Abstract: Disclosed herein are systems and method for multiplexing data of an underlying index. In an exemplary aspect, an index handler may generate a plurality of slots and a plurality of data buckets for a traditional index. The index handler may receive, from a software application, a request to access a data file. The index handler may determine whether any slot of the plurality of slots is attached to a respective data bucket of the plurality of data buckets comprising the data file. In response to determining that a first slot of the plurality of slots is attached to a first data bucket comprising the data file, the index handler may enable, via the first data bucket attached to the first slot, access to the data file to the software application.

Abstract: Disclosed herein are systems and method for determining a boot status of a failover server. In an exemplary aspect, a method may receive a failover test request for a failover server that provides disaster recovery for a production server, wherein the failover test request queries a successful boot status of the failover server. The method may determine whether a login into the failover server can be performed to execute the failover test request. In response to determining that the login cannot be performed, the method may retrieve server metrics for a failover server from a metric store and may determine a probability of the successful boot status based on both the retrieved server metrics and historic server metrics. In response to determining that the probability is greater than a threshold probability, the method may mark a recovery point of the failover server as validated.

Abstract: Disclosed herein are systems and method storing data. In an exemplary aspect, a method comprises determining a threshold data size for objects in a target data system; generating a data blob that has an allocated size of at least the threshold data size, wherein the data blob comprises at least one data set; identifying a data set stored in a source data system for backup to the target data system; determining whether a size of the data set is less than the threshold data size; and responsive to determining that the size of the data set is less than the threshold data size, inserting the data set into the data blob; and writing the data blob to the target data system.

Abstract: Disclosed herein are systems and method for selectively restoring a computer system to an operational state. In an exemplary aspect, the method may create a backup image of the computer system comprising a set of data blocks and may store the backup image of the computer system in an archive storage database. The method may determine a subset of the data blocks of the backup image that are required to keep the computer system operational. In response to determining that the computer system should be restored, the method may restore the subset of the data blocks such that the computer system is operational during startup, and may restore a remaining set of the data blocks from the backup image after the startup of the computer system.

Abstract: Disclosed are systems and method for machine learning and blockchain-based anti-discrimination validation. The described techniques uses a machine learning model to generate a numerical determination associated with a first person based on an input data set associated with the first person. The numerical determination is further based on a corrective module configured to compensate for prohibited discrimination by the machine learning model. The technique generates a blockchain transaction data structure comprising a state of the machine learning model at the time of generating the numerical determination, a copy of the input data set associated with the person, and an indication of a correction by the machine learning model. The blockchain transaction data structure is recorded or published in a blockchain network.

Abstract: Disclosed herein are systems and method for malicious behavior detection in processing chains comprising identifying a chain of related processes executing on a computing device; for each respective process in the chain of related processes: monitoring events generated by the respective process; storing snapshots of data modified by any of the events; determining a level of suspicion for the respective process by applying an artificial intelligence (AI) model to the snapshots of data; determining whether the chain of related processes is trusted based on the determined levels of suspicion; and in response to determining that the chain of related processes is not trusted, restoring objects affected by the chain from the snapshots.

Abstract: A method, computer program product, computing system, and system for using hot-plug virtual disks in granular recovery are described. The method may include receiving, at a cloud computing site, a backup configuration including a list of protected resources associated with a cloud computing tenant. The method may further include mounting a hot-plug virtual disk to a virtual machine including the protected resources associated with the cloud computing tenant. The method may also include collecting metadata corresponding to the protected resources associated with the cloud computing tenant. The method may additionally include generating, at the cloud computing site, a backup of the virtual machine including the protected resources associated with the cloud computing tenant.

Abstract: A system and method is provided for data classification to control file backup operations. An exemplary method includes sampling metadata of one or more files on a computer at a predetermined time interval, determining whether the metadata has changed over time after a predetermined amount of metadata is collected, deriving a model of the change of the metadata over time when the metadata has changed over time, wherein the model of change is a snapshot of dynamically sampled attributes of the one or more files and reflects a state of the computer, performing an analysis of the model of change by determining features of the one or more files comprising at least file usage dynamics of the computer and a user associated with the one or more files based on the model; and selecting a backup plan for the one or more files according to the file usage dynamics.

Abstract: Disclosed herein are systems and method for de-duplicating blocks of data. In one aspect, an exemplary method comprises for each previously de-duplicated block of data of a de-duplication engine, storing de-duplicated pages references by hashes and a block descriptor. The method comprises receiving, at the de-duplication engine, a new block of data for de-duplication assessment and determining a similarity of the received block to the previously de-duplicated blocks. When the received block is determined as being similar to the previously de-duplicated blocks, the method comprises storing the received block without duplication in the de-duplication engine, including pages of the block referenced by the hashes and the block descriptor.

Abstract: Disclosed herein are systems and method for building content for a de-duplication engine. In one aspect, an exemplary method comprises periodically receiving instructions for cycling through a coalescing phase and a sedimentation phase of the de-duplication engine, during a first coalescing phase, selecting a set of seed blocks that are similar to each other, when an instruction for proceeding to a next sedimentation phase is received, entering the sedimentation phase during which newly received blocks are processed to be stored near similar seed blocks, and when an instruction to proceed to a next coalescing phase is received, entering the coalescing phase to update the set of seed blocks.

Abstract: Disclosed herein are systems and method for backing up data in a clustered environment. A clustered resource to be backed up is selected, wherein the clustered resource is stored on a common storage system and operated on by a cluster-aware application executing on two or more nodes of a computing cluster. A first backup agent executing on a first node of the computing cluster may determine a list of changes to the clustered resource and may receive at least one list of changes to the clustered resource that are tracked by peer backup agents executing on other nodes of the computing cluster. The first backup agent may merge the lists of changes to the clustered resource, and may generate a consistent incremental backup using data retrieved from the common storage system according to the merged lists of changes to the clustered resource.

