Oracle International Corporation

Confluera, Inc.

Niloy Mukherjee

Vineet Marwah

Amit Ganesh

Tirthankar Lahiri

Jesse Kamp

Juan R Loaiza

Allison Holloway

Sanket Hase

Kartik Kulkarni

Eun-Gyu Kim

Michael J Gleeson

Abhijit Ghosh

Shasank Kisan Chavan

Vivekanandhan Raja

Sujatha Muthulingam

Krishna Kunchithapadam

Wei Zhang

Teck Hua Lee

Jiaqi Yan

Mohamed Zait

Atrayee Mullick

Sandeep Siroya

Zhen Hua Liu

Yunrui Li

Kumar Rajamani

Wei-Ming Hu

Bipul Sinha

Manosiz Bhattacharyya

Dheeraj Pandey

Jia Shi

Vinay H Srihari

Mark Dilman

J William Lee

Jaebock Lee

Vasudha Krishnaswamy

Dinesh Das

Neil MacNaughton

Aurosish Mishra

Ramesh Kumar

Bharat Chandra Baddepudi

Hariharan Lakshmanan

Kiran Badrinarain Goyal

Prashant Gaharwar

Vipin Gokhale

Hochak Hung

Maria Colgan

Dhruvil Shah

Vinay Prabhu

Rushikesh Patil

Pradeep Gopanapalli Venkata

Aditi Gupta

Chamnan So

Hui Jin

Maheswaran Venkatachalam

Allison L Holloway

Techniques are described herein for executing queries on distinct portions of a database object that has been separate into chunks and distributed across the volatile memories of a plurality of nodes in a clustered database system. The techniques involve redistributing the in-memory database object portions on changes to the clustered database system. Each node may maintain a mapping indicating which nodes in the clustered database system store which chunks, and timestamps indicating when each mapping entry was created or updated. A query coordinator may use the timestamps to select a database server instance with local in memory access to data required by a portion of a query to process that portion of the query.

Method and mechanism for efficient re-distribution of in-memory columnar units in a clustered RDBMs on topology change

Infrastructure attacks based on graph edge context are identified by receiving an execution graph constructed by a central service based on behaviors monitored by a plurality of agents deployed on respective systems including a first system. The execution graph comprises a plurality of execution trails. One or more tags are applied to each edge of an execution trail of the execution graph based on at least one of temporal context or spatial context associated with the edge. One or more behaviors associated with the edge of the execution trail happen across an enterprise infrastructure involving the first system. The execution trail enriched with the one or more tags is analyzed. An action that is performed to mitigate security risks in the execution graph is determined based on the analysis.

Attack detection based on graph edge context

Infrastructure attacks involving lateral movement are identified by monitoring system level activities using software agents deployed on respective operating systems, and constructing, based on the system level activities, an execution graph comprising execution trails. A logon session between a remote connection client executing on a first operating system and a remote connection server executing on a second operating system is identified. Behavior exhibited from the logon session is attributed to a first global execution trail in the execution graph. A reconnection to the logon session between a remote connection client executing on a third operating system and the remote connection server is then identified, and, thereafter, behavior exhibited from the logon session is attributed to a second global execution trail in the execution graph.

Detecting and trail-continuation for attacks through remote desktop protocol lateral movement

A novel enterprise security solution allows for precise interception and surgical response to attack progression, in real time, as it occurs across a distributed infrastructure. The solution includes a data monitoring and management framework that continually models system level host and network activities as mutually exclusive infrastructure wide execution sequences and bucketizes them into unique execution trails. A multimodal intelligent security middleware detects indicators of compromise in real-time on top of subsets of each unique execution trail using rule based behavioral analytics, machine learning based anomaly detection, and other sources. Each detection result dynamically contributes to aggregated risk scores at execution trail level granularities. These scores can be used to prioritize and identify highest risk attack trails to end users, along with steps that such end users can perform to mitigate further damage and progression of an attack.

