Abstract: A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Abstract: A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Abstract: A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Abstract: An approach to workflow management in response to a detected security incident in a computer system. The approach may include an inference driven response based on prior artifacts. The inference driven response may predict the condition of the system and the outcomes of actions in response to the security incident. The predictions made by the inference drive response may be based on a machine learning model. The inference driven response may pause or prevent scheduled actions of the system based on the predictions. The inference driven response may continue to monitor the system and dynamically update its predictions for the condition of the system. In response to the updated predictions, the inference driven response may cancel or execute the previously scheduled actions of the system.

Abstract: A malware family identification engine constructs a graph data structure of direct relationships between malware instances and malware families, direct relationships between malware instances and detected tags, and indirect relationships between detected tags and malware families. The engine builds a dictionary data structure comprising detected tag entries linking each detected tag to one or more malware family nodes based on the graph data structure. The engine identifies significant indirect entities (SIEs) within the detected tag entries of the dictionary data structure and selects a SIE with a highest number of out-going links (OGLs) as a root node in a family tree data structure, recursively connects SIEs with a number of OGLs less than the highest number of OGLs to the root node in the family tree data structure, and converts each SIE name in the family tree data structure to a chained family entity name in the family tree data structure.

Abstract: An approach to workflow management in response to a detected security incident in a computer system. The approach may include an inference driven response based on prior artifacts. The inference driven response may predict the condition of the system and the outcomes of actions in response to the security incident. The predictions made by the inference drive response may be based on a machine learning model. The inference driven response may pause or prevent scheduled actions of the system based on the predictions. The inference driven response may continue to monitor the system and dynamically update its predictions for the condition of the system. In response to the updated predictions, the inference driven response may cancel or execute the previously scheduled actions of the system.

Abstract: Embodiments of the present invention relate to a method, system and computer program product for compacting data in a distributed storage system. According to the method, a query request is received from a client, wherein the query request comprises information of a previous query request of the client. A first query result of the query request and a second query result of the previous query request are retrieved. A delta data and a first indicator are sent to the client in response to the first query result being different from the second query result, wherein the delta data is the data of the first query result excluding the data comprised in both first and second query results, and the first indicator indicates the data comprised in both the first and the second query results.

Abstract: Embodiments of the present invention relate to a method, system and computer program product for compacting data in a distributed storage system. According to the method, a query request is received from a client, wherein the query request comprises information of a previous query request of the client. A first query result of the query request and a second query result of the previous query request are retrieved. A delta data and a first indicator are sent to the client in response to the first query result being different from the second query result, wherein the delta data is the data of the first query result excluding the data comprised in both first and second query results, and the first indicator indicates the data comprised in both the first and the second query results.

Abstract: Administering reward schemes. A first reward scheme is predefined by a computer system, the first reward scheme defining a first reward event. A second reward scheme is obtained externally by the computer system, the second reward scheme defining a second reward event. In response to an action by a user, the computer system determines whether the first reward event or the second reward event has been triggered. If the first reward event has been triggered, the computer system calculates a first reward for the user according the first reward scheme and if the second reward event has been triggered, the computer system calculates a second reward for the user according the second reward scheme. The second reward scheme may be obtained by, and shared to, the computer system as an inheritance of rules within an organization.

Abstract: Administering reward schemes. A first reward scheme is predefined by a computer system, the first reward scheme defining a first reward event. A second reward scheme is obtained externally by the computer system, the second reward scheme defining a second reward event. In response to an action by a user, the computer system determines whether the first reward event or the second reward event has been triggered. If the first reward event has been triggered, the computer system calculates a first reward for the user according the first reward scheme and if the second reward event has been triggered, the computer system calculates a second reward for the user according the second reward scheme. The second reward scheme may be obtained by, and shared to, the computer system as an inheritance of rules within an organization.

Abstract: Aspects are related to automatically determining game mechanics in business process gamification. Execution data of prior users of a first task in a business process is accessed in a history database. The execution data of the prior users of the first task is analyzed. The game mechanics for the first task is determined according to a result of the analyzing.

Abstract: A method and system of teaming via a social network service for activity coaching include creating a stage model that comprises a first and second stages, wherein a value of a performing parameter for use in the first stage is less than a value of the performing parameter for use in the second stage; receiving initial activity data of users at social network service; determining users involved in the first stage according to initial activity data; teaming the users involved in the first stage; communicating to users via social network service the value of the performing parameter for use in the second stage; setting a team goal to achieve the value; waiting for feedback from the users; determining whether the team goal is achieved; moving the users in the same team to the second stage; and providing rewards to the users, if the determination is affirmative.