Abstract: Techniques for grouping data portions are disclosed. Each group includes data portions determined to exhibit similar behavior. The techniques may include determining whether an affinity measurement with respect to two groups exceeds an affinity threshold; merging the two groups into a single group responsive to the affinity measurement exceeding the affinity threshold; modeling movement of at least one data portion of the single group between two storage tiers at a particular time of day using predicted workload metrics; and performing the data movement of the at least one data portion between the two storage tiers. Predicted workload metrics may be determined by revising first modeled workload metrics using a bias value, where bias values are associated with different times of day, and the bias value is selected based on the particular time of day that the predicted workload metrics are modeling.

Abstract: Techniques are described data storage optimization that determine predicted values for I/O statistics using an ARIMA (auto-regressive integrated moving average) model. The ARIMA model may be used to capture periodic patterns and trends of workload I/O access to predict the future load demand. A current set of I/O statistics is collected for a current time period T. Using the current set and one or more ARIMA models, a predicted set of I/O statistics is determined for a next time period T+1. Each of the ARIMA models is characterized by model parameters including P denoting a number of auto-regressive terms, D denoting a number of nonseasonal difference needed for stationarity, and Q denoting a number of lagged forecast errors of prediction. A data storage optimizer may determine one or more data portions for movement from a current storage tier to a target storage tier using the predicted set of I/O statistics.

Abstract: An efficient linear technique is used to determine allocation of tiered storage resources among data extents based on system performance and SLOs. Efficiency is achieved by first determining a system performance boundary condition via hardware performance modeling under desirable system performance zones. SLOs are then balanced and SLO achievement improved by exchanging workload activities among SG donors and SG receivers while system performance boundary conditions are maintained. Remaining unutilized capacity is the uniformly distributed to further improve SLO achievement.

Abstract: An intrusion detection system collects architectural level events from a Virtual Machine Monitor where the collected events represent operation of a corresponding Virtual Machine. The events are consolidated into features that are compared with features from a known normal operating system. If an amount of any differences between the collected features and the normal features exceeds a threshold value, a compromised Virtual Machine may be indicated. The comparison thresholds are determined by training on normal and abnormal systems and analyzing the collected events with machine learning algorithms to arrive at a model of normal operation.

Abstract: An intrusion detection system collects architectural level events from a Virtual Machine Monitor where the collected events represent operation of a corresponding Virtual Machine. The events are consolidated into features that are compared with features from a known normal operating system. If an amount of any differences between the collected features and the normal features exceeds a threshold value, a compromised Virtual Machine may be indicated. The comparison thresholds are determined by training on normal and abnormal systems and analyzing the collected events with machine learning algorithms to arrive at a model of normal operation.