Abstract: A method, comprising: executing an embedded malware detector, the embedded malware detector being executed inside a first guest operating system, the first guest operating system being executed on a storage processor that is part of a storage system, the storage processor being configured to execute one or more second guest operating systems in addition to the first guest operating system, each of the second guest operating systems being arranged to execute software for reading and/or writing data to one or more storage devices that are provided in the storage system; identifying, by the embedded malware detector, a given one of the storage devices; obtaining, by the embedded malware detector, a snapshot of the given one of the storage devices; mounting, by the embedded malware detector, the snapshot in the first guest operating system; scanning the mounted snapshot for malware.

Abstract: A method, comprising: executing an embedded malware detector, the embedded malware detector being executed inside a first guest operating system, the first guest operating system being executed on a storage processor that is part of a storage system, the storage processor being configured to execute one or more second guest operating systems in addition to the first guest operating system, each of the second guest operating systems being arranged to execute software for reading and/or writing data to one or more storage devices that are provided in the storage system; identifying, by the embedded malware detector, a given one of the storage devices; obtaining, by the embedded malware detector, a snapshot of the given one of the storage devices; mounting, by the embedded malware detector, the snapshot in the first guest operating system; scanning the mounted snapshot for malware.

Abstract: A method for restoring a data volume, comprising: receiving a request to restore the data volume; identifying a risk map that is associated with the data volume, the risk map including a plurality of entries, each entry mapping a different respective one of a plurality of snapshot identifiers to a respective risk assessment score for a snapshot corresponding to the snapshot identifier, the respective risk assessment score being generated by security software, the respective risk assessment score representing a level of threat or potential harm posed by one or more files in the data volume; identifying a risk policy that corresponds to the data volume; retrieving the risk assessment score threshold from the risk policy; performing a search of the risk map to identify a snapshot whose respective risk assessment score satisfies the risk assessment score threshold; and using the identified snapshot to restore the data volume.

Abstract: A method for use in a storage system, comprising: detecting a first event, the first event being a cyber threat (CT) event, the first event being generated, at least in part, by using security software that is executed in the storage system; in response to the CT event, identifying a secure snapshot of the storage system and performing a first modification of a retention period of the secure snapshot in response to the first event; detecting a second event, the second event being detected after the first modification is performed; and performing a second modification of the retention period in response to the second event.

Abstract: A method for restoring a data volume, comprising: receiving a request to restore the data volume; identifying a risk map that is associated with the data volume, the risk map including a plurality of entries, each entry mapping a different respective one of a plurality of snapshot identifiers to a respective risk assessment score for a snapshot corresponding to the snapshot identifier, the respective risk assessment score being generated by security software, the respective risk assessment score representing a level of threat or potential harm posed by one or more files in the data volume; identifying a risk policy that corresponds to the data volume; retrieving the risk assessment score threshold from the risk policy; performing a search of the risk map to identify a snapshot whose respective risk assessment score satisfies the risk assessment score threshold; and using the identified snapshot to restore the data volume.

Abstract: A method for use in a storage system, comprising: detecting a first event, the first event being a cyber threat (CT) event, the first event being generated, at least in part, by using security software that is executed in the storage system; in response to the CT event, identifying a secure snapshot of the storage system and performing a first modification of a retention period of the secure snapshot in response to the first event; detecting a second event, the second event being detected after the first modification is performed; and performing a second modification of the retention period in response to the second event.

Abstract: Techniques for predicting states may include: receiving data sets of counter values, wherein each counter values denotes a number of times a particular code flow point associated with the counter value is executed at runtime during a specified time period; receiving images generated from the data sets; labeling each of the images with state information, wherein first state information associated with a first image indicates that the first image is associated with a first error state of a system or an application; training a neural network using the images to recognize the first state; receiving a next image generated from another data set; and predicting, by the neural network and in accordance with the next image, whether the system or the application is expected to transition into the first state. In at least one embodiment, the foregoing processing may optionally use matrices generated from the data sets rather than images.

Abstract: Techniques for determining service levels may include receiving an I/O operation at a target port of a data storage system, where the I/O operation is sent from an initiator port of a host and directed to a storage object in a first storage group. The initiator port may be included in a first initiator group and the target port may be included in a first port group. The I/O operation may be assigned a service level using a table of a service levels specified for different triples. Each triple may identify an initiator groups, a storage group and a port group. Assigning the service level may include determining a first of the triples that matches the first storage group, the first initiator group and the first port group, wherein the first triple is associated with the service level.

Abstract: Embodiments of the present disclosure relate to load balancing application processing between storage platforms. Input/output (I/O) workloads can be anticipated during one or more time-windows. Each I/O workload can comprise one or more I/O operations corresponding to one or more applications. Processing I/O operations of each application can be dynamically migrated to one or more storage platforms of a plurality of storage platforms based on the anticipated workload.

