Abstract: Disclosed herein are systems and method for inspecting archived slices for malware. In one exemplary aspect, the method comprises identifying a first slice in a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time. The method comprises scanning the first slice of the plurality of slices in the backup archive and detecting at least one infected file in the first slice. The method comprises identifying a block of the first slice that corresponds to the at least one infected file. The method comprises mounting, to a disk, a second slice of the plurality of slices. The method comprises tracking the block and determining that the at least one infected file exists on the second slice and removing the infected file from the second slice by generating a respective cured slice of the second slice.

Abstract: Disclosed are systems and methods restoring a computing system. The described method includes emulating a virtual disk using a backup of the computing device and generating an ancillary virtual machine (VM). The method includes determining and writing, to a delta disk linked to the virtual disk, configuration modifications to the ancillary VM that enable booting of the ancillary VM using the virtual disk on a different device with dissimilar hardware as the computing device. Responsive to receiving a request to perform recovery of the computing device, the method comprises restoring the backup by creating on the different device a recovery virtual machine (VM) having a base virtual disk emulated from the backup, and modifying the recovery VM by attaching the delta disk having the configuration modifications.

Abstract: Disclosed herein are systems and method for providing agentless security of virtual machines. In one aspect, the method intercepts, by a virtual switch filtering extension of an extensible virtual switch on a host processor, a data packet in an outbound transmission from a virtual machine to a destination device. The method blocks, by the virtual switch filtering extension, transmission of the data packet from the virtual machine to the destination device based on determining non-compliance with a set of predefined rules of the first virtual machine. The method generates a first event indicative of the blocking and creates a filtering log comprising a list of events, filtered by the virtual switch filtering extension, including the first event. The filtering log is either transmitted or cached based on whether accessibility is available to a management service database.

Abstract: Disclosed herein are systems and method for multiplexing data of an underlying index. In an exemplary aspect, an index handler may: search for a data file in a plurality of data buckets associated with an index, wherein at least one respective data bucket of a plurality of data buckets is attached to a respective slot of a plurality of slots; identify, based on the searching, a first data bucket of the plurality of data buckets that comprises the data file; in response to determining that the first data bucket is not attached to any of the plurality of slots, attach the first data bucket to a first slot of the plurality of slots; and enable access to the data file via the first data bucket attached to the first slot.

Abstract: Disclosed herein are systems and methods for protecting user data. In one aspect, an exemplary method comprises, by a hardware processor, detecting one or more user files, created by a user, that are on a user device; generating user transactional data associated with one or more detected network-based interactions with a service provider by the user, and user behavior data based on one or more user interactions with a graphical user interface of the user device by the user; generating a user classification using a machine learning model that classifies the user based on the one or more user files, the user transactional data, and the user behavior data; and when the user is identifiable based on the user classification, modifying at least one of the one or more user files stored on the user device and user behavior of the user during an operation of the user device.

Abstract: Disclosed herein are systems and method for determining data storage insurance policies. In an exemplary implementation, a method comprises receiving a request to add a data storage insurance policy to a plurality of data files. The method comprises extracting data file attributes and determining a data recovery score for each respective data file based on a uniqueness, criticality, and/or importance of the respective data file. The method comprises determining a hardware score for each of a plurality of performance tiers comprising at least one storage server, based on an available capacity, a performance cost, and/or data recovery scores of data files currently stored at each of the plurality of performance tiers. The method comprises selecting and executing a data storage insurance policy for the respective data file based on a plurality of data recovery rules and/or the comparison of the data recovery score and the hardware score.

Abstract: Disclosed herein are systems and methods for classifying organizational structure for implementing data protection policies. In one exemplary aspect, a method may comprise retrieving a plurality of data files of an organization, wherein the plurality of data files are stored in a data storage; retrieving structural information of the organization, the structural information comprising details of user accounts, organizational roles, and file metadata within the organization; classifying the structural information into an organization type of a plurality of organization types; classifying each respective data file of the plurality of data files into a respective topic of a plurality of topics, wherein the plurality of topics are associated with the organization type; generating a data protection policy for the organization based on each respective topic of the plurality of data files and the organization type; and executing the data protection policy on the data storage.

Abstract: Disclosed herein are systems and methods for parallel malware scanning in a cloud environment. In one exemplary aspect, a method may comprise identifying a plurality of agents connected to a server, wherein each agent is configured to synchronize data between a different computing device and the server. The method may comprise receiving, from a first agent of the plurality of agents, a request to scan the synchronized data for malware. In response to determining, from the plurality of agents, at least one other agent that comprises the synchronized data, the method may comprise partitioning the synchronized data into a plurality of portions. The method may comprise assigning a first portion for scanning to the first agent and at least one other portion for scanning to the at least one other agent, and aggregating scan results from the first agent and the at least one other agent.

Abstract: Disclosed herein are systems and methods for dynamic job performance in secure multiparty computation (SMPC). The method may comprise receiving an SMPC query that indicates a processing job to be performed on a data input. The method may split the data input to generate a plurality of partial data inputs, based on parameters and the query type of the SMPC query. The method may generate a plurality of jobs to perform on the plurality of partial data inputs and determine a combined result of the processing job. The method may adjust the amount of worker processes in a worker pool based on at least one of: required computation, time of day, date, financial costs, power consumption, and available network bandwidth.

Abstract: Disclosed herein are systems and method for selectively restoring a computer system to an operational state. In an exemplary aspect, the method may create a backup image of the computer system comprising a set of data blocks, and create and start a virtual machine based on the backup image. The method may identify a subset of the data blocks accessed from the backup image during startup of the virtual machine. In response to determining that the computer system should be restored, the method may restore the subset of the data blocks such that the computer system is operational during startup, and restore a remaining set of the data blocks from the backup image after the startup of the computer system.

