Abstract: An efficient distributed transaction protocol for a distributed file sharing system is described. One embodiment of the protocol involves a transaction coordinator node sending three messages to participant nodes, where the participant nodes reply to only two of those messages. In one embodiment, the transaction coordinator node may return success to the client application after receiving replies to the second message from the participant nodes. The protocol may provide benefits associated with traditional three-phase commit (3PC) protocols while also decreasing response time latencies experienced by client applications and decreasing network traffic.

Abstract: A method and apparatus for storing, in a fault tolerant manner, checkpoint data in backup servers. To facilitate fault tolerance, the checkpoint data produced by a production server is distributed to a plurality of backup servers. In one embodiment, the method subsegments each segment of checkpoint data, produces parity data for parity groups of the subsegmented checkpoint data, and stripes the subsegments and the parity data across a number of backup servers within a server cluster.

Abstract: A system using consistent virtual addresses to communicate in cooperative multi-layer virtualization environments includes a volume server, one or more physical storage devices, a front-end layer and a back-end layer of virtualization participants. The volume server may be configured to aggregate storage in the one or more physical storage devices into a logical volume, and to provide configuration information on the logical volume to a front-end virtualization participant and to a back-end virtualization participant. The front-end virtualization participant may be configured to send a storage request including a target virtual address identifying a block of the logical volume to the back-end virtualization participant. The back-end virtualization participant may be configured to use the configuration information to identify a physical data block at a physical storage device corresponding to the target virtual address, and to perform a physical I/O operation on the physical data block.

Abstract: Computer-implemented methods, apparati, and computer-readable media for detecting the presence of viral infections in target files (10) located within a computer. The invention has broad applicability to a number of different platforms, including Windows.

Abstract: In some embodiments, during a restore operation, a restore program executes in a restore environment on the restore system. The restore program may create a client environment to which a backed up client may be restored, which may include one or more client volumes. The restore program may create a directory structure to restore shadow copy component files, and may mount one or more of the client volumes to the directory structure. The shadow copy component files may be restored to the restore volume(s), and the files restored to directories that are beneath a mount point in the directory structure are restored, through the mount, to the client volume(s).

Abstract: A data backup system can be operable to determine whether to send a data file segment to backup storage. The data backup system can comprise a comparator operable to compare a boundary parameter of a candidate segment proposed for sending to backup storage to a boundary parameter of a previously stored segment to determine whether the candidate segment potentially corresponds to the previously stored segment. The data backup system can also comprise a comparator operable, if it is determined that the candidate segment potentially corresponds to the previously stored segment, to compare a checksum value for the candidate segment to a checksum value for the previously stored segment to determine whether the candidate segment has previously been stored to the second location. A storage engine can be provided to send to backup storage a segment determined not to have previously been stored.

Abstract: In an authentication system, a first computer system provides a desired service and a second computer system provides a dialog-based interactive protocol service (e.g., an instant messaging service). Users of a second computer system can be authenticated by the first system using a mechanism separate from the dialog based interactive protocol system, so the users can then access the first system using the dialog based interactive protocol systems (even though the systems are not owned or necessarily trusted by the first system). The authentication system enables communication between the first and second computer systems by establishing the dialog session between the computer systems and transmitting to the second computer system a link to a site used to authenticate this computer system. The authentication system associates authentication information (e.g., a unique identifier and/or an authorization token, etc.

Abstract: Detecting network proxies through the observation of symmetric relationships is disclosed. Network transmission data is analyzed to detect symmetric relationships between network data transmissions. A symmetric relationship is detected with respect to a first network data transmission sent by a first node to a second node if the second node is observed to send or have sent to a third node a second network data transmission that satisfies a prescribed first criterion that it is anticipated the second network data transmission would satisfy if it were used to forward to the third node at least part of the data comprising the first network data transmission. For each symmetric relationship found, further analysis is performed to determine if the second node is configured to serve as a proxy.

Abstract: A method and apparatus for creating predictive filters for messages. In one embodiment, filter information is coupled to a reputation database. One or more filters for a message feature are generated if a reputation of the message feature is associated with one or more portions of the filter information. In one embodiment, SPAM filters are generated. In yet another embodiment, one or more message features are tested using heuristics. One or more message features are blacklisted based on a determination of the heuristics. One or more additional message filters are generated if a reputation of the message feature is associated with a blacklisted feature.

