Abstract: Determining which snapshot deltas tend to occur in: (i) healthy virtual machines (VMs) that have been subject to an attack yet remained healthy, and/or (ii) unhealthy VMs that have apparently been adversely affected by an attack. Snapshot deltas that occur in at least some (or more preferably all) of the healthy VM subset provide information about software changes (for example, updates, configuration changes) that may be helpful. Snapshot deltas that occur in at least some (or more preferably all) of the unhealthy VM subsets provide information about software changes (for example, updates, configuration changes) that may be unhelpful.

Abstract: Techniques for model-based analysis of a data center. A method includes creating a metamodel based on domain knowledge to represent a type of object and/or relationship of a data center, using static and dynamic configuration and data analysis techniques to discover topology of elements of the data center and represent the topology as a model that is an instance of the metamodel, extending the metamodel, using the model to perform analysis of the data center in connection with a specified task, leveraging domain knowledge represented in nodes of the extended metamodel to guide the analysis in terms of determining guidelines to apply to each node and determining relationships to traverse to continue the analysis, extending the domain knowledge by updating the extended metamodel upon discovery of additional knowledge for use in improving analysis tasks, and extending the model on-demand using dynamic analysis techniques upon detection of multiple analysis failures.

Abstract: Determining which snapshot deltas tend to occur in: (i) healthy virtual machines (VMs) that have been subject to an attack yet remained healthy, and/or (ii) unhealthy VMs that have apparently been adversely affected by an attack. Snapshot deltas that occur in at least some (or more preferably all) of the healthy VM subset provide information about software changes (for example, updates, configuration changes) that may be helpful. Snapshot deltas that occur in at least some (or more preferably all) of the unhealthy VM subsets provide information about software changes (for example, updates, configuration changes) that may be unhelpful.

Abstract: A base query having a plurality of base query terms is obtained. A plurality of problem log files are accessed. Words, contained in a corpus vocabulary, are extracted from the plurality of problem log files. Based on the words extracted from the plurality of problem log files, a first expanded query is generated from the base query. The corpus is queried, via a query engine and a corpus index, with a second expanded query related to the first expanded query.

Abstract: A method, a computer program product, and a computer system for automatically migrating servers into an environment of multiple firewalls. A computer creates a graph representing the servers and connectivity, based on connectivity strengths and resource requirements. The computer groups the servers into multiple groups by using a graph based partitioning algorithm which considers the connectivity strengths and the resource requirements. The computer creates two adjacency matrices, one for local rules and the other for global rules. The computer adds endpoints to a local adjacency list, in response to determining that the endpoints are in a respective one of the multiple groups. The computer adds endpoints to a global adjacency list, in response to determining that the endpoints are not in respective one of the multiple groups. The computer converts the adjacency lists to firewall rules for the respective one of the multiple groups.

Abstract: A method, a computer program product, and a computer system for automatically migrating servers into an environment of multiple firewalls. A computer creates a graph representing the servers and connectivity, based on connectivity strengths and resource requirements. The computer groups the servers into multiple groups by using a graph based partitioning algorithm which considers the connectivity strengths and the resource requirements. The computer creates two adjacency matrices, one for local rules and the other for global rules. The computer adds endpoints to a local adjacency list, in response to determining that the endpoints are in a respective one of the multiple groups. The computer adds endpoints to a global adjacency list, in response to determining that the endpoints are not in respective one of the multiple groups. The computer converts the adjacency lists to firewall rules for the respective one of the multiple groups.

Abstract: Determining which snapshot deltas tend to occur in: (i) healthy virtual machines (VMs) that have been subject to an attack yet remained healthy, and/or (ii) unhealthy VMs that have apparently been adversely affected by an attack. Snapshot deltas that occur in at least some (or more preferably all) of the healthy VM subset provide information about software changes (for example, updates, configuration changes) that may be helpful. Snapshot deltas that occur in at least some (or more preferably all) of the unhealthy VM subsets provide information about software changes (for example, updates, configuration changes) that may be unhelpful.

Abstract: Methods, systems, and articles of manufacture for injecting faults at select execution points of distributed applications are provided herein. A method includes monitoring a run-time state of each of multiple components of a distributed application to determine one or more sequence of events that triggers a fault injection point at one of the multiple components; defining a fault injection scenario in a specification based on said monitoring, wherein said fault injection scenario comprises a description of one or more sequence of events during which an intended fault is to be injected to a target component of the multiple components at one selected event; and executing the fault injection defined in the specification to perform injection of the intended fault during run-time of the distributed application.

Abstract: For disaster recovery involving a first site and a disaster recovery site, where at least a portion of management service metadata not isolated within the management service, a failover process is initiated, including creating an initial snapshot of the distributed metadata state. In a failback process, a representation is created of state changes for the management service and a delta description is calculated therefrom. The delta description is transmitted to the first site; and a reverse replica is created, at the first site, of all the workload components from the disaster recovery site. The delta description is played back to restore a distributed metadata state that existed in the disaster recovery site and to re-create it in the first site.

Abstract: For disaster recovery involving a first site and a disaster recovery site, where at least a portion of management service metadata not isolated within the management service, a failover process is initiated, including creating an initial snapshot of the distributed metadata state. In a failback process, a representation is created of state changes for the management service and a delta description is calculated therefrom. The delta description is transmitted to the first site; and a reverse replica is created, at the first site, of all the workload components from the disaster recovery site. The delta description is played back to restore a distributed metadata state that existed in the disaster recovery site and to re-create it in the first site.

