Abstract: Disclosed is a first device and a second device each sending BFD echo request packets in an initial stage of establishing communication between the two devices. A method can include determining that a certain mode is detected, such as a low bandwidth mode. The method can be practiced by one or both of the devices or a separate network controller. Based on the detection of the certain mode or the communication link being in a certain mode, the method includes the first device or the second device electing to be a master or a slave. Upon establishing that one of the devices is the master and the other of the devices is a slave, only the master will send BFD echo request packets.

Abstract: Embodiments provide methods and systems for removing temporal biases in classification tasks. Method performed by server system includes accessing a transaction graph associated with a particular time duration and determining a set of local features and aggregate features associated with each node based on labeled data. Method includes generating via a machine learning model, a set of intermediate node representations associated with each of the plurality of nodes based on the set of local features and the set of aggregate features. Method includes generating via a fraud model and a timestep model, a fraud classification loss, and a timestep classification loss based on the set of intermediate node representations. Method includes determining an adversarial loss value based on the fraud classification loss and the timestep classification loss. Method includes determining a set of optimized parameters for the machine learning model based on the adversarial loss value.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: Metadata associated with content stored in a corresponding primary storage system is received receiving from each secondary storage cluster of a plurality of different secondary storage clusters included in different storage domains. The metadata received from the plurality of different secondary storage clusters is stored and indexed together. A unified metadata search interface is provided for stored data of the corresponding primary storage systems and the plurality of different secondary storage clusters of the different storage domains.

Abstract: Embodiments provide methods and systems for identifying a re-routed transaction. Method performed by processor includes retrieving a plurality of transaction windows from a transaction database. Each transaction window includes a transaction declined under a restricted MCC. The method includes accessing a plurality of features associated with each transaction of each transaction window from the transaction database. The method includes predicting an output dataset of a plurality of reconstructed transaction windows based on feeding the input dataset to a trained neural network model. The method includes computing a corresponding reconstruction loss value for each transaction of each transaction window. The method includes comparing the corresponding reconstruction loss value for each transaction with a pre-determined threshold value.

Abstract: An indication to store to a remote storage a new archive of a snapshot of a source storage is received. At least one shared data chunk of the new archive is determined to be already stored in an existing chunk object of the remote storage storing data chunks of a previous archive. One or more evaluation metrics for the existing chunk object are determined based at least in part on a retention period associated with one or more individual chunks stored in the chunk object and a data lock period associated with the entire existing chunk object. It is determined based on the one or more evaluation metrics whether to reference the at least one shared data chunk of the new archive from the existing chunk object or store the at least one shared data chunk in a new chunk object of the remote storage.

Abstract: A first archive of a first snapshot of a source storage is caused to be stored to a remote storage. At least a portion of content of the first archive is stored in data chunks stored in a first chunk object of the remote storage and the first archive is associated with a first data policy. A second archive of a second snapshot of the source storage is caused to be stored to the remote storage. At least a portion of content of the second archive is referenced from data chunks stored in the first chunk object and the second archive is associated with a second data policy. Policy compliance of the chunk object storing data chunks referenced by the first archive and the second archive that are different is automatically managed based on the first data policy and the second data policy that are different.

Abstract: Data chunks sent to a content destination are tracked. It is determined whether content of a portion of an object to be sent to the content destination matches one of the data chunks previously sent to the content destination. In response to the determination that the portion of the object to be sent to the content destination matches one of the data chunks previously sent to the content destination, a source reference to the matching previously sent data chunk where the content destination can locally obtain the content for the portion of the object is provided to the content destination.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed outside of the first host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that a hidden process exists and corrective action can be taken.

Abstract: Data is ingested from a source system including by storing a plurality of data chunks in one or more chunk files and storing corresponding chunk identifiers associated with the plurality of data chunks in a first data structure. After data ingestion is complete, one or more duplicate data chunks that were stored during the data ingestion are determined and a second data structure is updated to include one or more entries corresponding to one or more determined duplicate data chunks.

Abstract: An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.

Abstract: According to certain embodiments, a system comprises one or more processors and one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations comprising: receiving location data associated with a plurality of remote users accessing one or more existing remote access gateways that are located at one or more network locations; building a heatmap of user locations based at least in part on the received location data; and identifying, from the heatmap of user locations, at least one new network location in which to generate at least one new remote access gateway, or at least one existing network location in which to remove at least one of the existing remote access gateways.

Abstract: A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

Abstract: Metadata associated with content stored in a corresponding primary storage system is received receiving from each secondary storage cluster of a plurality of different secondary storage clusters included in different storage domains. The metadata received from the plurality of different secondary storage clusters is stored and indexed together. A unified metadata search interface is provided for stored data of the corresponding primary storage systems and the plurality of different secondary storage clusters of the different storage domains.

Abstract: An example method includes detecting, using sensors, packets throughout a datacenter. The sensors can then send packet logs to various collectors which can then identify and summarize data flows in the datacenter. The collectors can then send flow logs to an analytics module which can identify the status of the datacenter and detect an attack.

Abstract: Cluster state information is generated in response to a request to establish a connection with a cloud service system. The cluster state information includes a first instance of a security token and host information. The cluster state information is provided to a web browser associated with a user. The web browser associated with the user is redirected to a cloud identity provider. The cloud identity provider is configured to provide to the cloud service system via the web browser associated with the user, the cluster state information that includes the first instance of the security token and the host information. A certificate is requested from the cloud service system. The cluster state information that includes a second instance of the security token is provided to the cloud service system. The cloud service system is configured to establish the connection based on comparison between the first instance of the security token and the second instance of the security token.

Abstract: An approach for establishing a priority ranking for endpoints in a network. This can be useful when triaging endpoints after an endpoint becomes compromised. Ensuring that the most critical and vulnerable endpoints are triaged first can help maintain network stability and mitigate damage to endpoints in the network after an endpoint is compromised. The present technology involves determining a criticality ranking and a secondary value for a first endpoint in a datacenter. The criticality ranking and secondary value can be combined to form priority ranking for the first endpoint which can then be compared to a priority ranking for a second endpoint to determine if the first endpoint or the second endpoint should be triaged first.

Abstract: A request to delete a directory from a storage is received. The directory is unlinked from a parent metadata object. A success confirmation that the directory is unlinked from the parent metadata object is provided. After the success confirmation is provided, one or more metadata objects of the directory are marked for deletion, and the one or more marked metadata objects and at least one of their descendant metadata objects are identified and deleted.

Abstract: Systems, methods, and computer-readable media for managing compromised sensors in multi-tiered virtualized environments. In some embodiments, a system can receive, from a first capturing agent deployed in a virtualization layer of a first device, data reports generated based on traffic captured by the first capturing agent. The system can also receive, from a second capturing agent deployed in a hardware layer of a second device, data reports generated based on traffic captured by the second capturing agent. Based on the data reports, the system can determine characteristics of the traffic captured by the first capturing agent and the second capturing agent. The system can then compare the characteristics to determine a multi-layer difference in traffic characteristics. Based on the multi-layer difference in traffic characteristics, the system can determine that the first capturing agent or the second capturing agent is in a faulty state.