RAPID RANSOMWARE DETECTION AND RECOVERY
    1.
    发明公开

    公开(公告)号:US20240354411A1

    公开(公告)日:2024-10-24

    申请号:US18335130

    申请日:2023-06-15

    Applicant: VMware, Inc.

    Abstract: Solutions for rapid ransomware detection and recovery include: receiving a first set of in-memory changed data blocks; identifying, within the first set of in-memory changed data blocks, a second set of in-memory changed data blocks addressed for storage within a file index for a virtual machine (VM) disk; determining, relative to a change history of the file index, an anomalous condition; based on at least determining the anomalous condition, identifying a third set of blocks within the file index that are changed between two versions of the VM disk; determining that changes in the third set of blocks indicate ransomware; and based on at least determining that changes in the third set of blocks indicate ransomware, generating an alert. Machine learning (ML) models may perform anomaly/ransomware detection. Remediation activities may include disk restoration storing the VM memory.

    INPUT/OUTPUT (I/O) QUIESCING FOR SEQUENTIAL ORDERING OF OPERATIONS IN A WRITE-AHEAD-LOG (WAL)-BASED STORAGE SYSTEM

    公开(公告)号:US20230010516A1

    公开(公告)日:2023-01-12

    申请号:US17368254

    申请日:2021-07-06

    Applicant: VMware, Inc.

    Abstract: A method for of input/output (I/O) quiescing in a write-ahead-log (WAL)-based storage system comprising a WAL, is provided. The method generally includes receiving a request to process a control operation for the storage system, determining whether a memory buffer includes payload data for one or more write requests previously received for the storage system and added to the WAL, forcing a flush of the payload data in the memory buffer to a persistent layer of the storage system when the memory buffer includes the payload data, and processing the control operation subsequent to completing the asynchronous flush, without waiting for processing of one or more other write requests in the WAL corresponding to payload data that was not added to the memory buffer prior to receiving the request to process the control operation.

    UPDATING STORED CONTENT IN AN ARCHITECTURE UTILIZING A MIDDLE MAP BETWEEN LOGICAL AND PHYSICAL BLOCK ADDRESSES

    公开(公告)号:US20220342575A1

    公开(公告)日:2022-10-27

    申请号:US17238984

    申请日:2021-04-23

    Applicant: VMware, Inc.

    Abstract: A method for updating block addresses is provided. The method includes overwriting content of a first data block referenced by a first logical block address (LBA) with updated content. Prior to overwriting, the content of the first data block is stored in a first physical block corresponding to a first physical block address (PBA), a logical map maps the first LBA to a first middle block address (MBA), and a middle map maps the first MBA to the first PBA. After overwriting, the updated content of the first data block is stored in a second physical block corresponding to a second PBA and, in response to the overwriting, the middle map is updated to map the first MBA to the second PBA instead of the first PBA.

    SYNCHRONIZING A STALE COMPONENT OF A DISTRIBUTED OBJECT USING A DELTA COMPONENT DURING MAINTENANCE

    公开(公告)号:US20210357122A1

    公开(公告)日:2021-11-18

    申请号:US16875624

    申请日:2020-05-15

    Applicant: VMware, Inc.

    Abstract: The disclosure herein describes enhancing data durability of a base component using a delta component. A delta component is generated based on the base component becoming unavailable. The delta component is configured to include unwritten storage space with an address space matching the base component and a tracking bitmap associated with data blocks of the address space of the delta component. Write operations targeted for the base component are routed to the delta component. Based on the routed write operations, bits associated with data blocks affected by the write operations are changed in the tracking bitmap. Based on the base component becoming available, data blocks affected by routed write operations are identified based on the tracking bitmap and the identified data blocks are synchronized from the delta component to the base component. The delta component is then removed.

    WORKLOAD ESTIMATION OF DATA RESYNCHRONIZATION

    公开(公告)号:US20200019440A1

    公开(公告)日:2020-01-16

    申请号:US16584244

    申请日:2019-09-26

    Applicant: VMware, Inc.