Abstract: During normal operation, at a first site, of a disaster recovery management unit, at least one customer workload machine, at least one management service machine, and metadata for the at least one management service machine are replicated to a remote disaster recovery site. After a disaster at the first site, a replicated version of the at least one customer workload machine and a replicated version of the at least one management service machine are brought up at the remote disaster recovery site. A replicated version of the metadata for the at least one management service machine is reconfigured by executing, on the replicated version of the at least one management service machine, a failover script, to obtain reconfigured replicated metadata for the replicated version of the at least one management service machine. When the first site comes back up, failback is carried out, essentially in the reverse order.

Abstract: Methods, systems, and articles of manufacture for selected VM replication and VM restart techniques are provided herein. A method includes selecting a sub-set of one or more VMs from a set of multiple VMs in a system to be replicated before an identification of one or more failed VMs in the set of multiple VMs; replicating the sub-set of one or more VMs before the identification of one or more failed VMs in the set of multiple VMs; selecting a sub-set of the identified one or more failed VMs to be restarted upon an identification of the one or more failed VMs in the set of multiple VMs in the system; and restarting the sub-set of the identified one or more failed VMs upon the identification of the one or more failed virtual machines in the set of multiple VMs.

Abstract: During normal operation, at a first site, of a disaster recovery management unit, at least one customer workload machine, at least one management service machine, and metadata for the at least one management service machine are replicated to a remote disaster recovery site. After a disaster at the first site, a replicated version of the at least one customer workload machine and a replicated version of the at least one management service machine are brought up at the remote disaster recovery site. A replicated version of the metadata for the at least one management service machine is reconfigured by executing, on the replicated version of the at least one management service machine, a failover script, to obtain reconfigured replicated metadata for the replicated version of the at least one management service machine. When the first site comes back up, failback is carried out, essentially in the reverse order.

Abstract: At least one anomaly associated with at least one actual hardware element in a computer system having a plurality of hardware elements is addressed. The anomaly is detected, and, responsive to the detection, a virtualization layer is inserted between (i) an operating system of the computer system, and (ii) the plurality of hardware elements. Hardware emulation and/or selective hardware activation/deactivation are performed on the at least one actual hardware element by the virtualization layer. The insertion of the virtualization layer is accomplished in an on-the-fly manner.

Abstract: User trustworthiness may be introduced in implicit feedback based supervised machine learning systems. A set of training data examples may be scored based on the trustworthiness of users associated respectively with the training data examples. The training data examples may be sampled into a plurality of training data sets based on a weighted bootstrap sampling technique, where each weight is a probability proportional to trustworthiness score associated with an example. A machine learning algorithm takes the plurality of the training data sets as input and generates a plurality of trained models. Outputs from the plurality of trained models may be ensembled by computing a weighted average of the outputs of the plurality of trained models.

Abstract: During normal operation, at a first site, of a disaster recovery management unit, at least one customer workload machine, at least one management service machine, and metadata for the at least one management service machine are replicated to a remote disaster recovery site. After a disaster at the first site, a replicated version of the at least one customer workload machine and a replicated version of the at least one management service machine are brought up at the remote disaster recovery site. A replicated version of the metadata for the at least one management service machine is reconfigured by executing, on the replicated version of the at least one management service machine, a failover script, to obtain reconfigured replicated metadata for the replicated version of the at least one management service machine. When the first site comes back up, failback is carried out, essentially in the reverse order.

Abstract: A system and computer program product for automatically generating one or more rules during IT transformation for configuring one or more firewall interfaces in a post-transformation target environment include obtaining at least one communication pattern occurring in a pre-transformation source environment, and automatically generating one or more vendor-neutral rules for one or more intended firewall interfaces in a post-transformation target environment based on the at least one communication pattern occurring in the source environment and based on information derived from the target environment.

Abstract: Techniques for model-based analysis of a data center. A method includes creating a metamodel based on domain knowledge to represent a type of object and/or relationship of a data center, using static and dynamic configuration and data analysis techniques to discover topology of elements of the data center and represent the topology as a model that is an instance of the metamodel, extending the metamodel, using the model to perform analysis of the data center in connection with a specified task, leveraging domain knowledge represented in nodes of the extended metamodel to guide the analysis in terms of determining guidelines to apply to each node and determining relationships to traverse to continue the analysis, extending the domain knowledge by updating the extended metamodel upon discovery of additional knowledge for use in improving analysis tasks, and extending the model on-demand using dynamic analysis techniques upon detection of multiple analysis failures.

Abstract: Techniques for model-based analysis of a data center. A method includes creating a metamodel based on domain knowledge to represent a type of object and/or relationship of a data center, using static and dynamic configuration and data analysis techniques to discover topology of elements of the data center and represent the topology as a model that is an instance of the metamodel, using the model to perform analysis of the data center in connection with a specified task, leveraging domain knowledge represented in nodes of the metamodel to guide the analysis in terms of determining guidelines to apply to each node and determining relationships to traverse to continue the analysis, extending the domain knowledge by updating the metamodel upon discovery of additional knowledge for use in improving analysis tasks, and extending the model on-demand using dynamic analysis techniques upon detection of multiple analysis failures.

Abstract: Techniques for automatically generating one or more rules during IT transformation for configuring one or more firewall interfaces in a post-transformation target environment. A method includes obtaining at least one communication pattern occurring in a pre-transformation source environment, and automatically generating one or more vendor-neutral rules for one or more intended firewall interfaces in a post-transformation target environment based on the at least one communication pattern occurring in the source environment and based on information derived from the target environment.