Abstract: Techniques are described herein that are capable of performing automatic graph-based detection of potential security threats. A Bayesian network is initialized using an association graph to establish connections among network nodes in the Bayesian network. The network nodes are grouped among clusters that correspond to respective intents. Patterns in the Bayesian network are identified. At least one redundant connection, which is redundant with regard to one or more other connections, is removed from the patterns. Scores are assigned to the respective patterns in the Bayesian network, based on knowledge of historical patterns and historical security threats, such that each score indicates a likelihood of the respective pattern to indicate a security threat. An output graph is automatically generated. The output graph includes each pattern that has a score that is greater than or equal to a score threshold. Each pattern in the output graph represents a potential security threat.

Abstract: Techniques are described herein that are capable of performing automatic graph-based detection of potential security threats. A Bayesian network is initialized using an association graph to establish connections among network nodes in the Bayesian network. The network nodes are grouped among clusters that correspond to respective intents. Patterns in the Bayesian network are identified. At least one redundant connection, which is redundant with regard to one or more other connections, is removed from the patterns. Scores are assigned to the respective patterns in the Bayesian network, based on knowledge of historical patterns and historical security threats, such that each score indicates a likelihood of the respective pattern to indicate a security threat. An output graph is automatically generated. The output graph includes each pattern that has a score that is greater than or equal to a score threshold. Each pattern in the output graph represents a potential security threat.

Abstract: Provided herein are methods, systems, and computer program products for intelligent detection of multistage attacks which may arise in computer environments. Embodiments herein leverage adaptive graph-based machine-learning solutions that can incorporate rules as well as supervised learning for detecting multistage attacks. Multistage attacks and attack chains may be detected or identified by collecting data representing events, detections, and behaviors, determining relationships among various data, and analyzing the data and associated relationships. A graph of events, detections, and behaviors which are connected by edges representing relationships between nodes of the graph may be constructed and then subgraphs of the possibly enormous initial graph may be identified which represent likely attacks.

Abstract: Provided herein are methods, systems, and computer program products for intelligent detection of multistage attacks which may arise in computer environments. Embodiments herein leverage adaptive graph-based machine-learning solutions that can incorporate rules as well as supervised learning for detecting multistage attacks. Multistage attacks and attack chains may be detected or identified by collecting data representing events, detections, and behaviors, determining relationships among various data, and analyzing the data and associated relationships. A graph of events, detections, and behaviors which are connected by edges representing relationships between nodes of the graph may be constructed and then subgraphs of the possibly enormous initial graph may be identified which represent likely attacks.

Abstract: A method for diagnosing problems with protection of a data source and recovery of the same. The method includes diagnosing a copy of data located at the storage location and diagnosing a temporal version of the copy of data. Based on the diagnosis it is determined whether an error or a warning was detected. If either were detected a response is provided with a suggested solution.

Abstract: A method for diagnosing problems with protection of a data source and recovery of the same. The method includes diagnosing a copy of data located at the storage location and diagnosing a temporal version of the copy of data. Based on the diagnosis it is determined whether an error or a warning was detected. If either were detected a response is provided with a suggested solution.

Abstract: A computer-implemented system configured to describe the relationship between a first Namespace and a second Namespace is provided. The system includes a containment relationship identifying a direct relationship between a first object of the first Namespace and a second object of the first Namespace. Moreover, the system includes a junction relationship linking the second object of the first Namespace to a first object of the second Namespace. In one embodiment, the system is configured to facilitate the recovery of information based on the descriptions of the Namespaces that is maintained.

Abstract: A method for diagnosing problems with protection of a data source and recovery of the same. The method includes diagnosing a copy of data located at the storage location and diagnosing a temporal version of the copy of data. Based on the diagnosis it is determined whether an error or a warning was detected. If either were detected a response is provided with a suggested solution.

