Abstract: An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing data in the computer. The collected data is analyzed to form a graph that describes and predicts what output is generated in response to received input. Later, a window of input and output data is collected from the computer. This collected window of data is used to query the activity model. The graph in the activity model is then used to give the probability that the collected window of data was collected from the computer used to generate the activity model. A high probability indicates that the computer is performing normally, while a low probability indicates that the computer may behaving erratically and there may be a problem with the computer.

Abstract: An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing channels for packets for a predetermined window of time. To generate an activity model, an input and an output channel are selected. A probability distribution function describing the observed waiting time between packet arrivals on the selected input channel and the selected output channel is generated by mining the data collected during the selected window of time. A probability distribution function describing the observed waiting time between a randomly chosen instant and receiving a packet on the selected input channel is also generated. The distance between the two generated probability distribution functions is computed. If the computed distance is greater than a predefined confidence level, then the two selected channels are deemed to be related. Otherwise, the selected channels are deemed to be unrelated.

Abstract: An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing channels for packets for a predetermined window of time. To generate an activity model, an input and an output channel are selected. A probability distribution function describing the observed waiting time between packet arrivals on the selected input channel and the selected output channel is generated by mining the data collected during the selected window of time. A probability distribution function describing the observed waiting time between a randomly chosen instant and receiving a packet on the selected input channel is also generated. The distance between the two generated probability distribution functions is computed. If the computed distance is greater than a predefined confidence level, then the two selected channels are deemed to be related. Otherwise, the selected channels are deemed to be unrelated.

Abstract: An activity model is generated at a computer. The activity model may be generated by monitoring incoming and outgoing data in the computer. The collected data is analyzed to form a graph that describes and predicts what output is generated in response to received input. Later, a window of input and output data is collected from the computer. This collected window of data is used to query the activity model. The graph in the activity model is then used to give the probability that the collected window of data was collected from the computer used to generate the activity model. A high probability indicates that the computer is performing normally, while a low probability indicates that the computer may behaving erratically and there may be a problem with the computer.

Abstract: Activity models are maintained on a plurality of computers on a network. When a user or a particular activity model at a computer discovers an error, it may query its own activity model to determine a possible source of the error. If it is determined to not be the likely source of the error, the activity model queries the activity models of those computers on the network that it depends on. These activity models may then query the activity models of the computers that their particular host computer depends on and so forth. Ultimately the results of these activity model queries may be used to diagnose the likely source of the error and may be presented to the requesting user as a report.

Abstract: While consulting indexes to conduct a search, a determination is made from time to time as to whether it is more efficient to consult individual indexes in a set or to merge the indexes and consult the merged index. The cost of merging indexes is compared with the cost of individually querying indexes. In accordance with the result of this comparison, the indexes are merged and the merged index is consulted, or the indexes are individually consulted. A cost-balance invariant in the form of an inequality is used to equate the cost of merging indexes to a weighted cost of individually querying indexes. As query events are received, the costs are updated. As long as the cost-balance invariant is not violated, indexes are merged and the merged index is queried. If the cost-balance invariant is violated, indexes are not merged, and the indexes are individually queried.

Abstract: Balanced prefetching automatically balances the benefits of prefetching data that has not been accessed recently against the benefits of caching recently accessed data, and can be applied to most types of structured data without needing application-specific details or hints. Balanced prefetching is performed in applications in a computer system, such as storage-centric applications, including file systems and databases. Balanced prefetching exploits the structure of the data being prefetched, providing superior application throughput. For a fixed amount of memory, it is automatically and dynamically determined how much memory should be devoted to prefetching.

Abstract: High-performance, scalable, and fault-tolerant distributed systems include decoupling data replication functions from reconfiguration and read functions to optimize system performance and provide a clean separation between scalability and fault tolerance. Each data object is replicated on multiple servers and a data replication protocol can be used to ensure data consistency. Read requests can be streamlined because any server can satisfy a read request, thus improving read performance, throughput, and overall system performance.

Abstract: Methods and apparatuses are provided for recovering one or more replicated datasets. In accordance to some embodiments of the invention, this is accomplished by determining whether a log contains one or more entries indicating a corruption in a replicated data item; and recovering the replicated data item if the log contains any such entries. The log, however, is maintained at a higher layer in a software hierarchy than the layer at which the replicated data item is recovered. As a result, there is no need to maintain a separate replication log at the layer where the replicated data item is recovered.

Abstract: An efficient method for renaming consecutive keys in a B-tree representing a hierarchical namespace, such as a file system, has an estimated time efficiency of O(logN), where N is the number of nodes in the B-tree. All the consecutive keys to be renamed are first excised from the original B-tree to form a trimmed B-tree, and the excised nodes are stored in a separate temporary extracted B-tree. The nodes in extracted B-tree are then renamed, and the renamed extracted B-tree is inserted into the trimmed B-tree to form a final B-tree that contains the renamed keys.

Abstract: Preventing replay attacks on servers. At least one Bloom filter may be set up in a server for tracking requests received from clients. Identifying data may be generated for each request. The identifying data may be checked against the Bloom filter array. If a match is found, the message may be a replay and may be rejected. If a match is not found, the request identifying data may be added to the Bloom filter and the request may be processed.