Abstract: Embodiments herein include generating a safe copy of a first control block for an operating system, recording the safe copy in memory, initiating a test of an authorized service associated with the operating system, identifying a vulnerability for the authorized service that includes comparing a state of the first control block after the test of the authorized service with the safe copy recorded in memory, and initiating an action to alleviate the identified vulnerability.

Abstract: Identifying an intrusion (e.g., a malicious intrusion) into a computing system is a challenging problem, because there is limited data available about what an intrusion would look like while it is progress. In one embodiment, input data reflecting operation of an operating system is received and a potential security intrusion for the operating system using the input data is identified by at least one of determining, based on the input data, that a first number of privilege changes exceeds a first threshold value or determining, based on the input data, that a second number of occurrences of an event, for a first user, exceeds a second threshold. An action can be taken to alleviate the potential security intrusion.

Abstract: Cyber security testing with automated system message processing for input and result determination is disclosed, including issuing, by a test tool, a call to an authorized service; identifying, by the test tool, one or more system-level error messages generated after issuing the call; determining, by the test tool based on at least one first system-level error message, a missing input for the call to the authorized service; and reissuing, by the test tool, the call to the authorized service with the missing input.

Abstract: A computing device accesses a current workload. The computing device saves the current workload into a computer workload accessible format, the computer workload accessible format usable for replicating the current workload. Security testing may be performed using the computer workload accessible format.

Abstract: A computing system employs one or more security managers that, in response to an active session user revocation request, such as from a security administrator, to revoke a user during an active session, update an active session access revocation list that includes data representing the user. The security manager revokes active user access to protected system resources for the user based on the updated active session access revocation list, during the active session. The active session user revocation request also causes an update of a user profile in a security manager database that allows the security manager to deny authentication of the user for new sessions. The updated active session access revocation list serves as a type of centralized list with all users that have been fully revoked on the computing system. Related methods and computer products are also described.

Abstract: Embodiments of the present disclosure provide methods, systems, and computer program products for generating an input set for implementing security vulnerability testing of a software programs for authorized services. Object code of the software program is received, and the object code is disassembled to identify instructions. The instructions are analyzed to determine where specific input registers are referenced. Usage of values stored in the specific input registers when the software program is executed is determined for at least one of comparing against the values stored in the specific input registers for test or conditional branch logic, copying the values stored in the specific input registers, or referencing storage at a location defined by the values in the specific input registers. One or more arrays describing values of one or more possible or valid parameters are generated based on the usage to provide the input set.

Abstract: Detecting a security bypass through binary code analysis is disclosed, including identifying one or more binary files of an authorized program; determining, based on a static code analysis of the one or more binary files, that the authorized program includes a potential security bypass, wherein the potential security bypass includes a modification of a system control block; and generating, in response to determining that the authorized program includes a potential security bypass, a security report.

Abstract: Cyber security testing with automated system message processing for input and result determination is disclosed, including issuing, by a test tool, a call to an authorized service; identifying, by the test tool, one or more system-level error messages generated after issuing the call; determining, by the test tool based on at least one first system-level error message, a missing input for the call to the authorized service; and reissuing, by the test tool, the call to the authorized service with the missing input.

Abstract: An anonymous leaderboard for a monitored computing environments is provided. In response to an entity registering with the monitored computing environment (MCE), an encrypted identity and a dynamic non-fungible token (NFT) are generated for the registered entity, where the dynamic NFT has an associated blockchain technology data structure. The blockchain technology data structure is associated with the encrypted identity. A progress element notification is received from the MCE in response to the entity satisfying criteria for a predefined progress element associated with the MCE. In response, a static NFT, corresponding to the predefined progress element, is generated and stored as a block in the blockchain technology data structure. An entry in an anonymous leaderboard output is generated based on the blockchain technology data structure, where the entry identifies the entity by the encrypted identity.

Abstract: A computer-implemented method for generating penetration tests automatically includes parsing an existing system test case, and identifying a particular program call in the system test case. The particular program call can require a particular data access authorization. The method further includes, in response to the system test case including the particular program call, generating a penetration test using a predetermined attack vector. The method further includes executing the penetration test and detecting an unauthorized access being performed during the penetration test. Further, the method includes responsively, sending a notification that identifies the particular program call.

Abstract: A method includes receiving test objective data indicates an objective to be achieved during a cybersecurity test of a target system. An attack tree is generated by processing the test objective data into attack tree data including a plurality of data parameter sets and links between data parameter sets. Complexity of the attack tree is analyzed based on the test objective data using a combinatorics model. The attack tree is reduced to achieve the objective of the cybersecurity test based on the analyzed complexity of the attack tree.

