Abstract: Disk drive reallocation or replacement is disclosed. When performing a data protection operation, a health score is determined for each of the disk drives associated with the data protection operation. Replacement is recommended for each of the disk drives with an unfavorable health score. The recommendation may also identify a drive class based in part on the write or wear pattern. This allows unhealthy drives to be replaced prior to performing the data protection operation.

Abstract: A method includes searching a group of PITs, identifying one of the PITs as having an indicator of an occurrence of an event involving data associated with the identified PIT, restoring the data, running a production system copy using the data, and while the production system copy is running, taking increasingly granular backups of the data until the event is located. The event may be a corruption of the data, or other problem.

Abstract: One example method includes receiving, at a remote site from a production site, copies of production site assets, storing, at the remote site, the copies of the production site assets, using, at the remote site, the copies of the production site assets to restore a temporary production site, running the temporary production site at the remote site, and restoring, from the remote site to the production site, the copies of the production site assets.

Abstract: Redistributing disks based on disk wear patterns is disclosed. The wear patterns of disk drives in a storage system are learned or determined. When a restore operation is performed, the volumes to disk drive mappings are changed to balance the overall wear pattern of the storage system. This insures that, after the restore operation, disks that had comparatively lower wear levels are used more heavily while disks that had comparatively higher wear levels are used less heavily.

Abstract: Opportunistically transmitting backups through a time-limited air gap. A data protection system may predict rates of changes for one or more applications. The predicted rate of change allows a size of corresponding backups to be estimated. If there is time during which an air gap is available (closed), at least of the backups is selected and opportunistically transmitted to a vault through the air gap.

Abstract: A system can train an artificial intelligence risk model to produce a trained model, wherein labeled training data for the training comprises respective features of user accounts and products, and corresponding labels of respective support costs applicable to supporting the products. The system can perform reconstructive self-supervised learning on a group of features of a user account to produce a complete group of features that are specified for the user account. The system can, in response to applying an input to the trained model, wherein the input comprises the complete group of features and a product of the products, produce an output that indicates a predicted cost that corresponds to the input.

Abstract: A system can determine a first output from an explainable artificial intelligence risk model based on a first input, wherein the first input indicates a first computing configuration, and wherein the first output indicates a first predicted maintenance cost of the first computing configuration during a time period. The system can determine a second output from the explainable artificial intelligence risk model based on a second input, wherein the second input indicates a second computing configuration that differs from the first computing configuration, and wherein the second output indicates a second predicted maintenance cost of the second computing configuration during the time period. The system can, in response to determining that the second predicted maintenance cost is less than the first predicted maintenance cost, saving an indication of a difference between the second predicted maintenance cost and the first predicted maintenance cost.

Abstract: A forensic kit with a granular infected backup. A forensic engine may evaluate a production system that is infected with malware or other corruption and generate a forensic kit. The forensic kit may include copies of components of the production system that are infected or that are sufficiently related to infected components. The forensic kit may be provided to investigators.

Abstract: A system can fit an artificial intelligence risk model to data based on labeled training data to produce a fitted model, wherein the labeled training data comprises respective features of users and products, and corresponding labels of respective maintenance costs applicable to the products, and wherein the fitted model comprises a tree model that is configured to differentiate between groups of the data with differing maintenance cost distributions. The system can, in response to applying a first input to the fitted model, produce an output that indicates a predicted maintenance cost distribution, wherein the first input comprises a feature of a user of the users and a product of the products.

Abstract: A system can comprise a communications antenna comprising a material that is configured to change shape in response to being stimulated with an external stimulus. The system can comprise an antenna performance detector that is configured to detect a measure of performance of the communications antenna. The system can comprise a distortion correction component that is configured to receive an indication of the measure of performance, determine an amount of distortion of the shape of the communications antenna based on the indication of the measure of performance, based on the amount of distortion, determine an amount of the external stimulus with which to stimulate the communications antenna, and selectively apply the amount of the external stimulus to the communications antenna to change the shape of the communications antenna.

Abstract: Methods and systems for anomaly detection in a distributed environment are disclosed. To manage anomaly detection, a system may include an anomaly detector and one or more data collectors. The anomaly detector may detect anomalies in data and classify the anomalies based on magnitudes of anomalies using an inference model. Different magnitudes of anomalies may be keyed to different action sets in response to the presence of anomalies in data. To perform anomaly detection, the inference model may require re-training. Data collected from the one or more data collectors may be used to re-train the inference model as needed. Following anomaly detection and/or inference model re-training, the data may be discarded to remove the data from the anomaly detector.

