Abstract: As described herein, a system, method, and computer program are provided for context-based data-driven classification. Input to be processed using a classifier is identified. Data is obtained from one or more third party data sources, based on the input to be processed. The input is processed, using the classifier, to generate output that includes at least one classification for the input. Both the data from the one or more third party data sources and the output of the classifier are processed to determine a final classification for the input.

Abstract: A method and system for data consistency across failure and recovery of infrastructure. In one embodiment of the method, copies of first data blocks stored in a source memory are sent to a target site via a data link. While sending one or more of the copies of the first data blocks to the target site, source hashes for second data blocks stored in the source memory are calculated, wherein the first data blocks are distinct from the second data blocks. While sending one or more of the copies of the first data blocks to the target site, target hashes of data blocks stored in a target memory of the target site are received. While sending one or more of the copies of the first data blocks to the target site, the source hashes are compared with the target hashes, respectively. After sending the first data blocks to the target site via the data link, copies of only those second data blocks are sent to the target site with source hashes that do not compare equally with respective target hashes.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include determining, at a source site, whether metadata has been received from a target site, and, in response to a determination that the metadata has been received at the source site, retrieving the at least one unit of the source data from the source data store using the metadata and sending, from the source site, the at least one unit of source data to the target site.

Abstract: A method and system for data consistency across failure and recovery of infrastructure. In one embodiment of the method, copies of first data blocks stored in a source memory are sent to a target site via a data link. While sending one or more of the copies of the first data blocks to the target site, source hashes for second data blocks stored in the source memory are calculated, wherein the first data blocks are distinct from the second data blocks. While sending one or more of the copies of the first data blocks to the target site, target hashes of data blocks stored in a target memory of the target site are received. While sending one or more of the copies of the first data blocks to the target site, the source hashes are compared with the target hashes, respectively. After sending the first data blocks to the target site via the data link, copies of only those second data blocks are sent to the target site with source hashes that do not compare equally with respective target hashes.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include determining whether a source data store and a replicated data store are unsynchronized and, in response to a determination that the source data store and the replicated data store are unsynchronized, performing a resynchronization operation. The source data stored in the source data store is replicated to replicated data in the replicated data store. The resynchronization operation resynchronizes the source data and the replicated data.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include determining whether a source data store and a replicated data store are unsynchronized and, in response to a determination that the source data store and the replicated data store are unsynchronized, performing a resynchronization operation. The source data stored in the source data store is replicated to replicated data in the replicated data store. The resynchronization operation resynchronizes the source data and the replicated data.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include tracking one or more write operations executed on a target data store and sending metadata regarding the one or more write operations to a source site. The tracking comprises storing information regarding the one or more write operations in a data structure. The one or more write operations cause one or more units of data to be written to the target data store. The target data store is at a target site. The metadata comprises the information.

Abstract: Infrastructure attacks are identified by monitoring system level activities using software agents deployed on respective operating systems and constructing, based on the system level activities, an execution graph comprising a plurality of execution trails. A connection to a remote server executing on a first one of the operating systems is identified, where the connection is initiated by a remote execution function executing on a second one of the operating systems. A connection is formed between the first operating system and the second operating system in a global execution trail in the execution graph. A new process created on the first operating system is determined to be associated with a logon session resulting from the connection, and behavior exhibited from the logon session is attributed to the global execution trail in the execution graph.

Abstract: Disclosed herein are methods, systems, and processes to provide and maintain data consistency during reverse replication. It is determined that a migrate operation or a reverse replication operation has been requested. Upon determining that the migrate operation or the reverse replication operation has been requested, a resynchronization identifier is set in a dirty region log (DRL) associated with a computing device that is subject to the migrate operation or the reverse replication operation. In response to the operation being the reverse replication operation, a master boot record (MBR) sector of a boot disk associated with the computing device is overwritten.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include tracking one or more write operations executed on a target data store and sending metadata regarding the one or more write operations to a source site. The tracking comprises storing information regarding the one or more write operations in a data structure. The one or more write operations cause one or more units of data to be written to the target data store. The target data store is at a target site. The metadata comprises the information.

Abstract: Methods, computer program products, computer systems, and the like are disclosed that provide for scalable deduplication in an efficient and effective manner. For example, such methods, computer program products, and computer systems can include determining whether a source data store and a replicated data store are unsynchronized and, in response to a determination that the source data store and the replicated data store are unsynchronized, performing a resynchronization operation. The source data stored in the source data store is replicated to replicated data in the replicated data store. The resynchronization operation resynchronizes the source data and the replicated data.

