Abstract: An example operation may include one or more of receiving a set of structured query language (SQL) queries from one or more software applications, generating a set of SQL syntax trees that correspond to the set of SQL queries, identifying a unique subset of SQL syntax trees among the generated set of SQL syntax trees based on previously obtained SQL syntax trees, and transmitting the unique subset of SQL syntax trees to a computing system.

Abstract: Disclosed is a method of customizing an appliance. The method includes steps of pre-storing a public key in the appliance; connecting the appliance to an external storage device; and booting up the appliance to automatically proceed with the following customization process: obtaining a customization file from the external storage device; authenticating the customization file with the public key; and executing customization with the customization file if the authentication succeeds.

Abstract: A Man in the Middle (MitM) computer receives a first session identifier from a client for a first communication session between the client and a server, and monitors Transport Layer Security (TLS) communication sessions between the client and the server, where the first session identifier is one of an unknown session identifier and an invalid session identifier. In response to receiving the first session identifier from the client, the MitM computer performs one of: requesting a second session identifier from the server for a second communication session if the first session identifier is an unknown session identifier; and transmitting, to the client, an instruction to flush a session cache in the client, where flushing the session cache in the client forces the client and the server to establish a full TLS handshake in order to obtain a session key if the first session identifier is an invalid session identifier.

Abstract: Embodiments provide a system and method for network tracking. Through various methods of packet encapsulation or IP option filling, one or more packets of information can be tagged with a unique security tag to prevent unauthorized access. A user agent can be validated by an authentication server through acceptance of one or more user credentials. The authentication server can generate a security token that can be transmitted to the user agent. The user agent can generate a keystream from the security token, and portions of that keystream can be attached to the packets as the security tag. The tagged packets can be forwarded to an authenticator, who can recreate the keystream from a copy of the security token provided by the authentication server. If the tags generated from the authenticator match the tags on the tagged packet, the authenticator can strip the tag from the tagged packet and forward the packet on to its next network address.

Abstract: Embodiments pertain to facilitation of live migration of a virtual machine in a network system. During live migration, a first appliance is cloned and state information directed to a first network flow is obtained. The state information is utilized by the cloned appliance to re-direct operations associated with the first network flow. At such time as the first network flow is terminated, the cloned is removed.

Abstract: A method, system and computer-usable medium are disclosed for obtaining domain name system (DNS) monitoring data. A DNS data collector that can be either part of a local network or part of an external network is implemented. The DNS data collector receives and collects logs from DNS transactions collected from various sources that include DNS resolvers, DNS servers, and DNS aggregator, which can be part of a local network or can be part of an external network. The DNS data collector determines if the DNS logs are missing any data related to the DNS transactions. The missing DNS data is looked up and the DNS logs are completed. Completed DNS logs can then be sent for analysis, such as for DNS traffic threats.

Abstract: Embodiments provide a computer implemented method in a data processing comprising a processor and a memory including instructions, which are executed by the processor to cause the processor to implement the method of terminating a connection between a database server and a database client through an enforcement point, the method including: continuously monitoring, by the enforcement point, information related to a connection to a database, and parsing one or more queries; continuously comparing, by the enforcement point, the information with a predefined plurality of rules, and checking whether there is a rule violation; if there is a rule violation, assembling, by the enforcement point, a termination packet including an error message indicative of the rule violation; sending, by the enforcement point, the termination packet to the database client; and terminating, by the enforcement point, a connection between the enforcement point and the database client.

Abstract: A graphical indicator comprising a plurality of first header blocks, a plurality of second header blocks and a plurality of data blocks for forming an indicator matrix is provided. Each of the first and second header blocks has a header graphical micro-unit, and each of the data blocks has a data graphical micro-unit. An array area is formed by the second header blocks and the data blocks. A first virtual line and a second virtual line are respectively formed by virtual centers of the first and second header blocks, and an included angle between the first and second virtual lines is less than 90 degrees.

Abstract: A method, computer system, and a computer program product for verification and authentication in a microservice framework is provided. The present invention may include configuring a container within a microservice framework. The present invention may also include receiving a generated salt file. The present invention may then include injecting the salt file into the container. The present invention may further include hashing the container image and the salt file.

Abstract: A technique for network attack tainting and tracking includes monitoring data packets received from a network for a malicious request. Responsive to detecting a malicious request, a forensic token is created having information pertaining to the malicious request that is configured to be stored by a source of the malicious request and discoverable regarding involvement of the source in the malicious request. The forensic token is injected into a response message, and the response message is then transmitted to the source of the request as a response to the request.

