Abstract: A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters.

Abstract: A database protection system (DPS) detects anomalies in real time without reliance on discrete security rules, instead relying on a machine learning-based approach. In particular, a Bayesian machine learning model is trained on a set of database protocol metadata (DPM) that the system collects during its runtime operation. Typically, a set of DPM parameters is protocol-specific. The approach herein presumes that DPM parameters are not independent, and that their conditional dependencies (as observed from the database connections) can be leveraged for anomaly detection. To that end, the machine learning model is trained to detect dominant (repeating) patterns of connection DPM parameters. Once trained, the model is then instantiated in the DPS and used to facilitate anomaly detection by identifying connections that do not conform to these patterns, i.e. that represent unusual connection DPM parameters.

Abstract: A technique for managing system drive integrity in data storage systems is disclosed. A plurality of storage drive data structures configured to store data associated with a system drive is created, wherein each storage drive data structure includes a data structure initialization string, a unique storage system identifier, a plurality of unique system drive identifiers associated with respective system drives, and a board replacement flag. Respective data structures are stored on each of the plurality of corresponding system drives. The contents of one or more of the data structures stored on one or more of the plurality of systems drives are read via an instruction initiated by a data store system. A drive type for one or more system drives is determined based on the contents.

Abstract: Described are techniques for processing a write operation that writes first data to a target location of a logical address range of a logical device. It is determined whether the target location is mapped to physical storage. Responsive to determining that the target location is not mapped to physical storage, performing first processing to service the write operation. The first processing includes sending the write operation along with a hint to a caching layer where the hint indicates to store zeroes to locations that do not include user data. The caching layer forms a data portion denoting data stored at a logical address subrange of the logical device. The logical address subrange includes the target location. The data portion includes the first data and zeroes stored at remaining locations of the logical address subrange not including user data. The data portion is stored in cache by the caching layer.

Abstract: Described are techniques for updating checkpoint data during a copy process that copies data from a first device to a second device. A portion of data is copied from the first device to the second device. A first calculated value is determined in accordance with a plurality of factors. In accordance with the first calculated value and a threshold ratio, it is determined whether to update the checkpoint data denoting progress of the copying process that copies data from the first device to the second device. If it is determined to update the checkpoint data, first processing is performed that updates the checkpoint data.

Abstract: A method is used in managing system I/O load. When a background operation is available to be executed on a processor core, it is determined whether a credit value associated with the processor core satisfies a memory use criterion. The background operation has a memory use requirement and is executed on the processor core when the credit value associated with the processor core satisfies the memory use criterion. The credit value associated with the processor core is modified by an amount corresponding to the memory use requirement.

Abstract: Described are techniques for performing a firmware update. A drive management object determines one or more physical drives matching criteria of a first received request. The drive management object sends to provision drive objects a second request to update firmware on physical drives. Firmware update processing is performed independently for each physical drive. Each provision drive object is associated with one of the physical drives. Firmware update processing for said one physical drive includes determining whether to perform the firmware update at a current point in time; in response to determining to perform the firmware update at the current point in time, performing preparation processing; notifying, upon completion of said preparation processing, a physical drive object associated with said one physical drive to download the firmware update to the one physical drive; and resuming I/O operations to the one physical drive upon successfully completing the firmware update.

Abstract: A method is used in analyzing drive errors in data storage systems. An error tag and total good I/O count are maintained for a drive. For each failed I/O, the following is performed. An error weight per error is retrieved. A new error tag is calculated from the error weight, a previous error tag, and the total good I/O count. An error ratio is calculated from the new error tag and a total I/O count. The error ratio is compared with thresholds. If one or more of the thresholds has been crossed, action is taken on the drive. The error tag is reduced as good I/O is produced.

Abstract: Described are techniques for performing a firmware update. A drive management object determines one or more physical drives matching criteria of a first received request. The drive management object sends to provision drive objects a second request to update firmware on physical drives. Firmware update processing is performed independently for each physical drive. Each provision drive object is associated with one of the physical drives. Firmware update processing for said one physical drive includes determining whether to perform the firmware update at a current point in time; in response to determining to perform the firmware update at the current point in time, performing preparation processing; notifying, upon completion of said preparation processing, a physical drive object associated with said one physical drive to download the firmware update to the one physical drive; and resuming I/O operations to the one physical drive upon successfully completing the firmware update.

Abstract: Described are techniques for performing I/O operations. A graph is received including a plurality of nodes and edges. The graph includes a first level with a root node and one or more other levels of nodes. Each edge has a value indicating an I/O load metric. A thread associated with a first node determines whether to perform a background I/O operation directed to a first device and having a first priority. The first priority is compared to a first value of an I/O load metric. The first value is determined in accordance with criteria including a maximum usage of an I/O buffer of the first device and priorities of other I/O operations directed to the first device. If it is determined that the background I/O operation is to be performed, the background I/O operation is forwarded for processing on an I/O path having a corresponding path in the graph.

Abstract: A method for testing each one of the CPUs on each one of the plurality of director printed circuit. Results from such test are collected in a memory of a computer. The results are collected in a predetermined format. The method processes the collected data to present the results of the tests on a display of the computer in a different format. The different format comprises lines of information on the computer display. Each one of the lines of information identifies a corresponding one of the CPUs and indicates whether such corresponding one of the CPUs passed or failed the testing thereof.