Methods and system for characterizing infrastructure security-related events

Methods and system for identifying relationships among infrastructure security-related events

Methods and system for tracking security risks over infrastructure

Methods and systems for identifying infrastructure attack progressions

Methods and system for detecting behavioral indicators of compromise in infrastructure

Techniques for non-disruptive versioning of in-memory units in a database are provided. A database server generates and maintains a first IMU that reflects changes made to a mirrored-data-set up to a first snapshot time, and a second IMU that reflects changes made to the mirrored-data-set up to a second snapshot time. During a first period, the database server responds to updates to first data items in the mirrored data by storing first staleness metadata that indicates that the copies of the first data items in the first IMU are stale. During a second period, the database server responds to updates to second data items in the mirrored data by storing second staleness metadata that indicates that the copies of the second data items in the second IMU are stale. The database server responds to a request by accessing the first IMU or the second IMU.

Versioning and non-disruptive servicing of in-memory units in a database

Method and mechanism for efficient re-distribution of in-memory columnar units in a clustered RDBMS on topology change

Techniques are described herein for distributing distinct portions of a database object across volatile memories of selected nodes of a plurality of nodes in a clustered database system. The techniques involve storing a unit-to-service mapping that associates a unit (a database object or portion thereof) to one or more database services. The one or more database services are mapped to one or more nodes. The nodes to which a service is mapped may include nodes in disjoint database systems, so long as those database systems have access to a replica of the unit. The database object is treated as in-memory enabled by nodes that are associated with the service, and are treated as not in-memory enabled by nodes that are not associated with the service.

Flexible in-memory column store placement

Techniques are described herein for executing queries on distinct portions of a database object that has been separate into chunks and distributed across the volatile memories of a plurality of nodes in a clustered database system. The techniques involve receiving a query that requires work to be performed on data that resides in a plurality of on disk extents. A parallel query coordinator that is aware of the in-memory distribution divides the work into granules that align with the in-memory separation. The parallel query coordinator then sends each granule to the database server instance with local in memory access to the data required by the granule and aggregates the results to respond to the query.

Framework for volatile memory query execution in a multi node cluster

Techniques are described for materializing pre-computed results of expressions. In an embodiment, a set of one or more column units are stored in volatile or non-volatile memory. Each column unit corresponds to a column that belongs to an on-disk table within a database managed by a database server instance and includes data items from the corresponding column. A set of one or more virtual column units, and data that associates the set of one or more column units with the set of one or more virtual column units, are also stored in memory. The set of one or more virtual column units includes a particular virtual column unit storing results that are derived by evaluating an expression on at least one column of the on-disk table.

Materializing expressions within in-memory virtual column units to accelerate analytic queries

Techniques related to efficient data storage and retrieval using a heterogeneous main memory are disclosed. A database includes a set of persistent format (PF) data that is stored on persistent storage in a persistent format. The database is maintained on the persistent storage and is accessible to a database server. The database server converts the set of PF data to sets of mirror format (MF) data and stores the MF data in a hierarchy of random-access memories (RAMs). Each RAM in the hierarchy has an associated latency that is different from a latency associated with any other RAM in the hierarchy. Storing the sets of MF data in the hierarchy of RAMs includes (1) selecting, based on one or more criteria, a respective RAM in the hierarchy to store each set of MF data and (2) storing said each set of MF data in the respective RAM.

Efficient data storage and retrieval using a heterogeneous main memory

Techniques are provided for maintaining data persistently in one format, but making that data available to a database server in more than one format. For example, one of the formats in which the data is made available for query processing is based on the on-disk format, while another of the formats in which the data is made available for query processing is independent of the on-disk format. Data that is in the format that is independent of the disk format may be maintained exclusively in volatile memory to reduce the overhead associated with keeping the data in sync with the on-disk format copies of the data.

Mirroring, in memory, data from disk to improve query performance

Growing community of inventors

Belmont, CA, United States of America

Niloy Mukherjee