Emc Corporation

Northeastern University

Aviram Cohen

Arieh Don

Alexandr Veprinsky

Hana Moreshet

Natan Vishlitzky

Mathieu Gagne

Kenneth A Halligan

Ishay Kedem

Ishai Kedem

Haim Kopylovitz

Philip E Tamer

David Kaeli

Micha Moffie

Jennifer Dy

Javed Aslam

Malak Alshawabkeh

Fatemeh Azmandian

An intrusion detection system collects architectural level events from a Virtual Machine Monitor where the collected events represent operation of a corresponding Virtual Machine. The events are consolidated into features that are compared with features from a known normal operating system. If an amount of any differences between the collected features and the normal features exceeds a threshold value, a compromised Virtual Machine may be indicated. The comparison thresholds are determined by training on normal and abnormal systems and analyzing the collected events with machine learning algorithms to arrive at a model of normal operation.

VMM-based intrusion detection system

A method and apparatus for enabling an on-line reconfiguration of striped data in a disk array storage device. A replicated copy of the striped logical device is made in parallel with host operations. A logical device with a new configuration is then substituted for access by the host application even before any data is transferred to locations within the newly configured logical device. Independent processes operating in this disk array storage device reconfigure the data transparently to any host operations while accommodating host I/O requests directed to locations in the new configuration.

Method and apparatus for reconfiguring striped logical devices in a disk array storage

A method for scanning a mass-storage device in communication with a global memory includes allocating a scan buffer in the global memory for placement of information descriptive of any errors found during the scan. When a scanning utility identifies a data error on the mass-storage device, it writes structured information descriptive of the error to the scan buffer. This information is available to an error-correction utility. The error-correction utility uses this information to determine, with a minimum of human intervention, which data errors to repair and which to ignore.

Selective correction of data errors

A method for scanning a disk to verify the integrity of data records stored on the disk includes comparing copies of meta-data derived from a data record to be verified. For each data record, a first copy of the meta-data for that record is stored in a cache memory and a second copy of the meta-data for that record is stored on the disk. To verify a data record, a third copy of the meta-data is made by copying the second copy to the cache-memory element. The first and third copy are then compared to verify the integrity of the data record. By reducing the number of disk accesses and eliminating the need to access the data record itself, the scanning method enables a disk to be scanned rapidly.

Error detection in disk storage systems

A system and method for initializing large portions, or extents, of a mass-storage device in the background so that such overwriting processes do not significantly affect latency as experienced by a host. The method extends the use a system intended for background copying of data from a source extent to a destination extent to that of initializing an extent on a mass-storage device. It does so by causing the system to treat the defined extent as both a source extent and as a destination extent simultaneously.

Initializing selected extents of a storage device

The meta-data pattern for records in an orphan track is not readily compressible into a form suitable for maintaining in memory. A method is provided for periodically attempting to compress meta-data from orphan tracks as newly compressible meta-data patterns are made available. The method includes specifying a compressed representation for a first meta-data pattern and determining a second meta-data pattern formed by the meta-data associated with the orphan track. If the second meta-data pattern is consistent with the first meta-data pattern, a compressed representation of the second meta-data pattern is generated and maintained in memory. In an optional feature, meta-data that could not be compressed is collected and periodically transmitted to a data-analysis node for analysis.

Management of orphan tracks

Growing community of inventors

Lexington, MA, United States of America

Aviram Cohen