    Abstract: Embodiments include estimating a workload of a re-synchronization task for a data component in a logical storage system. Embodiments include detecting a connection from the data component, wherein the data component was previously disconnected. Embodiments further include determining a layout of the logical storage system. Embodiments further include estimating the workload of the re-synchronization task based on the layout. One or more actions may be performed based on the estimate.

    DEDUPLICATING DATA CHUNKS USING CHUNK OBJECTS

    公开(公告)号:US20240419583A1

    公开(公告)日:2024-12-19

    申请号:US18333986

    申请日:2023-06-13

    Applicant: VMware, Inc.

    Abstract: The disclosure herein describes deduplicating data chunks using chunk objects. A batch of data chunks is obtained from an original data object and a hash value is calculated for each data chunk. A first duplicate data chunk is identified using the hash value and a hash map. A chunk logical block address (LBA) of a chunk object is assigned to the duplicate data chunk. Payload data of the duplicate data chunk is migrated from the original data object to the chunk object, and a chunk map is updated to map the chunk LBA to a physical sector address (PSA) of the migrated payload data on the chunk object. A hash entry is updated to map to the chunk object and the chunk LBA. An address map of the original data object is updated to map an LBA of the duplicate data chunk to the chunk object and the chunk LBA.

    MODIFIED COPY-ON-WRITE SNAPSHOTTING
    8.
    发明公开

    公开(公告)号:US20230333766A1

    公开(公告)日:2023-10-19

    申请号:US17724456

    申请日:2022-04-19

    Applicant: VMware, Inc.

    CPC classification number: G06F3/0647 G06F3/0655 G06F3/0604 G06F3/0679

    Abstract: Example methods and systems for creating a plurality of snapshots of a storage object backed by a plurality of copy-on-write (COW) B+ tree data structure including a first COW B+ tree data structure having a first root node and leaf nodes maintaining mappings of LBAs to PBAs associated with a first snapshot of the storage object are disclosed. One example method includes creating a first root node of a first B+ tree data structure, maintaining a delta mapping table between a set of LBAs to a set of PBAs in the first leaf node, in response to receiving a request to create a second snapshot of the storage object: creating a second root node of a second COW B+ tree data structure and creating leaf nodes of the second COW B+ tree data structure in batches based on an order of the set of LBAs.

    REVERSE RANGE LOOKUP ON A UNIFIED LOGICAL MAP DATA STRUCTURE OF SNAPSHOTS

    公开(公告)号:US20220398030A1

    公开(公告)日:2022-12-15

    申请号:US17348016

    申请日:2021-06-15

    Applicant: VMware, Inc.

    Abstract: A method for reverse range lookup in an ordered data structure of keys, wherein each key comprises a logical block address (LBA) and a snapshot identifier (ID) of one of one or more snapshots in a snapshot hierarchy, is provided. The keys in the ordered data structure are in an order from smallest to largest LBA, wherein in the order, keys having a same LBA are ordered from smallest to largest snapshot ID. The method includes determining a range of LBAs and traversing the ordered data structure in reverse order until a key is found that: has an LBA and a snapshot ID that is less than or equal to the last LBA and the largest snapshot ID, respectively. The method further includes adding an extent corresponding to the located key to an extent result list if the snapshot ID of the located key is not within a deny list.

    DRR-BASED TWO STAGES IO SCHEDULING ALGORITHM FOR STORAGE SYSTEM WITH DYNAMIC BANDWIDTH REGULATION

    公开(公告)号:US20220179710A1

    公开(公告)日:2022-06-09

    申请号:US17112618

    申请日:2020-12-04

    Applicant: VMware, Inc.

    Abstract: An efficient scheduling of IOs in a computing system using dynamic bandwidth regulation includes building up a shared regulator to limit the total IOPS scheduling among all IO classes at any given time. Reserved regulators may be used to place limits on the IOPS scheduled for a particular IO class at any given time. An outstanding IO window may also limit the overall number of outstanding IOs, and/or the bytes of outstanding IOs at any particular time. A first stage of IO scheduling may involve enforcing the reserved regulators to limit the IOPS scheduled for particular IO classes. A second stage of IO scheduling may involve enforcing the shared regulator to limit the total IOPS scheduled for all IO classes.

Patent Agency Ranking