on an execution time, a process identifier and a process group identifier for each of the container immutability change events. The method further includes checking, by the hardware processor, if an initial process from among the identified initial processes matches an entry in a database that stores external container commands and at least one respective process resulting from executing each of the external container commands. The method also includes designating, by the hardware processor, a particular external command, from among the external container commands stored in the database, as having a correspondence to the initial process, responsive to the initial process matching the at least one respective process resulting from executing the particular external command.

One or more computer processors collect logs containing one or more admission requests associated with a new application installation in an empty namespace, wherein the empty namespace is a sandbox representative of a production environment. The one or more computer processors classify the one or more admission requests according to a set of conditions indicating respective levels of trust. The one or more computer processors create a set of candidates for signing containing admissions requests that are classified unsigned. The one or more computer processors generate a security policy for each candidate for signing in the set of candidates for signing.

Clustered application policy generation

A computer-implemented method is provided for identifying words likely to be used in new combo-squatted domains of a target domain. The method includes selecting the target domain. The method further includes storing, in a memory device, a sequence of previously detected combo-squatted domains from period [t-W, t-1]. The sequence includes a set of words W. The method also includes obtaining trends associated with the target domain at time t. The method additionally includes obtaining, by a hardware processor responsive to the trends, a trend distribution associated with the target domain at time t. The method further includes ranking, by a likelihood, a set of words E that have been extracted from the trend distribution and are expected to be used in the future in the new combo-squatting domains, responsive to the set of words W.

Trend-aware combo-squatting detection

A method for checking an integrity of an object to be deployed to a cluster is provided. The method detects a resource creation request. The method, responsive to the request being an initial resource creation request for the object, verifies the integrity of the object based on properties in the request to create a release secret in the cluster for a positive integrity verification result for the object. The release secret represents a specific deployment configuration of the object on the cluster. The method, responsive to the request being other than the initial resource request, checks if the request corresponds to the specific deployment configuration of the object by checking against the release secret in the cluster. The method, responsive to the request corresponding to a deployment of the object and the release secret being present in the cluster, creates a resource requested by the request in the cluster.

Preventing unauthorized package deployment in clusters

A computer-implemented method for linking combo-squatting domains is provided. The method includes grouping domain names into nameserver groups based on a nameserver for each of the domains. Each of the domain names contain valued words. The method also includes splitting words in each domain name and generating a wordlist for each of the nameserver groups. The method further includes finding feature words among the nameserver groups, and extracting malicious domain names which contain the feature words in each of the nameserver groups. The method further includes outputting, for each of the nameserver groups, the malicious domain names and corresponding registrant identifying data based on the feature words.

Combo-squatting domain linkage

Methods and systems for detecting mutation events include collecting change event pattern counts from one or more processing nodes. Unintended change events are identified based on the collected change event pattern counts. A corrective action is performed for the unintended change events.

Tracking cluster image mutation events

A method includes, for a first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server, determining that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being associated with a second user ID, and sending a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application.

Privacy-aware ID gateway

A computer-implemented method includes generating one or more process trees based on one or more processes associated with one or more change events within a cluster computing system, performing mutation event detection by comparing a root of each of the one or more process trees with one or more external commands, and generating a mutation event report based on the comparison.

Mutation event detection for integrity monitoring

At least one processor device is configured to receive a first authentication request for authenticating a first user, the first user having been authenticated on a first application with a first user identification (ID) using a first ID federation between the first application and a federation server, determine that the first user is authorized to access information of a second user on a second application based on the first user ID, the second user being associated with a second user ID, and send a second authentication request for authenticating the first user to the second application with the second user ID using a second ID federation between the federation server and the second application.

Growing community of inventors

Tokyo, Japan

Yuji Watanabe