International Business Machines Corporation

Russell Holden

William A Spencer

John Douglas Curtis

Gordon E Hegfield

Peter Otto Mierswa

Stanley Kieran Jerrard-Dunne

Ravi Ranjan

Charles W Kaufman

Jane B Marcus

Scott M Davidson

Srinivasa R Kolaparthi

Olgierd Stanislaw Pieczul

Mark Alexander McGloin

Chester E Ryder, Iii

Damien F Katz

Albert J Morello

Jason D LaVoie

Daniel C Gurney

Vinod R Seraphin

Michael J Kerrigan

Kenneth E Brunsen

Michael J Gagnon

Nikolaus K Brauer

Michael I Killoran

Merging directory information from a user directory to a common directory includes based on a rule associated with contents of a user directory of a local database, extracting a department indicator from the user directory, mapping the department indicator to a corresponding user record in a common directory of a registry database, and based on the department indicator, marking the user record in the common directory with a department that corresponds to the contents from the user directory with a department for controlling access to that user record in the registry database.

Merging directory information from a user directory to a common directory

Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of 'legitimate' behavior is defined for accessor classes, preferably along with actions to be taken in the event an accessor exceeds those limits. A set of accessor 'usage profiles' are generated. Typically, a profile comprises information, such as a &#x201c;request time window,&#x201d; one or more &#x201c;constraints,&#x201d; and one or more &#x201c;actions.&#x201d; A request time window defines a time period over which request usage is accumulated and over which constraints are applied. A constraint may be of various types (e.g., number of transactions, defined resource usage limits, etc.) to be applied for the usage monitoring An action defines how the system will respond if a particular constraint is triggered. By applying the constraints to accessor requests, over-utilization of compute resources is enabled.

Preventing application-level denial-of-service in a multi-tenant system

Techniques are described above for smoothing peak load in collaborative systems. One embodiment includes, prior to a predicted peak load period, pre-staging user-data associated with one or more users of the collaborative system. During the predicted peak load period, a request from a first one of the users for access to the pre-staged user-data associated with the first user is received. And in response to the request, the pre-staged user-data is provided to the first user.

Smoothing peak system load via behavior prediction in collaborative systems with temporal data access patterns

Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of 'legitimate' behavior is defined for accessor classes, preferably along with actions to be taken in the event an accessor exceeds those limits. A set of accessor 'usage profiles' are generated. Typically, a profile comprises information, such as one or more &#x201c;constraints,&#x201d; and one or more &#x201c;actions.&#x201d; At least one constraint is generated by applying one or more parameters of a transaction weighting function such that the resulting constraint represents an actual or estimated cost of executing the transaction. An action defines how the system will respond if a particular constraint is triggered. By applying the constraints to accessor requests, the approach prevents over-utilization of compute resources.

Preventing application-level denial-of-service in a multi-tenant system using parametric-sensitive transaction weighting

Denial-of-service attacks are prevented or mitigated in a cloud compute environment, such as a multi-tenant, collaborative SaaS system. This is achieved by providing a mechanism by which characterization of 'legitimate' behavior is defined for tenant applications or application classes, preferably along with actions to be taken in the event a request to execute an application is anticipated to exceed defined workflow limits. A set of application profiles are generated. Typically, a profile comprises information, such as a request defined by one or more request variables, one or more 'constraints,' one or more &#x201c;request mappings,&#x201d; and one or more &#x201c;actions.&#x201d; A constraint is a maximum permitted workload for the application. A request mapping maps a request variable to the constraint, either directly or indirectly. The profile information defines how a request is mapped to a workload to determine whether the request is in policy or, if not, what action to take.

Pre-processing system for minimizing application-level denial-of-service in a multi-tenant system

Transaction storm detection includes receiving a series of transactions in a data stream for an authenticated network session. A detection engine determines whether the transactions form a transaction storm. In response to determining that the transactions are a transaction storm, metrics associated with the transaction storm are presented. One or more actions may be specified to be applied in a subsequently detected transaction storm.

Session-based server transaction storm controls

A transaction storm detection engine is configured to receive a series of transactions in a data stream for an authenticated network session. The detection engine determines whether the transactions form a transaction storm. In response to determining that the transactions are a transaction storm, metrics associated with the transaction storm are presented. One or more actions may be specified to be applied in a subsequently detected transaction storm.

A method, system, and program product are provided for minimizing replication when a new server is replicated with. A replication application for a client computer having a replica of a database thereon is executed by a processor in a computer to receive for a replication service comprising a plurality of servers containing replicas of the database, an indication of each healthy server in the replication service and a determined period of time within which replication is assured to have been completed for each healthy server. The replication application updates a replication history after successful completion of each replication by adding an entry comprising an identification for the server replicated with and a timestamp for the time of replication and by adding an entry for each other healthy server in the replication service containing an identification for the respective server and an imputed timestamp adjusted for the determined period of time.

Minimizing replication search on failover

Growing community of inventors

Boxborough, MA, United States of America

Russell Holden