Abstract: Node resets in a distributed environment can be disruptive due to the need to reset shared state. However, a central system can notify all other nodes asynchronously of a pending event, and then multiple nodes can use that notification to mitigate costs when it actually happens. For example, in anticipation of a first node leaving a group of nodes, a second node can reduce its cache to store the cache from the first node. Additionally, a client device can be directed to the second node so as not to interrupt a service provided to the client device by the first node.

Abstract: Harmonization of failure domains in a distributed system is provided herein. A data storage system as described herein can include a memory that stores computer executable components and a processor that executes computer executable components stored in the memory. The computer executable components can include a node assignment component that assigns computing nodes in the data storage system to respective failure domains of a set of data failure domains, a hashing component that generates hashing information associated with respective computing nodes of the computing nodes assigned to a selected failure domain of the set of failure domains, and a group update component that designates at least one computing node of the computing nodes in the selected data failure domain to perform an operation associated with the hashing information.

Abstract: Node resets in a distributed environment can be disruptive due to the need to reset shared state. However, a central system can notify all other nodes asynchronously of a pending event, and then multiple nodes can use that notification to mitigate costs when it actually happens. For example, in anticipation of a first node leaving a group of nodes, a second node can reduce its cache to store the cache from the first node. Additionally, a client device can be directed to the second node so as not to interrupt a service provided to the client device by the first node.

Abstract: Implementations are provided herein for using a distributed DNS cache that is distributed among nodes of a cluster of nodes operating as a distributed file system. A consistent hash can be used to determine a resolution node for a DNS request asking to resolve a specific FQDN. The inputs to the consistent hashing algorithm can be the FQDN, a set of available nodes, and a set of all possible nodes. By using a consistent hash, the process can reduce the sensitivity of the hashing algorithm output from changing when nodes added or removed as participants in the distributed cache service. As each node in the cluster of nodes can independently calculate a resolution node for specific FQDN, there is no need to send control messages between nodes, as each node only needs to be aware of the set of available nodes in the cluster of nodes.

Abstract: Implementations are provided herein for using a distributed DNS cache that is distributed among nodes of a cluster of nodes operating as a distributed file system. A consistent hash can be used to determine a resolution node for a DNS request asking to resolve a specific FQDN. The inputs to the consistent hashing algorithm can be the FQDN, a set of available nodes, and a set of all possible nodes. By using a consistent hash, the process can reduce the sensitivity of the hashing algorithm output from changing when nodes added or removed as participants in the distributed cache service. As each node in the cluster of nodes can independently calculate a resolution node for specific FQDN, there is no need to send control messages between nodes, as each node only needs to be aware of the set of available nodes in the cluster of nodes.

Abstract: Implementations are provided herein for an efficient reconstruction of distributed lock states during a group change within a distributed file system. When a node leaves or joins the cluster, a consistent hash can be used in reassigning the coordinator node to all the distributed locks throughout the file system. Through the use of the consistent hash, wherever possible, nodes that exist both prior to and after the group change can maintain their coordinator status for the locks they manage. If the node is aware they are maintaining coordinator status for the locks it manages, it can retain the locking status previously associated with the locks it was coordinating prior to the group change, thus reducing necessary backplane communication from a coordinator change, and increasing the efficiency for the group change process.

Abstract: A real-time sequence-based anomaly detection system is disclosed. In a preferred embodiment, the intrusion detection system is incorporated as part of a software wrapper. Event abstraction in the software wrapper enables the intrusion detection system to apply generically across various computing platforms. Real-time anomaly detection is enabled through the definition of a distance matrix that defines allowable separation distances between pairs of system calls. The distance matrix indirectly specifies known sequences of system calls and can be used to determine whether a sequence of system calls in an event window represents an anomaly. Anomalies that are detected are further analyzed through levenshtein distance calculations that also rely on the contents of the distance matrix.

Abstract: A real-time sequence-based anomaly detection system is disclosed. In a preferred embodiment, the intrusion detection system is incorporated as part of a software wrapper. Event abstraction in the software wrapper enables the intrusion detection system to apply generically across various computing platforms. Real-time anomaly detection is enabled through the definition of a distance matrix that defines allowable separation distances between pairs of system calls. The distance matrix indirectly specifies known sequences of system calls and can be used to determine whether a sequence of system calls in an event window represents an anomaly. Anomalies that are detected are further analyzed through levenshtein distance calculations that also rely on the contents of the distance matrix.