Abstract: The disclosed computer-implemented method for replicating information with information retention systems may include (1) queueing information communicated between a virtual machine and a source storage device, (2) initiating creating a clone of the virtual machine, (3) sending update information sets, (4) inserting a flush marker into a network queue, (5) stopping the queueing of the information communicated between the virtual machine and the source storage device, (6) sending, after sending the update information sets, the flush marker via a source replication gateway to the target server computing device, (7) pausing replication of the source storage device, (8) resuming replication of the source storage device responsive to completing creating the clone of the virtual machine, and (9) sending, to the target server computing device, additional information communicated between the virtual machine and the source storage device after stopping the queueing.

Abstract: Infrastructure attacks involving lateral movement are identified by monitoring system level activities using software agents deployed on respective operating systems, and constructing, based on the system level activities, an execution graph comprising execution trails. A logon session between a remote connection client executing on a first operating system and a remote connection server executing on a second operating system is identified. Behavior exhibited from the logon session is attributed to a first global execution trail in the execution graph. A reconnection to the logon session between a remote connection client executing on a third operating system and the remote connection server is then identified, and, thereafter, behavior exhibited from the logon session is attributed to a second global execution trail in the execution graph.

Abstract: Disclosed herein are methods, systems, and processes to provide and maintain data consistency during reverse replication. It is determined that a migrate operation or a reverse replication operation has been requested. Upon determining that the migrate operation or the reverse replication operation has been requested, a resynchronization identifier is set in a dirty region log (DRL) associated with a computing device that is subject to the migrate operation or the reverse replication operation. In response to the operation being the reverse replication operation, a master boot record (MBR) sector of a boot disk associated with the computing device is overwritten.

Abstract: The disclosed computer-implemented method for recovery of computing environments via a replication solution may include (1) dynamically maintaining a replica of data associated with a protected computing device via a data replication device, (2) obtaining, from a preboot execution environment (PXE) server, a PXE that includes a bootable replication environment for the protected computing device, (3) directing the protected computing device to boot using the bootable replication environment, (4) exposing at least one data storage device associated with the protected computing device to the data replication device via a secure data connection, and (5) replicating the replica of data associated with the protected computing device to the data storage device associated with the protected computing device via the bootable replication environment and the secure data connection. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: The disclosed computer-implemented method for replicating information with information retention systems may include (1) queueing information communicated between a virtual machine and a source storage device, (2) initiating creating a clone of the virtual machine, (3) sending update information sets, (4) inserting a flush marker into a network queue, (5) stopping the queueing of the information communicated between the virtual machine and the source storage device, (6) sending, after sending the update information sets, the flush marker via a source replication gateway to the target server computing device, (7) pausing replication of the source storage device, (8) resuming replication of the source storage device responsive to completing creating the clone of the virtual machine, and (9) sending, to the target server computing device, additional information communicated between the virtual machine and the source storage device after stopping the queueing.

Abstract: Disclosed herein are methods, systems, and processes to provide and maintain data consistency during reverse replication. It is determined that a migrate operation or a reverse replication operation has been requested. Upon determining that the migrate operation or the reverse replication operation has been requested, a resynchronization identifier is set in a dirty region log (DRL) associated with a computing device that is subject to the migrate operation or the reverse replication operation. In response to the operation being the reverse replication operation, a master boot record (MBR) sector of a boot disk associated with the computing device is overwritten.

Abstract: The disclosed computer-implemented method for recovering data may include (i) accumulating a list of changed blocks that have changed in a replicated source volume over a continuous-data-protection window of time, (ii) receiving a request to recover data in a replication target volume of the replicated source volume, (iii) converting the changed blocks to a changed-block volume that is paired with the replication target volume, (iv) launching a virtual machine from the replication target volume and the paired changed-block volume, (v) determining that an intercepted read request is directed to a changed block stored within the changed-block volume, and (vi) redirecting the intercepted read request from the replication target volume to the changed-block volume to fulfill the intercepted read request. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Concurrent access to a user profile in a layering system is provided. When a user logs into a computing device, the server can locate a corresponding user profile to identify which layers should be provided to the user. Rather than sending these layers to the computing device for mounting, the server can mount the layers on the server. Therefore, if a user logs into multiple computing devices, the layering file system and registry filter drivers on those devices can route file system and registry requests to the server where the layers are mounted. Since the layers are mounted to a single device, concurrent access can be provided without the concern of data conflicts.

Abstract: The disclosed computer-implemented method for monitoring data synchronization progress in a multi-hop data recovery system may include (i) calculating a number of data blocks to be synchronized, (ii) setting each element of a synchronization data structure to dirty, (iii) determining a dirty bytes counter, (iv) transmitting a portion of the data blocks to be synchronized, (v) receiving an acknowledgement corresponding to the transmitted portion of the data blocks, (vi) setting a set of elements within the synchronization data structure corresponding to the transmitted portion of the data blocks to clean, (vii) determining a pending dirty bytes counter that indicates a current number of elements within the synchronization data structure that are set to dirty, and (viii) transmitting the dirty bytes counter and the pending dirty bytes counter. Various other methods, systems, and computer-readable media are also disclosed.