Abstract: Disclosed are systems, methods and computer program products for automatic data backup based on multi-factor environment monitoring. An example method includes monitoring an occurrence of one or more danger events; detecting when a danger event occurs or about to occur; determining a danger level of the detected danger event; determining an importance level of each of a plurality of backup data items; determining a backup time for performing backup of the backup data items based on the determined danger level of detected danger event; determining a backup order of the plurality of backup data items based on the determined importance level of the backup data items; selecting a backup storage for the backup data items and performing a backup of the plurality of backup data items to the selected backup storage.

Abstract: A system and method is disclosed for scheduling and allocating data storage. An example method comprises generating a scheduling problem based at least on states of each of the plurality of storage nodes, a received plurality of storage tasks and received constraints, wherein the scheduling problem is a constraint satisfaction problem, selecting one or more approaches to solving the scheduling problem based on metadata associated with the storage tasks and constraints, solving the scheduling problem to generate a scheduling solution based on the one or more approaches, determining whether the given constraints are satisfied by the scheduling solution, executing, by the processor, the scheduling solution by assigning storage of data to each of the plurality of storage nodes when the constraints are satisfied by the scheduling solution and determining another scheduling solution based on the one or more approaches when the constraints are not satisfied by the scheduling solution.

Abstract: A method is provided for protecting a file server from a ransomware attack. An exemplary method comprises assigning a session identifier to a remote session initiated with the file server, monitoring operations associated with the session identifier, determining whether the operations are suspicious according to a policy, creating a volume-level snapshot of files on the file server, determining that encryption of the data is occurring when entropy of the monitored data is growing faster than the predetermined threshold rate, classifying the remote session as having a calculated degree of danger when the operations match operations contained in previously observed suspicious behavior patterns, interrupting the remote session when a combination of the degree of danger and the entropy is greater than a predetermined threshold value and restoring the data on the file server using the volume-level snapshot to a state prior to the encryption and dangerous activity.

Abstract: A system and method that provides for the backup and recovery of personalized user data. An exemplary method includes storing user data files in electronic memory of a user device, continuously tracking user actions by one or more user devices to detect interact with at least one external resource; determining whether the tracked user actions have modified one or more of the plurality of user data files; and if the processor determines that the tracked user actions have modified a user data file, storing the modified user data file in a data storage system.

Abstract: A system and method is provided for storing data and ensuring integrity and reliability of the data using blockchain technology. An exemplary method is provided for time-stamping a file to be added to a blockchain network. The method includes generating a data file; identifying a hash value from a first block previously recorded in the blockchain network; embedding a beacon relating to the hash value in the data file; and recording the data file with the embedded beacon as a transaction in a second block in the blockchain network.

Abstract: Disclosed are systems and methods for detecting malicious applications. The described techniques detect a first process has been launched on a computing device, and monitor at least one thread associated with the first process using one or more control points of the first process. An execution stack associated with the one or more control points of the first process is received from the first process. In response to detecting activity on the one or more control points of the first process, an indication that the execution of the first process is malicious is generated by applying a machine learning classifier to the received execution stack associated with the one or more control points of the first process.

Abstract: A systems and methods of managing user data using clustering patterns based on metadata analysis. The described technique includes receiving file metadata from multiple user devices, where the file metadata is associated with data stored on the plurality of user devices associated with a plurality of users. The technique generates a user metadata fingerprint based on a plurality of user metadata record attributes contained in the file metadata, and determines clustering of the plurality of users based on the generated user metadata fingerprint. The data for the plurality of users may be stored based on the determined clustering.

Abstract: A method, computer program product, computing system, and system for preventive hash loading are described. The method may include receiving an indication at a storage server that a machine will be backed up. The method may further include loading fingerprints of blocks related to a previous backup of the machine to RAM of the storage server. The method may also include searching the storage server for fingerprints in the RAM that match fingerprints of incoming blocks from the machine being backed up. The method may additionally include, in response to determining that the fingerprints of the incoming blocks do not match fingerprints in the RAM, searching for the fingerprints in a database. Moreover, the method may include transferring only blocks from the machine being backed up that are not in the RAM or the database of the storage server to the storage server.

Abstract: Disclosed are system and method for synchronization of large amounts of data while maintaining control over access rights to such data in electronic data storage. An exemplary method comprises: partitioning a volume of data into a plurality of data blocks; assigning a synchronization status to at least one data block in the plurality of data blocks; determining access rights to the data contained in the at least one data block, based upon at least one of information identifying an owner or administrator associated with the at least one data block, or a set of allowed or prohibited operations that may be performed on the at least one data block; controlling access to the data contained in the at least one data block based upon the determination of access rights; and updating the synchronization status of the at least one data block.

Abstract: Disclosed are systems and methods restoring a computing system. The described method includes receiving a delta disk that was generated based on a backup of a computing device executing a protected application. The delta disk comprises one or more configurations for executing the protected application on a different device than the computing device. In response to a request to perform recovery of the computing device, a recovery virtual machine (VM) is created having a base virtual disk emulated from the backup. The recovery VM is modified by attaching the delta disk having the one or more configurations for executing the protected application. Execution of the protected application on the recovery VM is resumed.