Abstract: Techniques for parsing electronic files are disclosed. In one particular exemplary embodiment, the techniques may be realized as an apparatus for parsing electronic files comprising an input module operable to read one or more electronic files, a syntax element store, associated with one or more syntax elements, a mutation module operable to mutate one or more of the one or more syntax elements and parse the one or more electronic files read from the input module, and an output module operable to create one or more normalized electronic files from the one or more parsed electronic files.

Abstract: Techniques for intelligent content indexing are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for performing intelligent content indexing comprising indexing by one or more processes associated with a client an initial full set of data of the client to create an index of the client data, detecting a change in the client data, and modifying the index to reflect the change in the client data.

Abstract: A method and apparatus for defining the scope of a search is described. In one embodiment, user input is received, and the scope is defined, based on the user input, for a search of free-form text for information from any random rows within a tabular structure of source data. In one embodiment, the search is intended for finding, in the free-form text, a sub-set of data fragments that matches information from any single row within the tabular structure of the source data.

Abstract: A system uses automatic feedback and control to secure a network infrastructure by iterative convergence of the network's security structure to meet a security policy. Following initialization, a security feedback control system of the security management system makes dynamic adjustments to the system using bi-directional services that are controlled via policy decision components, without user intervention.

Abstract: A method for performing data backup operations may involve copying data to be archived from a source system and copying file properties from the source system. The file properties may include archiving properties for at least one data file among the copied data. The data file may then be archived in accordance with the archiving properties. The copied data may be copied from a first host onto a second host. The file properties may also be copied from the first host onto the second host. The file properties may be stored as file attributes or metadata on the source system and may be copied to an archiving server along with the file. Additionally, a method for performing off-host processing of data may involve copying data to be processed from a source system, copying processing instructions from the source system and processing the copied data according to the copied processing instructions.

Abstract: Inbound and outbound traffic on a computer system are intercepted and compared to determine if the presence of malicious code is indicated. Outbound traffic that is sufficiently similar to recently received inbound traffic is indicative of the presence of malicious code. In some embodiments, if the presence of malicious code is indicated, the user, as well as other individuals or systems, are notified of the detection. In some embodiments, if desired, protective actions are initiated to hinder or block the propagation of the malicious code from the host computer system to other computer systems, as well as to remove or inactivate the malicious code on the host computer system.

Abstract: Systems, methods, apparatus and software can be implemented to discover third-party copy devices in a distributed computing environment, determine which of the third-party copy devices is best suited for a particular data moving application, and thereby better utilize network and computing system resources. Moreover, environment changes (e.g., device failure, network traffic changes, new device addition) can be dynamically incorporated into the information used for third-party copy device discovery and selection. These systems, methods, apparatus and software help to reduce human errors which can cause failures in critical data protection operations.

Abstract: Moving backup data within a storage hierarchy based on a calculated uniqueness of the backup data and on the estimated significance of at least a portion of the backup data. More unique and significant backup data would tend to have higher availability levels. Conversely, less unique and significant backup data would tend to have lower availability levels, or may even cause the backup data to be deleted.

Abstract: Systems, methods, and computer readable media for determining whether a computer file (210) has been infected with malicious code by an attacking agent. A scanning engine (205) determines whether the file (210) contains malicious code. The scanning engine (205) includes detection modules (325) for detecting particular attacking agents, and indicators of when particular attacking agents were first created. The scanning engine (205) determines a critical date for a file (210) with regards to a particular attacking agent. If the file (210) has not been changed since the critical date, the scanning engine (205) determines that the file (210) has not been infected by that attacking agent.

Abstract: One goal of consistency interval replication is to achieve a consistent copy of data generated by independent streams of writes from nodes in a clustered/distributed environment. Two writes to the same block from different nodes may arrive at a replication target in a different order from the order in which they were written to primary storage. A consistency interval coordinator may analyze a list of blocks modified during a consistency interval to determine conflict blocks written to by two different nodes during the same consistency interval. Conflict resolution may involve a node reading data for a conflict block from primary storage and forwarding it to the replication target or a node completing a suspended in-progress write for the conflict block. Once the conflicts have been resolved, the replication target may checkpoint the data modified during the interval and nodes may resume writes to the conflict blocks for the new interval.

Abstract: A rollback manager creates a restore point on a computer. The rollback manager stores a reboot indicator in non-revertible storage. The rollback manager monitors the reboot indicator to detect an unexpected reboot during deployment of a modification. The rollback manager configures the computer responsive to the reboot indicator. The rollback manager can roll back the system state, responsive to detecting a failed modification deployment. The rollback manager can deem the computer to be stable, responsive to detecting a successful modification deployment.