Abstract: A computer-implemented method may include identifying a file that includes one or more data blocks stored within a storage device. The computer-implemented method may also include determining that the file has been accessed more frequently than one or more other files stored within the storage device and then tracking the number of times that at least one data block associated with the file is accessed in the storage device. The computer-implemented method may further include determining that the number of times that the data block associated with the file has been accessed in the storage device is above a predetermined threshold. In addition, the computer-implemented method may include caching the data block associated with the file in a caching mechanism to decrease the amount of time required to access the data block. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method and apparatus for notifying a recipient of a threat within previously communicated data is described. In one embodiment, network activity amongst at least two computer is analyzed to determine a threat communicated to a computer of the at least two computers. Furthermore, the computer is notified as to the previous communication of the threat.

Abstract: A process for reading entries in a directory is initiated. A first index is maintained to indicate how far the read has progressed in the directory. If, during execution of the process, the directory is partitioned into subdirectories, then a second index is maintained for each of the subdirectories to indicate how far the read has progressed in each of the subdirectories. A third index that indicates how far the read has progressed in the partitioned directory is also maintained.

Abstract: A system and method for passing data access information to a disk array are provided. Data access statistics are received from a first source. Thereafter, a determination is made as to whether such data access statistics are to be included in a list of data access statistics. A frequency analysis is then performed by a disk array using the list of data access statistics. An assignment of data to storage blocks within the disk array is then made according to results of the frequency analysis.

Abstract: A method for identifying data for relocation in a multivolume file system. The method includes generating a file location map, the file location map containing a list of the locations of files that occupy space on each of a plurality of volumes of the file system, wherein The file system comprising least a first volume and a second volume. The method further includes updating the file location map in accordance with changes in a file change log for the file system, and identifying data residing on the first volume of the file system by scanning the file location map. Using the identified data, a ratio of per-file activity during a first time period relative to overall file system activity over a second time period is calculated to derive a file activity ratio for each of the files of the identified data. Files are then selected for relocation based on the file activity ratio.

Abstract: A method of updating a link count in a partitioned directory shared by a plurality of computers within a cluster. The partitioned directory is traversed once by a first computer to obtain a link count. The link count is stored in the first computer and broadcast to a cluster of computers. A total number of allocated links is less than a maximum limit on link count minus the link count. A respective number of links is allocated to each computer within the cluster. Delta values of each computer are updated in real-time as subdirectories are created/erased. A delta value associated with each of the plurality of computers is received. A delta value represents a net number of links created or removed by each computer. The link count is updated based on the previous link count and further based on each of the delta values and further based a delta value associated with the first computer. The updated link count is stored by the first computer and broadcast to the plurality of computers.

Abstract: A method for information flow tracking is provided using, for example, a functional programming language based on lambda calculus, ?I. The method provides a unified information-tracking framework that supports multiple, interdependent dimensions of information. An expressive policy-specification system is separated from the underlying information-flow tracking mechanism. Arbitrary domain-specific policies are supported that can be developed and enforced independent of information flow tracking. Information-flow metadata is treated as a first-class entity, and information flow is correctly tracked on the metadata itself. Classes of information flow polices are defined using multiple dimensions that are application to both information flow data and to the information flows themselves. These classes of polices accurately model more realistic security policies, based on partial trust relations.

Abstract: Various systems and methods generate access control policies. For example, one method can receive attribute information regarding a computer user. The method can compare the attribute information with access control information and select a value of an access restriction based on a result of the comparing. The access restriction indicates whether a computer resource can be accessed or not. The method then generates an access control policy that includes the value of the access restriction.

Abstract: A region of memory is logically divided into a number of segments, each of which is logically divided into a number of blocks. Blocks are allocated sequentially. A head pointer and a tail pointer demarcate the section of allocated blocks. As allocated blocks are added, the tail pointer is moved so that it remains at the end of the section of allocated blocks. If the tail pointer is within a threshold distance of the head pointer, then the head pointer is moved from its current position to a new position, and the allocated blocks between the current and new positions are freed (deallocated and/or erased). Thus, writes to the memory can be performed sequentially, and blocks can be freed in advance of when they are actually needed.

Abstract: A mechanism to identify data that can be removed from a solid state drive (SSD) cache by determining a least recently accessed memory region of the SSD is provided. This functionality is provided by using a tree data structure to store a table mapping storage volume data locations to SSD data locations and associating a time stamp with each entry. The time stamp is updated with each access to the associated SSD location. Advantages of the tree data structure are utilized to efficiently determine an SSD memory location associated with an oldest time stamp in order to make that SSD memory location available for storage of recently accessed data from the storage volume.

