Abstract: A computerized searchable repository stores documents as structured metadata parts and unstructured content parts using single instancing. A full text index used for keyword searching includes a metadata index and a content index. A linking structure includes metadata-to-content (MD to CT) links and content-to-metadata (CT to MD) linking entries, with each MD to CT link linking a metadata part of a document to each content part of the document, and each CT to MD linking entry having one or more CT to MD links collectively linking a content part to the metadata parts of the documents that include the content part. Indexing includes metadata indexing a metadata part, conditionally content indexing a content part, and updating the linking structure. Content indexing is performed only if the content part does not match a content part already stored and indexed. Index entries each associate a key word or key value with corresponding metadata or content parts containing the key word or key value.

Abstract: Detecting harmful or illegal intrusions into a computer network or into restricted portions of a computer network uses a process of synthesizing anomalous data to be used in training a neural network-based model for use in a computer network intrusion detection system. Anomalous data for artificially creating a set of features reflecting anomalous behavior for a particular activity is performed. This is done in conjunction with the creation of normal-behavior feature values. A distribution of users of normal feature values and an expected distribution of users of anomalous feature values are then defined in the form of histograms. The anomalous-feature histogram is then sampled to produce anomalous-behavior feature values. These values are then used to train a model having a neural network training algorithm where the model is used in the computer network intrusion detection system.

Abstract: A computerized searchable repository stores documents as structured metadata parts and unstructured content parts using single instancing. A full text index used for keyword searching includes a metadata index and a content index. A linking structure includes metadata-to-content (MD to CT) links and content-to-metadata (CT to MD) linking entries, with each MD to CT link linking a metadata part of a document to each content part of the document, and each CT to MD linking entry having one or more CT to MD links collectively linking a content part to the metadata parts of the documents that include the content part. Indexing includes metadata indexing a metadata part, conditionally content indexing a content part, and updating the linking structure. Content indexing is performed only if the content part does not match a content part already stored and indexed. Index entries each associate a key word or key value with corresponding metadata or content parts containing the key word or key value.

Abstract: Embodiments of a distributed index mechanism for indexing and searching for presence information in peer-to-peer networks. In one embodiment, a distributed index may be used to store presence information in a decentralized manner on a plurality of peer nodes. In one embodiment, a notification service may be implemented on top of the distributed index to notify peers of other peers joining a peer-to-peer session. Participating peers may query the distributed index to detect the presence of other participating peers registered in the distributed index. One embodiment of a distributed index of presence information may be implemented in peer-to-peer networks implemented according to a peer-to-peer platform including one or more peer-to-peer platform protocols for enabling peer nodes to discover each other, communicate with each other, and cooperate with each other to form peer groups and share network resources.

Abstract: A method for distributively storing a data object on a data storage system includes determining a layout map ID and associating the layout map ID with the data object. The layout map ID is used in determining a layout map, and the layout map is used in determining a layout given a current configuration of the data storage system. The data object is fragmented into data fragments and parity fragments, and the data fragments and parity fragments are distributively stored on data storage system in accordance with the layout.

Abstract: In accordance with the invention, a data storage system for fixed content includes one or more peer node computer systems interconnected by a storage system network, where each peer node computer system includes a symmetric storage system application and locally attached storage. A data object is distributively stored on one or more of the one or more peer node computer systems and identified using a unique object identifier. A data object is flexibly stored on the data storage system according to external criteria. Stored data objects are accessible from any of the one or more peer node computer systems. Applications can be executed on the data storage system using data objects that are stored on, being written to, or being read from the data storage system to generate results accessible by a user.

Abstract: In accordance with the invention, a data storage system for storing and retrieving fixed data content includes: a storage system network; one or more peer node computer systems interconnected by the storage system network; and at least one disklet stored on at least one of the one or more peer node computer systems, the disklet for execution on the data storage system using data that are stored on, being written to, or being read from the data storage system. In one embodiment, a disklet includes executable program code and a disklet interface that permits the program code of the disklet to be loaded on to the data storage system and executed on the data storage system by a user.