Abstract: Various embodiments are directed to systems and methods for creating an archive of a set of logical storage units stored on at least one storage medium. A first plurality of LSU descriptors may be generated. Each LSU descriptor may describe a current version of one of the set of LSUs at about the time of the generating. A first archive may be read to produce a first archive plurality of LSU descriptors. Each of the first archive plurality of LSU descriptors may describe a version of one of the set of LSUs when the first archive was created. The first archive plurality of LSU descriptors may be compared with the first plurality of LSU descriptors to identify a first LSU from the set of LSUs that has an associated LSU descriptor that does not match a corresponding LSU descriptor from the first archive plurality of LSU descriptors.

Abstract: Disclosed are systems and method for machine learning and blockchain-based anti-discrimination validation. The described techniques uses a machine learning model to generate a numerical determination associated with a first person based on an input data set associated with the first person. The numerical determination is further based on a corrective module configured to compensate for prohibited discrimination by the machine learning model. The technique generates a blockchain transaction data structure comprising a state of the machine learning model at the time of generating the numerical determination, a copy of the input data set associated with the person, and an indication of a correction by the machine learning model. The blockchain transaction data structure is recorded or published in a blockchain network.

Abstract: A system and method is disclosed for using performance-maintaining commands for generating backup data of an unsupported file system. An example method includes intercepting a plurality of data storage commands transmitted from the file system to a storage device, where the plurality of data storage commands indicating sectors of the memory of the computer that do not contain valid data. The method further includes analyzing the plurality of data storage commands to determine sectors of the memory that contains valid data, generating a data structure that indicates the sectors of the memory that contain valid data and the sector of the memory that do not contain valid data, and subsequently generating the backup data copy of the memory of the computer based on the data structure.

Abstract: A system and method is provided for data storage using log-structured merge (LSM) trees. An example method includes storing data blocks for a number of files backup data files in a data archive, storing data values and corresponding segment identifiers for each data block in a first LSM tree, and storing the segment identifiers and associated physical addresses for each data block in a second LSM tree. The method further includes determining that one or more data blocks is no longer referenced by the backup data file and storing, in a third LSM tree, the physical address of the unused space in the data archive. Finally, the method includes copying data blocks from the end of the data archive to unused memory space at the physical address in the data archive and then deleting these data block at the end position of the archive to truncate the archive.

Abstract: Methods of preserving and protecting user data from modification or loss due to malware are disclosed, as well as systems and computer program products related to the same.

Abstract: Disclosed herein are systems and method for storing media authentication data using a distributed ledger. In one aspect, an exemplary method comprises, receiving, by a processor of a computing node of a plurality of computing nodes, one or more hashes associated with a media content and a timestamp, the computing nodes being communicatively linked, generating a data block that contains at least one of the received hashes, the data block being generated by hashing a hash corresponding to a previous data block of the distributed ledger together with the at least one hash, the at least one hash corresponding to the media content of the data block being generated, transmitting to the plurality of computing nodes, a message reporting an addition of the generated data block, wherein at least some of the plurality of computing nodes maintain at least a partial copy of the distributed ledger.

Abstract: Disclosed herein are systems and method for forming and executing a backup strategy. In one aspect, an exemplary method comprises, for each file of files from one or more data sources that is being evaluated to form the backup strategy for the file, updating a frequency database, evaluating a uniqueness for the file stored at a data source of the one or more data sources by comparing at least a portion of data of the file to the frequency database, categorizing the file into a hierarchy of logical types according to properties of the file, and forming the backup strategy for the file according to the uniqueness and categorization of the file.

Abstract: A system and method is disclosed for live virtual incremental restoring of data from a cloud storage. An example method includes, in response to detecting a data backup, collecting information by a hardware processor of a computing device for configuring a list of changed sectors (LCS) of a storage medium of the computing device as a result of the data backup. The method further includes virtually restoring at least a portion of electronic data saved in the storage medium of the computing device from the cloud storage, the selected electronic data being previously saved in the cloud storage. The method also includes rebooting the computing device and applying changes to the storage medium of the computing device based on the LCS during a subsequent data backup.

Abstract: A system and method is disclosed for storing a block of data in a distributed data-storage system. An example method includes identifying a list of a plurality of disks in the distributed data-storage system, randomly selecting a disk from the list of the plurality of disks and adding the selected disk to a subset of disks allocated for a copyset, and continuously performing the step of randomly selecting the disk and adding the disk to the subset of disks until the copyset contains a predetermined amount of allocated disks from the distributed data-storage system. Furthermore, this process is repeated to perform a plurality of copysets. Once the copysets are defined, the method further includes dividing the block of data into a number of data chunks equal to the predetermined amount of allocated disks, and, distributing the data chunks onto disks of one of the plurality of the copysets.

Abstract: A system and method is disclosed for data storage in a distributed data storage system. An exemplary method includes generating derivatives of a file using an (n,k) algorithm, such that k number of derivatives can be used to restore the file. Moreover, the derivatives are stored in nodes in a multilevel tree representing the distributed data storage system and a rank is calculated that indicates a fault tolerance of the file. The method further determines whether the rank is greater than or equal to k to ensure reliability of recoverability of the file. If the rank less than k, the method reorders one or more derivatives to a different node and/or store one or more additional derivative from the file.