Abstract: Embodiments provide a system and method for stateless session synchronization between inspectors for high availability deployments. Man in the Middle inspectors of a communication session between a client and server exchange a shared key that is used as a common seed value in a mapping function algorithm. Each inspector generates identical key-pairs using the common mapping function algorithm, and the inspectors generate the session keys from the key-pairs. Inspectors use the session keys to decrypt and either actively or passively inspect data transferred in a session between a client and server.

Abstract: Methods and systems for high-availability data processing include detecting, at a first data processing system, a change in link state between the first data processing system and a second data processing system. A link state between the first data processing system and a third data processing system is changed responsive to the detection in accordance with a first high availability policy stored at the first data processing system. An identifier of the first data processing system is changed in accordance with the first high availability policy to conform to a second high availability policy stored at the first data processing system. The detection, change of the link state, and change of the identifier are repeated in accordance with the second high availability policy.

Abstract: A method and system are provided that, in turn, provide a secure policy audit in a shared enforcement environment. The method includes providing an auditing component in a software defined network. The method further includes receiving, by the auditing component, a first auditing event from a first component in the software defined network and a related auditing event from a second component in the software defined network. The method also includes analyzing, by the auditing component, the first auditing event and the related auditing event against an enforcement of an access policy criteria for the software defined network. The access policy criteria requires auditing events from at least two enforcement points in the software defined network. The first and second component form the at least two enforcement points. The method additionally includes determining, by the auditing component, one of a compliance and a non-compliance with the access policy criteria.

Abstract: A technique for network attack tainting and tracking includes monitoring data packets received from a network for a malicious request. Responsive to detecting a malicious request, a payload is created that is digitally signed. The digitally signed payload is encrypted and injected into a response message, and the response message is then transmitted to a source of the request as a response to the request.

Abstract: A graphical indicator comprising a plurality of first header blocks, a plurality of second header blocks and a plurality of data blocks for forming an indicator matrix is provided. Each of the first and second header blocks has a header graphical micro-unit, and each of the data blocks has a data graphical micro-unit. An array area is formed by the second header blocks and the data blocks. A first virtual line and a second virtual line are respectively formed by virtual centers of the first and second header blocks, and an included angle between the first and second virtual lines is less than 90 degrees.

Abstract: “Multi-tenant awareness” is added to a set of one or more packet processing devices in a Software Defined Network (SDN) having a controller. For each of one or more tenants, information in a table associates network protocol address attributes with an Internet Protocol (IP) address unique to the tenant. The table is associated with a multiple-layer translation layer being managed by the SDN controller. As a data packet traverses the translation layer, network protocol address attributes are translated according to values in the table to enable logical routing of the packet (to a given PPD. This translation occurs dynamically (or “on-the-fly”) as packets are “on route” to their destination. By implementing a multi-layer network address translation (NAT), one layer may be used to translate network protocol address source attributes, while a second layer may be used to translate network protocol address destination attributes.

Abstract: Embodiments are directed to a method of monitoring a suspicious file, including: receiving, from a web server, a first file; encrypting, by an intermediary network device, the first file; transferring the encrypted file, from the intermediary network device, to an end device; transferring the first file, from the intermediary network device, to a malware analysis device for a malware analysis; and receiving a malware analysis result, from the malware analysis device. If the malware analysis result indicates the first file is not a malware, requesting a key; decrypting the encrypted file using the key; and accessing the decrypted file.

Abstract: Embodiments can provide a computer implemented method in a data processing system comprising a processor and a memory comprising instructions, which are executed by the processor to cause the processor to implement a system for network protection, the method comprising determining, by the processor, if an incoming connection comprising one or more packets has a false latency larger than a trigger latency; determining, by the processor, if an attack is currently in progress; and if the attack is in progress, injecting, by the processor, at least one of the one or more packets of the incoming connection or one or more packets of an outgoing connection with a false latency.

Abstract: Embodiments provide a system and method for stateless session synchronization between inspectors for high availability deployments. Man in the Middle inspectors of a communication session between a client and server exchange a shared key that is used as a common seed value in a mapping function algorithm. Each inspector generates identical key-pairs using the common mapping function algorithm, and the inspectors generate the session keys from the key-pairs. Inspectors use the session keys to decrypt and either actively or passively inspect data transferred in a session between a client and server.

Abstract: A method for reading a graphical indicator is provided. The method includes the following steps. An indicator image including a plurality of graphical micro-units is obtained. According to a portion of the graphical micro-units, a first header part and a first content data part belonging to a first image indicator are obtained. According to another portion of the graphical micro-units, a second header part and a second content data part belonging to a second image indicator are obtained. The graphical micro-units of the first content data part are further used to obtain the indicator data. When a portion of the graphical micro-units in the first content data part is lost, the complete graphical micro-units can be obtained by recovering the lost graphical micro-units of the first content data part according to the graphical micro-units belonging to the first and the second content data parts captured in the indicator image.