Patents by Inventor Thomas M. Roelofs

Thomas M. Roelofs has filed for patents to protect the following inventions. This listing includes patent applications that are pending as well as patents that have already been granted by the United States Patent and Trademark Office (USPTO).

  • Composing and applying security monitoring rules to a target environment
    Patent number: 11245716
    Abstract: In an aspect of the invention, the method includes one or more processors identifying events in the target environment that are associated with an indication of a security attack on the target environment. The method further includes composing rules based on the events and relating to an entity identifier that is fixed over a period of time in relation to an entity in the target environment. The method further includes weighting the rules according to a probability that the rule positively identifies a security attack. The method further correlating outputs of multiple activated rules relating to an entity identifier that are activated over time in response to events occurring in the target environment. The method further includes aggregating weightings from the multiple activated rules. The method further includes determining a score for an entity relating to the entity identifier based on the aggregated weightings.
    Type: Grant
    Filed: May 9, 2019
    Date of Patent: February 8, 2022
    Assignee: International Business Machines Corporation
    Inventors: Thomas M. Roelofs, Codur S. Pranam
  • COMPOSING AND APPLYING SECURITY MONITORING RULES TO A TARGET ENVIRONMENT
    Publication number: 20200358803
    Abstract: In an aspect of the invention, the method includes one or more processors identifying events in the target environment that are associated with an indication of a security attack on the target environment. The method further includes composing rules based on the events and relating to an entity identifier that is fixed over a period of time in relation to an entity in the target environment. The method further includes weighting the rules according to a probability that the rule positively identifies a security attack. The method further correlating outputs of multiple activated rules relating to an entity identifier that are activated over time in response to events occurring in the target environment. The method further includes aggregating weightings from the multiple activated rules. The method further includes determining a score for an entity relating to the entity identifier based on the aggregated weightings.
    Type: Application
    Filed: May 9, 2019
    Publication date: November 12, 2020
    Inventors: Thomas M. Roelofs, Codur S. Pranam