Abstract: A processor establishes time-based file access limits that are concurrently applicable to file access requests associated with a user ID and detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets communicating file access requests. Applying statistical process control includes comparing a number of file access requests by the user ID observed in an observation interval to file access limits including one based on periodicity of file access requests and/or a second one based on age of accessed files. Based on the comparing, the processor generates an event based on each time-based file access limit that is satisfied, and based on one or more events, detects the abnormal file system access pattern. The processor initiating an action based on detection of the abnormal file system access pattern.

Abstract: Techniques are disclosed to detect, isolate, and/or mitigate an attack on a file system, for example, by malicious software, human actors, and/or compromised Internet-connected devices (bots). A processor of a data processing system detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets. Based on detecting the abnormal file system access pattern, the processor temporarily suspends file system access by at least one user ID contributing to the abnormal file system access pattern. The processor provides a notification identifying one or more file system object accessed in the abnormal file system access pattern.

Abstract: Techniques are disclosed to detect, isolate, and/or mitigate an attack on a file system, for example, by malicious software, human actors, and/or compromised Internet-connected devices (bots). A processor of a data processing system detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets. Based on detecting the abnormal file system access pattern, the processor temporarily suspends file system access by at least one user ID contributing to the abnormal file system access pattern. The processor provides a notification identifying one or more file system object accessed in the abnormal file system access pattern.

Abstract: Systems, methods and computer software utilized in the implementation of tamper protection, where unique information associated with data storage tapes and with particular revisions of these tapes is stored on the storage medium itself and on a memory of the tape cartridge, so that the data can be compared to determine whether unauthorized modifications have been made to the tapes. One embodiment is a system which includes an archive node appliance coupled between a set of hosts and a tape media library. The archive node appliance presents files stored on a tape of a media library as a directory. The archive node appliance maintains tamper protection data on the tape and on an auxiliary memory on the cartridge of the tape, and determines from this data whether the tape has been altered by an authorized system.

Abstract: System, apparatus and computer program product for automatically determining a type of tape drive that is present in a media library and accessing the tape drive using commands that are adapted to the identified type of the drive. In one embodiment, a system includes a set of hosts, a media library and an archive node appliance. The archive node appliance is coupled between the hosts and the media library to provide the hosts with access to a set of drives and media in the media library. The archive node appliance has a processor and a data store that contains instructions that are executable on the processor to perform, for one or more of the drives, the method of identifying the type of the drive, identifying a set of software applications adapted to control the drive, and executing the software application, where the drive is accessed through the software application.

Abstract: Systems, methods and computer software utilized in the implementation of tamper protection, where unique information associated with data storage tapes and with particular revisions of these tapes is stored on the storage medium itself and on a memory of the tape cartridge, so that the data can be compared to determine whether unauthorized modifications have been made to the tapes. One embodiment is a system which includes an archive node appliance coupled between a set of hosts and a tape media library. The archive node appliance presents files stored on a tape of a media library as a directory. The archive node appliance maintains tamper prevention data on the tape and on an auxiliary memory on the cartridge of the tape, and determines from this data whether the tape has been altered by an authorized system.

Abstract: System, apparatus and computer program product for automatically determining a type of tape drive that is present in a media library and accessing the tape drive using commands that are adapted to the identified type of the drive. In one embodiment, a system includes a set of hosts, a media library and an archive node appliance. The archive node appliance is coupled between the hosts and the media library to provide the hosts with access to a set of drives and media in the media library. The archive node appliance has a processor and a data store that contains instructions that are executable on the processor to perform, for one or more of the drives, the method of identifying the type of the drive, identifying a set of software applications adapted to control the drive, and executing the software application, where the drive is accessed through the software application.

Abstract: Embodiments provide a solution for controlling file migration in archiving systems. A networked device can be configured to, during an archiving process, exclude or otherwise prevent files from migrating to tape or another archiving appliance connected to the networked device which, in one embodiment, implements an archive node appliance. The archive node appliance may be configured to start an archiving process to store a file. The archiving process may cause the file to be stored in a share or directory on the archive node appliance. The archive node appliance may check a file exclusion policy associated with the share or directory to determine whether the file is to be excluded from migration. The archive node appliance may stop the archiving process if it determines that the file exclusion policy contains a pattern that matches the file name. One example of such a pattern can be a user-defined glob.

Abstract: Embodiments provide a solution for controlling file migration in archiving systems. A networked device can be configured to, during an archiving process, exclude or otherwise prevent files from migrating to tape or another archiving appliance connected to the networked device which, in one embodiment, implements an archive node appliance. The archive node appliance may be configured to start an archiving process to store a file. The archiving process may cause the file to be stored in a share or directory on the archive node appliance. The archive node appliance may check a file exclusion policy associated with the share or directory to determine whether the file is to be excluded from migration. The archive node appliance may stop the archiving process if it determines that the file exclusion policy contains a pattern that matches the file name. One example of such a pattern can be a user-defined glob.

Abstract: Systems, methods and computer software utilized in the implementation of tamper protection, where unique information associated with data storage tapes and with particular revisions of these tapes is stored on the storage medium itself and on a memory of the tape cartridge, so that the data can be compared to determine whether unauthorized modifications have been made to the tapes. One embodiment is a system which includes an archive node appliance coupled between a set of hosts and a tape media library. The archive node appliance presents files stored on a tape of a media library as a directory. The archive node appliance maintains tamper prevention data on the tape and on an auxiliary memory on the cartridge of the tape, and determines from this data whether the tape has been altered by an authorized system.

Abstract: Systems, methods and computer software utilized in the implementation of tamper protection, where unique information associated with data storage tapes and with particular revisions of these tapes is stored on the storage medium itself and on a memory of the tape cartridge, so that the data can be compared to determine whether unauthorized modifications have been made to the tapes. One embodiment is a system which includes an archive node appliance coupled between a set of hosts and a tape media library. The archive node appliance presents files stored on a tape of a media library as a directory. The archive node appliance maintains tamper prevention data on the tape and on an auxiliary memory on the cartridge of the tape, and determines from this data whether the tape has been altered by an authorized system.