Netapp, Inc.

Amit Valjibhai Panara

Susan M Coatney

Hrishikesh Keremane

Mrinal K Bhattacharjee

Siddhartha Nandi

Chaitanya V Patel

Jagadish Vasudeva

Priya Sehgal

Pankti Vinay Majmudar

Prateeksha Varshney

Santhosh Unnikrishnan

Sravan Kumar Elpula

Sumith Makam

Vinay Kumar

Sushrut Bhowmik

Varun Simhadri

Sriram Venketaraman

Sriram Venkataraman

A method, computing device, and non-transitory machine-readable medium for detecting malware attacks and mitigating data loss. In various embodiments, an agent is implemented in the operating system of a storage node to provide protection at the bottommost level in a data write path. The agent intercepts write requests and observes file events over time to detect anomalous behavior. For example, the agent may monitor incoming write requests and, when an incoming write request is detected, determine whether the file is associated with a malware attack risk based on an analysis of an encryption state of data in the file.

Systems and methods for protecting against malware attacks

A method, a computing device, and a non-transitory machine-readable medium for managing modes of operation for volumes in a node. A first portion of a plurality of volumes in a node is selected to operate in an active mode. A second portion of the plurality of volumes in the node is selected to operate in a passive mode. The second portion of the volumes that operates in the passive mode consumes fewer resources than the first portion of the volumes that operates in the active mode. The first portion of the plurality of volumes and the second portion of the plurality of volumes are adjusted over time based on activity of each volume of the plurality of volumes.

Systems and methods for scaling volumes using volumes having different modes of operation

A method, computing device, and non-transitory machine-readable medium for detecting malware attacks and mitigating data loss. In various embodiments, an agent is implemented in the operating system of a storage node to provide protection at the bottommost level in a data write path. The agent intercepts write requests and observes file events over time to detect anomalous behavior. For example, the agent may monitor incoming write requests and, when an incoming write request is detected, determine whether the file is associated with a malware attack risk based on an analysis of an encryption state of data in the file. If the file is associated with a malware attack risk, an entry for the file is added to a file log. The agent may analyze the chi-square values for data written to the files, the file log, and the file format to determine whether a malware attack is underway.

During a storage redundancy giveback from a first node to a second node following a storage redundancy takeover from the second node by the first node, the second node is initialized in part by receiving a node identification indicator from the second node. The node identification indicator is included in a node advertisement message sent by the second node during a giveback wait phase of the storage redundancy giveback. The node identification indicator includes an intra-cluster node connectivity identifier that is used by the first node to determine whether the second node is an intra-cluster takeover partner. In response to determining that the second node is an intra-cluster takeover partner, the first node completes the giveback of storage resources to the second node.

Non-disruptive controller replacement in a cross-cluster redundancy configuration

Growing community of inventors

Bengaluru, India

Amit Valjibhai Panara