Abstract: A Bayesian spam filter determines an amount of content in incoming email messages that it knows from training. If the filter is familiar with a threshold amount of the content, then the filter proceeds to classify the email message as being spam or legitimate. On the other hand, if not enough of the words in the email are known to the filter from training, then the filter cannot accurately determine whether or not the message is spam. In this case, the filter classifies the message as being of type unknown. Different threshold metrics can be used, such as the percentage of known words, and the percentage of maximum correction value used during processing. This greatly improves the processing of emails in languages on which the filter was not trained.

Abstract: System and method for exporting single-instance data. A computer system includes a host configured to select a dataset having a first attribute and convey a request to a catalog to export the dataset. The first attribute is a data selection identifying a source of the dataset and a point in time at which data objects were sent from the data selection to the single-instance storage pool. The catalog identifies data objects whose attributes match the first attribute and conveys a request to a single-instance storage pool to retrieve the data objects. In response, the single-instance storage pool associates data segments with each of the data objects, re-assembles each of the data objects from its associated data segments, and conveys the re-assembled data objects to the catalog. The catalog converts the received re-assembled data objects into the dataset.

Abstract: A method includes determining if an attempt to recreate a requested resource is made, and, if so, if the requested resource is a suspicious resource. If the requested resource is a suspicious resource, identification of an originating process is made. A determination is made if the originating process is a non-trusted originating process or a trusted originating process. If the originating process is the non-trusted originating process, a protective action is taken. In this manner, self-repairing and persistent malicious code is identified and removed with minimal adverse impact on system functionality.

Abstract: A system for space-optimized backup set conversion may include a backup converter and a first sequence of backup images of a data source. Each backup image may be of a particular backup image type, such as a full image, a differential image, or an incremental image. The backup converter may be configured to convert the first sequence of backup images into a second sequence of backup images by converting a particular backup image of the first sequence into a transformed backup image of a different backup type. For example, a full image may be converted into either a differential image or an incremental image, and a differential image may be converted into an incremental image.

Abstract: A system and method for storing data. In one embodiment, a file system includes a hierarchy of nodes partitioned into a plurality of containers. The file system further includes metadata associated with each node. First metadata describes each node's references to other nodes and second metadata identifies each node's parent node. The file system further includes a linkage table associated with each container. Each linkage table comprises entries describing links between a node owned by the associated container and other nodes. In response to detecting that a file system error has occurred, the file system identifies a container which corresponds to the detected error, corrects inconsistencies between the first and second metadata associated with each node owned by the container, and corrects inconsistencies between each of the entries of the linkage table associated with the identified container and the first and second metadata.

Abstract: In one embodiment, a computer accessible medium comprises a plurality of instructions which, when executed and if a computer system comprises at least one virtual hardware device, identify the virtual hardware device and a corresponding physical hardware device. The plurality of instructions also capture a device driver associated with the physical hardware device for use as the device driver in an install of an operating system on a second computer system having a same type of physical hardware device. Corresponding computer systems and methods are also described.

Abstract: A system for dynamic tagging of network data based on service level objectives comprises one or more processors and memory coupled to the processors. The memory comprises program instructions executable by the processors to identify a service level objective associated with a particular task that comprises a transmission of data packets over a network on behalf of an application, where the network includes one or more devices (such as routers, switches, etc.) configured to provide different levels of service to data packets based at least in part on service level indicators included within the packets. The instructions are executable to dynamically generate service level indicators corresponding to the identified service level objectives for inclusion in the data packets of the task, and to transmit the packets including the service level indicators into the network.

Abstract: A computer-implemented method for using geo-location information in sensitive Internet transactions is disclosed. In one example, such a method may include: 1) receiving, from a client device, a request to conduct an Internet transaction, 2) requiring geo-location information from the client device in order to conduct the Internet transaction, 3) receiving the geo-location information from the client device, 4) verifying the validity of the geo-location information, and then 5) conducting the Internet transaction. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method, system, computer program product and/or computer readable medium of instructions for detecting if a processing system has been compromised with audio/visual threat. The method comprises steps of intercepting one or more requests to perform an activity associated with an audio and/or visual communication device of the processing system; and performing a behavioural analysis of the processing system to determine if the processing system exhibits behavioural characteristics indicative of the processing system having been compromised with an audio/visual threat.