Abstract: Techniques for determining service levels may include receiving an I/O operation at a target port of a data storage system, where the I/O operation is sent from an initiator port of a host and directed to a storage object in a first storage group. The initiator port may be included in a first initiator group and the target port may be included in a first port group. The I/O operation may be assigned a service level using a table of a service levels specified for different triples. Each triple may identify an initiator groups, a storage group and a port group. Assigning the service level may include determining a first of the triples that matches the first storage group, the first initiator group and the first port group, wherein the first triple is associated with the service level.

Abstract: Techniques for predicting states may include: receiving data sets of counter values, wherein each counter values denotes a number of times a particular code flow point associated with the counter value is executed at runtime during a specified time period; receiving images generated from the data sets; labeling each of the images with state information, wherein first state information associated with a first image indicates that the first image is associated with a first error state of a system or an application; training a neural network using the images to recognize the first state; receiving a next image generated from another data set; and predicting, by the neural network and in accordance with the next image, whether the system or the application is expected to transition into the first state. In at least one embodiment, the foregoing processing may optionally use matrices generated from the data sets rather than images.

Abstract: A method is used in managing remote replication in storage systems. The method monitors network traffic characteristics of a network. The network enables communication between a first storage system and a second storage system. The method predicts a change in at least one of an application demand of an application of a set of applications executing on the first storage server and a network state of the network, where the set of applications have been identified for performing a replication to the second storage system. Based on the prediction, the method dynamically manages replication of the set of applications in accordance with a performance target associated with each application.

Abstract: Embodiments of the present disclosure relate to load balancing application processing between storage platforms. Input/output (I/O) workloads can be anticipated during one or more time-windows. Each I/O workload can comprise one or more I/O operations corresponding to one or more applications. Processing I/O operations of each application can be dynamically migrated to one or more storage platforms of a plurality of storage platforms based on the anticipated workload.

Abstract: Techniques for processing data may include: determining a first amount denoting an amount of write pending data stored in cache to be redirected through storage class memory (SCM) when destaging cached write pending data from the cache; performing first processing that destages write pending data from the cache, the first processing including: selecting, in accordance with the first amount, a first portion of write pending data that is destaged from the cache and stored in the SCM and a second portion of write pending data that is destaged directly from the cache and stored on one or more physical storage devices providing back-end non-volatile physical storage; and subsequent to storing the first portion of write pending data to the SCM, transferring the first portion of write pending data from the SCM to the one or more physical storage devices providing back-end non-volatile physical storage.

Abstract: A method is used in managing remote replication in storage systems. The method monitors network traffic characteristics of a network. The network enables communication between a first storage system and a second storage system. The method predicts a change in at least one of an application demand of an application of a set of applications executing on the first storage server and a network state of the network, where the set of applications have been identified for performing a replication to the second storage system. Based on the prediction, the method dynamically manages replication of the set of applications in accordance with a performance target associated with each application.

Abstract: Techniques for processing data may include: determining a first amount denoting an amount of write pending data stored in cache to be redirected through storage class memory (SCM) when destaging cached write pending data from the cache; performing first processing that destages write pending data from the cache, the first processing including: selecting, in accordance with the first amount, a first portion of write pending data that is destaged from the cache and stored in the SCM and a second portion of write pending data that is destaged directly from the cache and stored on one or more physical storage devices providing back-end non-volatile physical storage; and subsequent to storing the first portion of write pending data to the SCM, transferring the first portion of write pending data from the SCM to the one or more physical storage devices providing back-end non-volatile physical storage.

Abstract: Techniques for processing I/O operations may include: receiving an I/O having an associated expected execution time (EET) and I/O service level; selecting, in accordance with the EET and service level of the I/O, a first I/O queue from multiple pending I/O queues; inserting the I/O into the first I/O queue; and performing I/O shifting. I/O shifting may include shifting I/Os from one pending I/O queue to another that is ranked immediately higher than the one pending I/O queue. The multiple I/O queues may be ranked from a highest priority queue to a lowest priority queue. I/O shifting may shift I/Os from the highest priority queue to execution and shifting I/Os from another queue into the highest priority queue. I/O shifting is subject to remaining credits available of the multiple I/O queues and time distance between source and target queues.

Abstract: A method is used in managing remote replication in storage systems. The method monitors network traffic characteristics of a network. The network enables communication between a first storage system and a second storage system. The method predicts a change in at least one of an application demand of an application of a set of applications executing on the first storage server and a network state of the network, where the set of applications have been identified for performing a replication to the second storage system. Based on the prediction, the method dynamically manages replication of the set of applications in accordance with a performance target associated with each application.

Abstract: Techniques for processing I/O operations may include: receiving an I/O having an associated expected execution time (EET) and I/O service level; selecting, in accordance with the EET and service level of the I/O, a first I/O queue from multiple pending I/O queues; inserting the I/O into the first I/O queue; and performing I/O shifting. I/O shifting may include shifting I/Os from one pending I/O queue to another that is ranked immediately higher than the one pending I/O queue. The multiple I/O queues may be ranked from a highest priority queue to a lowest priority queue. I/O shifting may shift I/Os from the highest priority queue to execution and shifting I/Os from another queue into the highest priority queue. I/O shifting is subject to remaining credits available of the multiple I/O queues and time distance between source and target queues.