Abstract: Methods, systems and computer program products for providing a customized display of social media content that is automatically filtered based on emotional content are provided. Aspects include receiving a plurality of social media posts that have been published for display by a social media service. Aspects also include receiving an emotional profile including social media post filtering preferences that are based on emotional content of social media posts. In response to performing an emotional content analysis of each of the plurality of social media posts, aspects include identifying a set of emotionally acceptable social media posts and a set of emotionally unacceptable social media. Aspects also include causing the set of emotionally acceptable social media posts to be displayed in a primary news feed window of the social media service in association with an account of the user of the social media service.

Abstract: Techniques for system kernel error identification and reporting for a computer system are described herein. An aspect includes detecting an error during the execution of a program. Another aspect includes determining whether the error is a system kernel error in the program. Another aspect includes, based on determining that the error is a system kernel error, generating a report regarding the determined system kernel error.

Abstract: A method includes receiving test objective data indicates an objective to be achieved during a cybersecurity test of a target system. An attack tree is generated by processing the test objective data into attack tree data including a plurality of data parameter sets and links between data parameter sets. Complexity of the attack tree is analyzed based on the test objective data using a combinatorics model. The attack tree is reduced to achieve the objective of the cybersecurity test based on the analyzed complexity of the attack tree.

Abstract: A system includes a memory system and a processing system operably coupled to the memory system. The memory system includes a plurality of address spaces. The processing system is configured to perform operations including creating a data space from within a primary address space and a primary address space number access list entry referencing the data space. An unauthorized caller routine in a home address space configured to issue a service request including an address space-switching program call from the home address space to a program call target routine in the primary address space. The address space-switching program call references the primary address space number access list entry in the primary address space. A vulnerability identifier associated with the program call target routine is created and logged based on one or more conditions indicative of a cross-memory integrity violation detected responsive to the service request.

Abstract: A system includes a memory system and a processing system operably coupled to the memory system. The processing system is configured to perform operations including setting a target register to point to a first protected storage location of the memory system resulting in a protection exception upon access, calling an authorized service, and confirming that the authorized service uses the target register based on detecting the protection exception. The target register is adjusted to point to a parameter list including one or more known values and a pointer to a second protected storage location resulting in the protection exception upon access to confirm use of a value of the parameter list responsive to calling the authorized service. Parameter list testing and target register testing is repeated for locations in the parameter list and target registers to construct a testing profile for vulnerability testing of the authorized service.

Abstract: A computer-implemented method for generating penetration tests automatically includes parsing an existing system test case, and identifying a particular program call in the system test case. The particular program call can require a particular data access authorization. The method further includes, in response to the system test case including the particular program call, generating a penetration test using a predetermined attack vector. The method further includes executing the penetration test and detecting an unauthorized access being performed during the penetration test. Further, the method includes responsively, sending a notification that identifies the particular program call.

Abstract: Methods, systems and computer program products for providing a customized display of social media content that is automatically filtered based on emotional content are provided. Aspects include receiving a plurality of social media posts that have been published for display by a social media service. Aspects also include receiving an emotional profile including social media post filtering preferences that are based on emotional content of social media posts. In response to performing an emotional content analysis of each of the plurality of social media posts, aspects include identifying a set of emotionally acceptable social media posts and a set of emotionally unacceptable social media. Aspects also include causing the set of emotionally acceptable social media posts to be displayed in a primary news feed window of the social media service in association with an account of the user of the social media service.

Abstract: A system includes a memory system and a processing system operably coupled to the memory system. The processing system is configured to perform operations including setting a target register to point to a first protected storage location of the memory system resulting in a protection exception upon access, calling an authorized service, and confirming that the authorized service uses the target register based on detecting the protection exception. The target register is adjusted to point to a parameter list including one or more known values and a pointer to a second protected storage location resulting in the protection exception upon access to confirm use of a value of the parameter list responsive to calling the authorized service. Parameter list testing and target register testing is repeated for locations in the parameter list and target registers to construct a testing profile for vulnerability testing of the authorized service.

Abstract: A system includes a memory system and a processing system operably coupled to the memory system. The memory system includes a plurality of address spaces. The processing system is configured to perform operations including creating a data space from within a primary address space and a primary address space number access list entry referencing the data space. An unauthorized caller routine in a home address space configured to issue a service request including an address space-switching program call from the home address space to a program call target routine in the primary address space. The address space-switching program call references the primary address space number access list entry in the primary address space. A vulnerability identifier associated with the program call target routine is created and logged based on one or more conditions indicative of a cross-memory integrity violation detected responsive to the service request.