Abstract: According to at least one aspect of the present disclosure a method for classifying flows on a network is provided. The method comprises determining a signature of a service's flows, collecting flow data having one or more attributes, responsive to collecting flow data, associating one or more ranges of the flow data with a value, responsive to associating the one or more ranges of the flow data with a value, composing a tensor having a dimensionality of one or more, responsive to composing the tensor, decomposing the tensor into one or more clusters, and responsive to decomposing the tensor into one or more clusters and determining the signature, comparing the signature to the one or more clusters and classifying one or more of the one or more clusters based on the signature.

Abstract: According to at least one aspect of the present disclosure a method for detecting tunneled or multiplexed flows is provided. The method comprises: receiving an input; responsive to receiving the input, extracting a set of attributes of the input flow; responsive to extracting the set of attributes, reducing the dimensionality of the set of attributes to produce a reduced attribute set; responsive to producing the reduced attribute set, producing an output based on the reduced attribute set and a model; responsive to producing the output, comparing the output to the input to determine an error or loss; and responsive to determining the error or loss, categorizing the input as a multiplexed flow based on a threshold error or loss value.

Abstract: Location-independent references include a live reference containing a location of a remote object and a universally unique identifier (UUID) which provides a unique global reference to that remote object. If a method call to the remote object using the live reference fails, the UUID is used to obtain a new reference to the remote object and the new reference is then used to make another method call. A new reference can be obtained from an identifier directory that contains a mapping between UUIDs and location-independent references. When a remote object is first created, or when a remote object is moved from one location to another, the remote object registers with any and all such directories that it can find in its environment. These registrations are leased; that is, if they are not occasionally refreshed by the remote object which registered them, they are dropped from the directory.

Abstract: A network storage server includes a main buffer cache to buffer writes requested by clients before committing them to primary persistent storage. The server further uses a secondary cache, implemented as low-cost, solid-state memory, such as flash memory, to store data evicted from the main buffer cache or data read from the primary persistent storage. To prevent bursts of writes to the secondary cache, data is copied from the main buffer cache to the secondary cache speculatively, before there is a need to evict data from the main buffer cache. Data can be copied to the secondary cache as soon as the data is marked as clean in the main buffer cache. Data can be written to secondary cache at a substantially constant rate, which can be at or close to the maximum write rate of the secondary cache.

Abstract: Redundant solid-state memory devices are used to enhance the operation of a network storage system. To reduce the likelihood of substantially concurrent failure of two or more such memory devices, write allocation decisions are made so as to influence the wear on the various solid-state memory devices, so that not all of the solid-state memory devices wear out at the same rate. This can be accomplished by skewing the wear caused by erases/writes, across the solid-state memory devices, so that the devices experience unequal wear and, therefore, do not all fail at or approximately at the same time. The roles of the various flash devices are adjusted when a solid-state memory device is replaced, such that subsequent write allocation decisions are based on the maintenance history (e.g., replacement history) of the devices as well as the past write history.

Abstract: A network storage server includes a main buffer cache to buffer writes requested by clients before committing them to primary persistent storage. The server further uses a secondary cache, implemented as low-cost, solid-state memory, such as flash memory, to store data evicted from the main buffer cache or data read from the primary persistent storage. To prevent bursts of writes to the secondary cache, data is copied from the main buffer cache to the secondary cache speculatively, before there is a need to evict data from the main buffer cache. Data can be copied to the secondary cache as soon as the data is marked as clean in the main buffer cache. Data can be written to secondary cache at a substantially constant rate, which can be at or close to the maximum write rate of the secondary cache.

Abstract: A network storage server includes a main buffer cache to buffer writes requested by clients before committing them to primary persistent storage. The server further uses a secondary cache, implemented as low-cost, solid-state memory, such as flash memory, to store data evicted from the main buffer cache or data read from the primary persistent storage. To prevent bursts of writes to the secondary cache, data is copied from the main buffer cache to the secondary cache speculatively, before there is a need to evict data from the main buffer cache. Data can be copied to the secondary cache as soon as the data is marked as clean in the main buffer cache. Data can be written to secondary cache at a substantially constant rate, which can be at or close to the maximum write rate of the secondary cache.

Abstract: An initialization process in a storage server is made more efficient by at least partially avoiding serial and/or sequential access to the data blocks that are needed for such process. To accomplish this, the blocks needed for the initialization process are identified prior to performing the initialization process. The blocks or a list of references to the blocks are stored in a non-volatile solid-state memory, such as a flash-based memory, that is separate from the main drive subsystem and has a much shorter power-up and read-access time than the main drive subsystem. The list or stored set of blocks may be used to access the blocks more efficiently when needed, by accessing two or more of such blocks in parallel, as well as performing block accessing and volume mounting in parallel.

Abstract: An extensible fingerprint comprised of an ordered list of fingerprints generated by applying each of a plurality of distinct fingerprinting functions to the content of a data item. The extensible fingerprint can be extended by using a new fingerprinting function to compute a new fingerprint and adding the new fingerprint to the list so that the old extensible fingerprint of a data item is used as a prefix of the new extensible fingerprint for that data item. Thus, the fingerprint can be incrementally extended over time. A content-addressed storage system uses extensible fingerprints as addresses and can also change over time.

Abstract: In a data storage system, content-containing objects to be stored are added to a storage hierarchy that is based on content relationships. The content of each stored object is encrypted and a stub is associated with that object. For each stored object other than a root object, the stub comprises a function of a decryption key for the content of that object and the stubs of all of the ancestors of that object. The stubs can be used to calculate a new stub for a data object to be inserted into the storage hierarchy and to generate a decryption key for an existing object. Since these latter calculations for an object involve the stubs of all ancestors of that object, deleting a stub for an object securely deletes that object and all its descendants. An object can be moved by recalculating its stub.