Abstract: A method includes determining a garbage collection list for a data storage structure of a node in a data storage system, the garbage collection list including one or more layout map identifiers (IDs) for garbage collection. A data fragment stored on the data storage structure is located at a first location and a layout map ID associated with the data fragment is determined. A determination is made whether the layout map ID associated with the data fragment matches a layout map ID for garbage collection in the garbage collection list. If the layout map ID associated with the data fragment matches a layout map ID for garbage collection in the garbage collection list, a determination is made whether the data fragment is present at a second location on the data storage system. If the data fragment is present at a second location on the data storage system, the data fragment at the first location is determined to be a garbage fragment and deleted from the data storage system.

Abstract: A method for recovery of data objects on a data storage system includes determining a list of layout map IDs that place data objects on a node of a data storage system. For each layout map ID, a list of object IDs associated with each of the data objects assigned the layout map ID is determined. For each object ID, a list of data object fragments associated with the object ID is determined. A determination is made whether each of the data object fragments is present on the node. If a data object fragment is not present on the node, the data object fragment is reconstructed on the data storage system. The method can be automatically implemented by each of one or more operational nodes of a distributed data storage system at configured time intervals, and/or upon the operational loss of a data storage structure of a node, or a node.

Abstract: Detecting harmful or illegal intrusions into a computer network or into restricted portions of a computer network uses a process of synthesizing anomalous data to be used in training a neural network-based model for use in a computer network intrusion detection system. Anomalous data for artificially creating a set of features reflecting anomalous behavior for a particular activity is performed. This is done in conjunction with the creation of normal-behavior feature values. A distribution of users of normal feature values and an expected distribution of users of anomalous feature values are then defined in the form of histograms. The anomalous-feature histogram is then sampled to produce anomalous-behavior feature values. These values are then used to train a model having a neural network training algorithm where the model is used in the computer network intrusion detection system.

Abstract: Detecting harmful or illegal intrusions into a computer network or into restricted portions of a computer network uses a process of synthesizing anomalous data to be used in training a neural network-based model for use in a computer network intrusion detection system. Anomalous data for artificially creating a set of features reflecting anomalous behavior for a particular activity is performed. This is done in conjunction with the creation of normal-behavior feature values. A distribution of users of normal feature values and an expected distribution of users of anomalous feature values are then defined in the form of histograms. The anomalous-feature histogram is then sampled to produce anomalous-behavior feature values. These values are then used to train a model having a neural network training algorithm where the model is used in the computer network intrusion detection system.

Abstract: Embodiments of a distributed index mechanism for indexing and searching for presence information in peer-to-peer networks. In one embodiment, a distributed index may be used to store presence information in a decentralized manner on a plurality of peer nodes. In one embodiment, a notification service may be implemented on top of the distributed index to notify peers of other peers joining a peer-to-peer session. Participating peers may query the distributed index to detect the presence of other participating peers registered in the distributed index. One embodiment of a distributed index of presence information may be implemented in peer-to-peer networks implemented according to a peer-to-peer platform including one or more peer-to-peer platform protocols for enabling peer nodes to discover each other, communicate with each other, and cooperate with each other to form peer groups and share network resources.

Abstract: Detecting harmful or illegal intrusions into a computer network or into restricted portions of a computer network uses a features generator or builder to generate a feature reflecting changes in user and user group behavior over time. User and user group historical means and standard deviations are used to generate a feature that is not dependent on rigid or static rule sets. These statistical and historical values are calculated by accessing user activity data listing activities performed by users on the computer system. Historical information is then calculated based on the activities performed by users on the computer system. The feature is calculated using the historical information based on the user or group of users activities. The feature is then utilized by a model to obtain a value or score which indicates the likelihood of an intrusion into the computer network. The historical values are adjusted according to shifts in normal behavior of users of the computer system.