Abstract: Disclosed herein are systems and methods for protecting user data. In one aspect, an exemplary method comprises, by a hardware processor, detecting user files created by a first user and stored on a user device, the user files containing personal information associated with the first user, generating user transactional data associated with one or more detected network-based interactions with a service provider, generating user behavior data based on one or more user interactions with a graphical user interface of the user device, applying a machine learning model to user data to generate a classification of the first user, the user data comprising the user files, the user transactional data, and the user behavior data, and when the user is identifiable based on the generated classification, modifying at least one of (i) user files stored on the user device and (ii) user behavior during an operation of the user device.

Abstract: Disclosed herein are systems and method for forming and executing a backup strategy. In one aspect, an exemplary method comprises, for each file of files from one or more data sources that is being evaluated to form the backup strategy for the file, updating a frequency database, evaluating a uniqueness for the file stored at a data source of the one or more data sources by comparing at least a portion of data of the file to the frequency database, categorizing the file into a hierarchy of logical types according to properties of the file, and forming the backup strategy for the file according to the uniqueness and categorization of the file.

Abstract: Disclosed herein are systems and methods for generating tokens using SMPC compute engines. In one aspect, a method may hash, by a node, a data input with a salt value. The method may split, by the node, the hashed data input into a plurality of secret shares, wherein each respective secret share of the plurality of secret shares is assigned to a respective SMPC compute engine of a plurality of SMPC compute engines. The respective SMPC compute engines may be configured to collectively hash the respective secret share with a secret salt value, unknown to the plurality of SMPC compute engines. The respective SMPC compute engine may further receive a plurality of hashed secret shares from remaining SMPC compute engines of the plurality of SMPC compute engines, and generate a token, wherein the token is a combination of the hashed respective secret share and the plurality of hashed secret shares.

Abstract: Disclosed herein are systems and method for read-optimized de-duplication of blocks of data. In one aspect, an exemplary method comprises for each page of a newly received block of data, computing a page hash and assigning a page context ID, computing an index of a page node for storing the page and selecting the page node, when the selected page node contains a copy of the page, adding a page reference to a block descriptor with the page being referenced by the page hash augmented by the page context ID, otherwise, storing the page in plain storage; and for the block of data, storing the block descriptor in a block node of the de-duplication engine, the block of data being referenced by a block hash and the block descriptor containing at least a list of pages of the block stored in page nodes of the de-duplication engine.

Abstract: A technique is described for protecting file data from malicious programs, in particularly, by decrypting data that has been maliciously encrypted by software such as ransomware. The described technique generates a copy of a first block of a plurality of files stored on a computing device, and also intercepts request(s) from a process executing on the computing device to obtain certain types of random data and system entropy, which are recorded. When the system detects that the plurality of files have been encrypted by a malicious program, the described system determines a cryptographic key determined based on the generated copies of the first blocks of the plurality of files and on the recorded random data, and uses that key to decrypt the plurality of files.

Abstract: Disclosed herein are systems and method for method for predictive data protection. In one aspect, an exemplary method comprises selecting data stored on a computing device for backing up, according to a predetermined schedule for performing a backup; collecting features associated with the computing device where the data for the backup is stored, the features comprising device information for the computing device, user information for a user of the data, and external information associated with a locale of the computing device; analyzing the features to determine a set of backup parameters for the backup, wherein the backup parameters comprise scheduling parameters and destination storage parameters; generating a backup plan based on the set of parameters for performing the backup; and performing the backup of the data according to the backup plan.

Abstract: Disclosed herein are systems and method for deep dynamic analysis for protecting endpoint devices from malware. In one aspect, an exemplary method comprises launching a deep analysis process, by a deep analysis tool, the launching including: injecting a dynamically loaded component into an address space of an application code and initializing, by the dynamically loaded component, to allow an execution activity, by the injected dynamically loaded component, parsing dependencies of run-time linkages, hooking system functions, creating an application memory map with separate application and system code areas, transferring control back to the application code, and performing on-sample-execution activity, obtaining control of exception handler and monitoring attempts to use the exception handler, changing an available area, logging accesses, inspecting exception reasons and applying policies, determining whether or not the application of the sample is a malware, and sending a final verdict.

Abstract: Disclosed herein are systems and method for storing media authentication data using a distributed ledger. In one aspect, an exemplary method comprises, receiving, by a processor of a computing node of a plurality of computing nodes, one or more hashes associated with a media content and a timestamp, the computing nodes being communicatively linked, generating a data block that contains at least one of the received hashes, the data block being generated by hashing a hash corresponding to a previous data block of the distributed ledger together with the at least one hash, the at least one hash corresponding to the media content of the data block being generated, transmitting to the plurality of computing nodes, a message reporting an addition of the generated data block, wherein at least some of the plurality of computing nodes maintain at least a partial copy of the distributed ledger.

Abstract: Disclosed herein are systems and method for correlating malware detections by endpoint devices and servers. In one aspect, an exemplary method comprises receiving, by a correlator, from one or more servers, one or more events collected without invasive techniques, one or more events collected using one or more invasive techniques, and one or more final verdicts, correlating the one or more events collected without invasive techniques with one or more events collected using the one or more invasive techniques, creating a suspicious pattern when an event of the one or more events collected without invasive techniques is correlated with an event of the one or more events collected using the one or more invasive techniques, and the event of the one or more events collected using one or more invasive techniques is used to detect a malware, and updating databases of one or more endpoint devices with created suspicious patterns.