Abstract: Methods and systems for anomaly detection in a distributed system are disclosed. To manage anomaly detection, a system may include an anomaly detector and one or more data collectors. The anomaly detector may detect anomalies in data obtained from one or more of the data collectors using an inference model. The inference model may be an autoencoder trained to reconstruct data that is intended to match input data to an extent considered acceptable by the system. To accurately perform anomaly detection, the inference model may require re-training. Data collected from the one or more data collectors may be used to re-train the inference model as needed. Following anomaly detection and/or inference model re-training, the data may be discarded to remove the data from the anomaly detector.

Abstract: Methods and systems for detecting data drift while performing anomaly detection in a distributed environment are disclosed. To perform anomaly detection, a system may include an anomaly detector and one or more data collectors. The anomaly detector may detect anomalies in data obtained from one or more of the data collectors using a continuous inference model. To detect data drifts in data from the one or more data collectors, the anomaly detector may also detect anomalies in data obtained from one or more data detectors using a quantized inference model. The output of the continuous inference model may be compared to the output of the quantized inference model to determine whether the continuous inference model has adapted to data drift over time through re-training. Following anomaly detection and/or data drift detection, the data may be discarded to remove the data from the anomaly detector.

Abstract: Methods and systems for anomaly detection in a distributed environment are disclosed. To manage anomaly detection, a system may include an anomaly detector and one or more data collectors. The anomaly detector may detect anomalies in data obtained from one or more of the data collectors using an inference model and an anomaly threshold. The anomaly threshold may be determined by fitting a normal distribution to output of the inference model when the inference model is exercised across an input range of the inference model. The anomaly threshold may correspond to a portion of the normal distribution. To perform anomaly detection, the inference model may require periodic re-training. Data collected from the one or more data collectors may be used to re-train the inference model as needed. Following anomaly detection and/or inference model re-training, the data may be discarded to remove the data from the anomaly detector.

Abstract: Methods and systems for anomaly detection in a distributed environment are disclosed. To manage anomaly detection, a system may include an anomaly detector and one or more data collectors. The anomaly detector may detect anomalies in data obtained from one or more of the data collectors using an inference model. To perform anomaly detection, the inference model may require periodic re-training. Data collected from the one or more data collectors may be used to re-train the inference model as needed. Following anomaly detection and/or inference model re-training, the data may be discarded to remove the data from the anomaly detector.

Abstract: One example method includes assigning, at a production site, a priority to a portion of a dataset to be backed up, checking to determine if the priority meets or exceeds a threshold priority; and, when the priority meets or exceeds the threshold priority, and when an air gap between the production site and a storage vault is closed, backing up, by way of the closed air gap, the portion of the dataset to the storage vault.

Abstract: Data protection including malware response operations are disclosed. When a production system is attacked, the malware is allowed to run in a forensic environment in order to learn its operational characteristics. Once learned, a return malware can be placed in the data. The return malware is transmitted to a malware host system by the malware itself and executed.

Abstract: Data protection including malware response operations are disclosed. When a production system is attacked, the malware is allowed to run in a forensic environment in order to learn its operational characteristics. The forensic environment includes a working scenario that may be prepared in advance with false data that allows the malware to communicate with a malware host system. Once the operational characteristics are learned, a return malware can be placed in the data. The return malware is transmitted to a malware host system by the malware itself and executed.

Abstract: Automated research experimentation on malware is disclosed. When malware is detected, an infected backup is generated. The infected backup is deployed to multiple working environments as recovered production systems, starting from the same state. Different scenarios are performed on the recovered production systems to learn the operational characteristics of the malware operating in the recovered production systems. The insights may be used to protect against the malware and/or other malware.

Abstract: One method includes listening, by a storage vault, to a port that is specific to a particular data structure in the storage vault, determining that an air gap between the storage vault and an entity external to the storage vault, is closed, such that communication between the storage vault and the external entity, by way of the port, is enabled, signaling, by the storage vault to the external entity, that the air gap is closed, and receiving, at the storage vault by way of the port, data from the external entity.