International Business Machines Corporation

Zohar Basil

Shmuel Regev

Ron Peleg

Alexandra Shulman-Peleg

Shahar Kohanim

Amit Klein

Shmulik Regev

Shahar T Kohanim

A security manager configured to generate a plurality of learned security policies and provide at least one learned security policy and a security agent to a client machine for enforcement of the at least one learned security policy by the security agent on the client machine. The security manager configured to receive alerts from the security agent indicating anomalous behavior on the client machine.

Intrusion detection and mitigation in data processing

Detecting heap spraying on a computer by determining that values of characteristics of a plurality of requests to allocate portions of heap memory are consistent with benchmark values of the characteristics, wherein the benchmark values of the characteristics are associated with heap spraying; and performing a computer-security-related remediation action responsive to determining that the values of the characteristics are consistent with the benchmark values of the characteristics.

Detecting heap spraying on a computer

Detecting heap spraying on a computer by detecting a plurality of requests to allocate portions of heap memory, measuring the plurality of requests to determine a value of a characteristic of the plurality of requests, identifying an activity consistent with heap spraying by determining that the value of the characteristic is consistent with a benchmark value of the characteristic, wherein the benchmark value of the characteristic is associated with heap spraying, and performing a computer-security-related remediation action responsive to determining that the value of the characteristic is consistent with the benchmark value of the characteristic.

Detecting remote operation of a computer by another computer by receiving pointing device movement event information associated with multiple pointing device movement events in a sequence of pointing device movement events detected at a first computer, determining a frequency of the pointing device movement events from the pointing device movement event information, and determining that the frequency is consistent with a frequency of pointing device movement events that are sent to the first computer, thereby detecting that the first computer is operated by a computer other than the first computer.

Growing community of inventors

Rehovot, Israel

Zohar Basil