Abstract: User account control (such as the UAC component of Windows Vista) is extended to enable users to allow their decisions on how to respond to managed events to be applied to equivalent events for groups, without any further prompting. When a managed event first occurs, the user is presented with an extended dialog prompting for input not only on whether to allow the event for just the user, but also on whether to allow the event for any groups the user manages. Managed groups can comprise all of the user's computers, or multiple user accounts the user manages. The user's response to the prompt and information concerning the managed event are stored. Matching events within a group context are recognized, and appropriate stored responses are automatically applied, without any additional user prompting.

Abstract: To prevent attackers from logging-in with modified passwords, backup copies of passwords are created and stored. At boot time, the stored passwords are compared to the corresponding backup copies to ensure that they have not been modified. This is done during the boot cycle before the attacker is able to login to the computer. If any passwords have been modified, they are replaced with backup copies, thereby preventing the attacker from logging-in with a modified password.

Abstract: A system and method for data storage in an array. A system includes a client coupled to a storage subsystem including data storage locations addressable as rows and columns in an array. Each column comprises a separate storage device. Each row includes redundant data. For a given row, a coordinating storage device coordinates the computation and storage of redundant data. The system detects a failure of a storage region and in response, configures an overlay storage device to temporarily overlay the failed region, maintains an association between the overlay device and the failed region, and maintains a record of changes made to the overlay device while the region is in a failed state. In response to detecting that the failed region has been restored, the system uses the association to identify the overlay device and uses the record of changes made to the overlay device to resynchronize the failed region.

Abstract: A method, system, and computer-readable storage medium are disclosed for sharing non-distributed, random-access storage resources among a plurality of computer systems. A first backup or restore operation may be initiated. In response to initiation of the first backup or restore operation, a volume of a random-access storage device may be automatically mounted at a first computer system. The random-access storage device may be coupled to the first computer system by a network, and the volume may store a non-distributed file system. The first backup or restore operation may be completed by transmitting a first set of data between the random-access storage device and the first computer system. In response to completion of the first backup or restore operation, the volume of the random-access storage device may be automatically unmounted at the first computer system.

Abstract: A method and system for a character-based document comparison are described. In one embodiment, the method includes receiving an email message and determining a level of noise present in the message. The level of noise present in the email message is then utilized to determine whether the message is indicative of spam.

Abstract: A method to provide user interfaces for multi-locale context-aware systems management problem analysis comprises receiving a request for information associated with a systems management event, dynamically identifying a first locale designation associated with a first user of a systems management tool and a second locale designation associated with a second user of the systems management tool, and the systems management tool concurrently displaying the information according to the first and second locale designations.

Abstract: A server node can monitor the status of servers in a server cluster. The node may receive an alert indicating that a server in the server cluster is unavailable. In response to the alert, the node can send instructions that cause pending remote procedure call requests to be canceled and then reissued to another server in the server cluster instead of to the first server.

Abstract: Systems and methods for information storage replication are presented. In one embodiment a replication method includes performing an intelligent synchronization process of selected portions of a primary image and intelligent verification of the accuracy of the replication. The intelligent synchronization process can include forwarding information if the information is in use (e.g., has been altered, written to, etc.) and the intelligent verification can be performed on the information in use.

Abstract: Prior to overwriting a block of data in a first volume of data on a primary host, the block of data is written to a first snapshot of the first volume. Subsequently, the first snapshot can be synchronized with a snapshot of a second volume of data on a secondary host, where the second volume is a replica of the first volume. To synchronize the snapshots, only a portion of the first snapshot (e.g., the block of data that was written to the first snapshot) is sent to the secondary host.

Abstract: Systems and methods for process flow tracking are presented. In one embodiment, a flow method comprises collecting records associated with flow for post analysis; performing a flow connection process associated with the flow, wherein the flow connection process examines information in a hash table and connects flow segments based upon connect ID; and performing a presentation process in which the flow is visualized, searched and traversed. In one exemplary implementation, a flow connection process utilizes a hash table that draws a correlation between the connect ID and a connect-start record or a connect-end record.

Abstract: A method for identifying data for relocation in a multivolume file system. The method includes generating a file location map, the file location map containing a list of the locations of files that occupy space on each of a plurality of volumes of the file system, wherein The file system comprising least a first volume and a second volume. The method further includes updating the file location map in accordance with changes in a file change log for the file system, and identifying data residing on the first volume of the file system by scanning the file location map. Using the identified data, a ratio of per-file activity during a first time period relative to overall file system activity over a second time period is calculated to derive a file activity ratio for each of the files of the identified data. Files are then selected for relocation based on the file activity ratio.