Abstract: Aspects of the disclosure describe methods and systems for cross-referencing forensic snapshots over time. In one exemplary aspect, a method may comprise receiving a first snapshot of a computing device at a first time and a second snapshot of the computing device at a second time and applying a pre-defined filter to the first snapshot and the second snapshot, wherein the pre-defined filter includes a list of files that are to be extracted from each snapshot. The method may comprise subsequent to applying the pre-defined filter, identifying differences in the list of files extracted from the first snapshot and the second snapshot. The method may comprise creating a change map for the computing device that comprises the differences in the list of files over a period of time, wherein the period of time comprises the first time and the second time, and outputting the change map in a user interface.

Abstract: A distributed agent for backup and restoration of virtual machines collects backup data and meta-data. The distributed agent includes an agent inside a virtual machine and an agent outside the virtual machine. The two kinds of agents communicate with each other to collect data of different types used to backup and restore virtual machines.

Abstract: Disclosed herein are systems and method for restoring a clean backup after a malware attack. In one aspect, a method forms a list of files that are of a plurality of designated file types that can be infected by malicious software. The method performs one or more snapshots of the files according to a predetermined schedule over a predetermined period of time and performs one or more backups. The method determines that a malware attack is being carried out on the computing device and generates a list of dangerous objects that spread the malware attack. The method compares the list of dangerous objects with the one or more snapshots to determine when the malware attack occurred. The method identifies a clean backup that was created most recently before the malware attack as compared to other backups and recovers data for the computing device from the clean backup.

Abstract: Disclosed herein are systems and method for detecting passwords vulnerable to compromise. In one exemplary aspect, a method comprises identifying a plurality of files in at least one storage device of an organization. For each respective file in the plurality of files, in response to determining that the respective file type is in the database of vulnerable file types, the method comprises parsing text in the respective file and identifying, for the respective file, at least one demographic associated with the organization. The method further comprises retrieving dictionaries and expressions specific to the at least one demographic and determining the text in the respective file comprises a password using the retrieved dictionaries and expressions of the at least one demographic. In response to determining that the text comprises the password, the method comprises generating a security alert for an administrator of the storage device.

Abstract: Described herein are systems and methods for controlling access to a protected resource based on various criteria. In one exemplary aspect, a method comprises designating a plurality of program data installed on a computing system as protected program data; intercepting, by a kernel mode driver, a request from an untrusted application executing on the computing system to alter at least one of the protected program data; classifying, by a self-defense service, the untrusted application as a malicious application based on the intercepted request and information related to the untrusted application; and responsive to classifying the untrusted application as a malicious application, denying, by the kernel mode driver, access to the at least one of the protected program data.

Abstract: Disclosed herein are systems and methods for continuous user authentication during access of a digital service. In an exemplary aspect, a continuous authentication module may receive, at a computing device, initial authentication credentials of the user. The initial authentication credentials enable access to a service via the computing device. While the service is being accessed, the continuous authentication module may continuously monitor whether an unauthorized user has replaced the user in accessing the service by comparing usage attributes of the service with historic usage attributes associated with the user. In response to determining that the unauthorized user has replaced the user, the continuous authentication module may cease the access to the service via the computing device.

Abstract: Disclosed herein are systems and methods for preventing anti-forensics actions. In one exemplary aspect, a method may identify a suspicious object from a plurality of objects on a computing device and monitor actions performed by the suspicious object. The method may intercept a first command by the suspicious object to create and/or modify a digital artifact on the computing device and subsequent to intercepting the first command, intercept a second command by the suspicious object to delete at least one of the suspicious object and the digital artifact. In response to intercepting both the first command to create and/or modify the digital artifact and the second command to delete at least one of the suspicious object and the digital artifact, the method may block the second command, and may store the suspicious object and the digital artifact in a digital repository.

Abstract: Disclosed herein are systems and method for backing up data in a load-balanced clustered environment. A clustered resource to be backed up is selected, wherein the clustered resource is stored on a common storage system and operated on by a cluster-aware application executing on at least a first node and a second node of a computing cluster. A load-balanced application may migrate the clustered resource from the first node with a high-load consumption to the second node with low-load consumption. A list of changes made by both nodes are received and merged. A backup agent then generates a consistent incremental backup using data retrieved from the common storage system according to the merged list of changes to the clustered resource.

Abstract: Disclosed herein are systems and method for performing recovery using a backup image. In one exemplary aspect, a method comprises scanning a plurality of files on one or more storage devices of a computing device. The method may determine a first set of files from the plurality of files that will be used during recovery of the one or more storage devices, and tag a second set of files that will not be used during recovery. The method may copy the second set of files that have been tagged to an external storage device, and may store the first set of files in a backup image for the computing device (excluding the tagged second set of files from the backup image). The method may add, to the backup image, a respective link to each of the tagged second set of files in the external storage device.

Abstract: Disclosed herein are systems and methods for pattern-based QoS violation prediction. In one exemplary aspect, a method may comprise identifying a service on a computing device that is connected to a plurality of client devices and determining a plurality of micro-services comprised in the identified service. The method may comprise parsing access information to detect that a first client device is accessing a micro-service. The method may comprise determining, for a first period of time, QoS evaluation parameters for the access between the micro-service and the first client device. The method may comprise identifying changes in the QoS evaluation parameters within the first period of time, detecting a predetermined QoS violation pattern, and executing a QoS action based on the predetermined QoS violation pattern.