Abstract: A method, computer program product, and computer system are provided for user access group discovery. The method includes: generating a matrix that depicts the respective resources of a set of resources accessed by each of a plurality of users; obtaining, for each user, a similarity measurement using the matrix, wherein the similarity measurement is based on a comparison of the resources accessed by the user to the resources accessed by the other users; generating, for each user, a feature vector for clustering the users into user access groups, wherein the feature vector represents the resources accessed by the user; applying the feature vectors and the similarity measurements to a centroid-based clustering algorithm to obtain the user access groups; and outputting the user access groups for application in a security environment.

Abstract: Embodiments of the present disclosure provide methods, systems, and computer program products for analyzing and matching similarity of operating system memory dumps to assign a developer for a given error event causing a computing failure. A disclosed embodiment includes generating trace information of the memory dump to identify an instruction causing the system failure and a memory location of the instruction; extracting a plurality of machine code instructions preceding the instruction causing the system failure based on the memory location, and removing a data part and not operations of the instructions being executed, from the plurality of machine code instructions. In addition, a list of operations of the machine code instructions is generated and compared to a plurality of reference memory dumps to identify similarity values of the plurality of reference memory dumps to the memory dump.

Abstract: Disclosed is a method, system, and computer program product for preserving actions taken after a snapshot. One embodiment of the method may comprise capturing a snapshot of a virtualized container environment (VCE), the VCE comprising one or more applications-of-interest. The method may further comprise intercepting an event-of-interest directed to an application-of-interest within the VCE. The method may further comprise automatically storing the intercepted event in an action database. The method may further comprise, in response to a user instruction to revert the VCE to a prior snapshot, generating an automated script from the intercepted events, wherein the automated script comprises actions that occurred in the VCE after capture of the selected snapshot; and executing the automated script.

Abstract: Disclosed is a method, system, and computer program product for preserving actions taken after a snapshot. One embodiment of the method may comprise capturing a snapshot of a virtualized container environment (VCE), the VCE comprising one or more applications-of-interest. The method may further comprise intercepting an event-of-interest directed to an application-of-interest within the VCE. The method may further comprise automatically storing the intercepted event in an action database. The method may further comprise, in response to a user instruction to revert the VCE to a prior snapshot, generating an automated script from the intercepted events, wherein the automated script comprises actions that occurred in the VCE after capture of the selected snapshot; and executing the automated script.

Abstract: Disclosed is a method, system, and computer program product for automatically managing snapshots of applications of interest in virtualized container environment (VCE). The method may comprise intercepting an action-of-interest directed to an application-of-interest within a VCE. The method may further comprise automatically capturing a snapshot of the VCE before executing the intercepted action-of-interest. The method may further comprise executing the intercepted action-of-interest. The method may further comprise automatically deleting the snapshot after a predetermined time period following the intercepted action.

Abstract: A method, computer program product, and computer system are provided for user access group discovery. The method includes: generating a matrix that depicts the respective resources of a set of resources accessed by each of a plurality of users; obtaining, for each user, a similarity measurement using the matrix, wherein the similarity measurement is based on a comparison of the resources accessed by the user to the resources accessed by the other users; generating, for each user, a feature vector for clustering the users into user access groups, wherein the feature vector represents the resources accessed by the user; applying the feature vectors and the similarity measurements to a centroid-based clustering algorithm to obtain the user access groups; and outputting the user access groups for application in a security environment.

Abstract: A system modeling meta-model language model for a system is extracted from a natural language specification of the system. Syntactic structure is extracted from the specification of a system. The syntactic structure represents a set of at least one syntactic subject. A first mapping is created between a predetermined set of the at least one syntactic subject and respective meta-model elements for a system modeling meta-model language. At least one of the meta-model elements is constructed in accordance with the mapping for each identified syntactic subject. The created meta-model structural elements are created for conversion into a model of the system.

Abstract: An event processing system in which a computer receives an input event comprising one or more factors. The computer evaluates the factors of the input event based on an event processing rule containing a pattern detection operator and a conditional probability operator. The conditional probability operator can operate to calculate a conditional probability for a set of training data that a specified pattern will appear in the factors of an input event given a specified output event, and can further operate to assign a conditional rule value a binary value based on how the conditional probability compares to a target probability.

Abstract: A system modeling meta-model language model for a system is extracted from a natural language specification of the system. Syntactic structure is extracted from the specification of a system. The syntactic structure represents a set of at least one syntactic subject. A first mapping is created between a predetermined set of the at least one syntactic subject and respective meta-model elements for a system modeling meta-model language. At least one of the meta-model elements is constructed in accordance with the mapping for each identified syntactic subject. The created meta-model structural elements are created for conversion into a model of the system.