Abstract: A computer-implemented method for data-loss prevention may include: 1) identifying data associated with a user, 2) determining that the data is subject to a data-loss-prevention scan, 3) identifying a data-loss-prevention reputation associated with the user, and then 4) performing a data-loss-prevention operation based at least in part on the data-loss-prevention reputation associated with the user. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: A method, in one embodiment, can include determining whether an administrative task for a file system is to be performed within a thin storage memory array. Furthermore, if the administrative task for the file system is to be performed, a determination is made as to whether memory space is freed up while performing the administrative task. If memory space is freed up while performing the administrative task, a determination is made as to whether the freed up memory space satisfies a predefined contiguous memory space threshold. If the predefined contiguous memory space threshold is satisfied by the freed up memory space, a determination is made as to whether a memory space reclamation process is to be performed. If the memory space reclamation process is to be performed, the freed up memory space is reclaimed from the file system.

Abstract: A method of reading data from a partitioned directory incident to a serialized process. A first read and an offset value are received. A first data block in a modeled fully partitioned directory is identified based on the offset value and a predetermined number of entries associated with a buffer. It is determined whether the first data block in the fully partitioned directory is present in the actual partitioned directory. Zeros are written in the buffer if the first data block in the fully partitioned directory is not present in the actual partitioned directory otherwise the first data block associated with the actual partitioned directory is written to the buffer. A second data block is similarly read by a second read operation and written. The second data block is associated with a second subdirectory, selected based on a horizontal node traversal at a node level of said first subdirectory.

Abstract: A method of reading data from a partitioned directory incident to a serialized process. A first read and an offset value are received. A first data block in a modeled fully partitioned directory is identified based on the offset value and a predetermined number of entries associated with a buffer. It is determined whether the first data block in the fully partitioned directory is present in the actual partitioned directory. Zeros are written in the buffer if the first data block in the fully partitioned directory is not present in the actual partitioned directory otherwise the first data block associated with the actual partitioned directory is written to the buffer. A second data block is similarly read by a second read operation and written. The second data block is associated with a second subdirectory, selected based on a horizontal node traversal at a node level of said first subdirectory.

Abstract: A method of maintaining and providing information relating to file deduplication. A first portion of a first file and a second portion of a second file that contain a first content are identified. A first header associated with the first portion is created. The first header identifies the first portion and the second portion containing the first content. The first header is appended to a storage location of the first content of the first portion to form a first data structure for the first file. The first data structure is stored. The first data structure is provided to an application requesting the first file so that duplicate data processing can be avoided by the application. The first data structure is updated when the first file or the second file are altered. A similar process may occur to generate a data structure for the second file.

Abstract: A mechanism is provided for identifying data that can be removed from a cache memory by determining a memory region of the cache that is less recently accessed than other memory regions in the cache. A tree data structure is used to store a mapping of storage volume data locations to cache data locations. A counter reflecting recency of access to the cache data location is associated with each entry. The counter is incremented, along with counters associated with keys leading to a node including the entry, with each access to the associated cache memory location, while other counters in each affected node are decremented. Advantages of the tree data structure are used to efficiently locate a cache memory location associated with a counter reflecting a less recently accessed state in order to make that cache memory location available for storage of recently accessed data from the storage volume.

Abstract: A method and apparatus for providing information to mitigate a current failure in a datacenter is described. The method comprises processing historical data regarding at least one failure. The historical data includes at least one action related to the at least one failure. The method further includes determining information for mitigating the current failure based on the historical data.

Abstract: A process for reading entries in a directory is initiated. A first index is maintained to indicate how far the read has progressed in the directory. If, during execution of the process, the directory is partitioned into subdirectories, then a second index is maintained for each of the subdirectories to indicate how far the read has progressed in each of the subdirectories. A third index that indicates how far the read has progressed in the partitioned directory is also maintained.

Abstract: A method of partitioning directory. Accesses, e.g., shared/exclusive, and/or waiting requests, e.g., shared/exclusive, to access one or more files with a directory are monitored, e.g., incrementing/decrementing respective counters. The waiting requests are queued to be granted at a later time. The directory is determined to be primed for partitioning if a number of waiting requests to access the directory is greater than a threshold value of a plurality of heuristics and optionally further based on satisfying the condition for at least a programmable time threshold period. A trigger signal is automatically generated if the directory is primed for partitioning. The trigger signal causes a file system to partition the directory. It is appreciated that the plurality of heuristics is user programmable.

Abstract: A method of updating a link count in a partitioned directory shared by a plurality of computers within a cluster. The partitioned directory is traversed once by a first computer to obtain a link count. The link count is stored in the first computer and broadcast to a cluster of computers. A total number of allocated links is less than a maximum limit on link count minus the link count. A respective number of links is allocated to each computer within the cluster. Delta values of each computer are updated in real-time as subdirectories are created/erased. A delta value associated with each of the plurality of computers is received. A delta value represents a net number of links created or removed by each computer. The link count is updated based on the previous link count and further based on each of the delta values and further based a delta value associated with the first computer. The updated link count is stored by the first computer and broadcast to the plurality of computers.