Abstract:
A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.
Abstract:
A method, a computing device, and a non-transitory machine-readable medium for detecting malware attacks. In one example, an agent implemented in an operating system detects an overwrite in which an original data component is overwritten with a new data component. The agent computes a plurality of features associated with the overwrite, the plurality of features including an original entropy corresponding to the original data component, a new entropy corresponding to the new data component, an overwrite fraction, and a set of divergence features. The agent determines whether the new data component is encrypted using the plurality of features.
Abstract:
A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.
Abstract:
A system, method, and machine-readable storage medium for resolving a candidate community are provided. In some embodiments, a method includes obtaining a candidate community and a neighbor set for the candidate community, the neighbor set including zero or more stable communities. The method also includes resolving the candidate community as being a new stable community if the neighbor set is empty. The method further includes resolving the candidate community as being part of a matching stable community if a hash value of the candidate community matches a hash value of one or more stable communities included in the neighbor set. The method also includes resolving the candidate community as being a new stable community if an entropy value is greater than a threshold, the entropy value being based on the candidate community and the neighbor set.
Abstract:
A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.
Abstract:
A system, method, and machine-readable storage medium for detecting an anomaly are provided. In some embodiments, the method includes computing an access rate of a set of entities for each user of a plurality of users. The access rate may refer to data operations for the set of entities stored by a storage system. The method also includes normalizing the access rates for a subset of the plurality of users, the subset belonging to a community. The method further includes determining whether a normalized access rate from among the access rates satisfies a threshold. The method also includes detecting an anomaly in response to a determination that the normalized access rate satisfies the threshold.
Abstract:
Methods and apparatuses for performing selective deduplication in a storage system are introduced here. Techniques are provided for determining a probability of deduplication for a data object based on a characteristic of the data object and performing a deduplication operation on the data object in the storage system prior to the data object being stored in persistent storage of the storage system if the probability of deduplication for the data object has a specified relationship to a specified threshold.
Abstract:
A system, method, and machine-readable storage medium for forming a community based on a common set of attributes are provided. In some embodiments, the method includes creating a list of entities associated with a plurality of users, each entity included in the list of entities being accessed by a user of the plurality of users. The method also includes identifying a first entity accessed by a group of users of the plurality of users. The method further includes determining a first set of entities accessed by each user of the group of users, the first set of entities being included in the list of entities. The method also includes removing the first entity and the first set of entities from the list of entities. The method further includes forming a first community including the group of users, the first entity, and the first set of entities.
Abstract:
A method and system for a provisioning advisor are described which estimates the input/output operation performance of a workload on a storage system. A regression module in a provisioning advisor estimates a maximum IOPS on the storage system for buckets, or combinations of values, for various characteristics of the workloads running on the system by modeling a relationship between the workload characteristics and performance metrics gathered from the storage system. A performance module can use the estimated maximum IOPS for each bucket to update a set of working tables for the provisioning advisor, which can then be used to predict the input/output performance of a new workload to be provisioned on the storage system.
Abstract:
Systems and methods disclosed herein provide intelligent filtering of system log messages having low utility value. In providing the filtering, the systems and methods determine the utility value of a system log message and delete the message from the system log if the message is determined to be of low utility value. As such, embodiments herein provide an system log filter, which reduces the amount of data stored in the system log based on the utility value of the message.