Abstract: A computer-implemented system configured to describe the relationship between a first Namespace and a second Namespace is provided. The system includes a containment relationship identifying a direct relationship between a first object of the first Namespace and a second object of the first Namespace. Moreover, the system includes a junction relationship linking the second object of the first Namespace to a first object of the second Namespace. In one embodiment, the system is configured to facilitate the recovery of information based on the descriptions of the Namespaces that is maintained.

Abstract: A computer-implemented system configured to describe the relationship between a first Namespace and a second Namespace is provided. The system includes a containment relationship identifying a direct relationship between a first object of the first Namespace and a second object of the first Namespace. Moreover, the system includes a junction relationship linking the second object of the first Namespace to a first object of the second Namespace. In one embodiment, the system is configured to facilitate the recovery of information based on the descriptions of the Namespaces that is maintained.

Abstract: A computer-implemented system configured to describe the relationship between a first Namespace and a second Namespace is provided. The system includes a containment relationship identifying a direct relationship between a first object of the first Namespace and a second object of the first Namespace. Moreover, the system includes a junction relationship linking the second object of the first Namespace to a first object of the second Namespace. In one embodiment, the system is configured to facilitate the recovery of information based on the descriptions of the Namespaces that is maintained.

Abstract: A method for creating a group plan for protecting an object located at a production location is provided. A selection of an object for which a group plan is to be created is received along with protection intents for the selected object. The protection intents are translated into a group plan for protecting the selected object.

Abstract: Software programs, such as an operating system or other application programs, are automatically customized to a specific user(s) based on data corresponding to the specific user(s) that is maintained in a user information store. In one embodiment, the information store is a unified store that is accessible by multiple programs including the operating system. Thus, new information or information changes can be made available to multiple programs by the user adding (or changing) the information only once. In another embodiment, the operating system image to be installed on a computer is pre-populated with user-specific information at the factory. The user-specific information can be integrated into the operating system at the factory or alternatively upon an initial boot of the computer by the user.

Abstract: A computer-implemented system configured to describe the relationship between a first Namespace and a second Namespace is provided. The system includes a containment relationship identifying a direct relationship between a first object of the first Namespace and a second object of the first Namespace. Moreover, the system includes a junction relationship linking the second object of the first Namespace to a first object of the second Namespace. In one embodiment, the system is configured to facilitate the recovery of information based on the descriptions of the Namespaces that is maintained.

Abstract: A system and method for dynamically updating software on one or more installation media for installation on at least one destination machine. The invention obtains update content from one or more update media and merges the update content with the software on the installation media prior to installing the software on the destination machine. The software to be installed includes application programs and operating system software.

Abstract: A method for protecting protectable objects located at a production location is provided. A Namespace, representative of a plurality of protectable objects, is provided to a user for selection. A selection of at least a portion of the Namespace is received and that selected portion is mapped to at least one protectable object. A plan for protecting the mapped protectable object is created, and using that plan the protectable object is protected.

Abstract: A method for diagnosing problems with protection of a data source and recovery of the same. The method includes diagnosing a copy of data located at the storage location and diagnosing a temporal version of the copy of data. Based on the diagnosis it is determined whether an error or a warning was detected. If either were detected a response is provided with a suggested solution.

Abstract: A method for diagnosing problems with protection of a data source and recovery of the same. The method includes diagnosing a copy of data located at the storage location and diagnosing a temporal version of the copy of data. Based on the diagnosis it is determined whether an error or a warning was detected. If either were detected a response is provided with a suggested solution.

Abstract: A system and method for dynamically updating software on one or more installation media for installation on at least one destination machine. The invention obtains update content from one or more update media and merges the update content with the software on the installation media prior to installing the software on the destination machine. The software to be installed includes application programs and operating system software.

Abstract: A system and method for manipulation of offline software. A software driver executing on a computer accesses and modifies target software while the target software is in an offline state. The software driver allows installation and configuration of an operating system and/or associated application programs to the target software when an operating system associated with the target software is not executing.