Abstract: Embodiments automate tracking of exploit information related to initially-identified security vulnerabilities, through the data mining of social networks. Certain social network communities (e.g., those frequented by hackers) share information about computer security breaches (zero-day events). Embodiments recognize that further relevant security information may be revealed, in conjunction with and/or subsequent to such initial zero-day vulnerability disclosures. That additional information can include valuable details regarding known (or unknown) vulnerabilities, exploit codes and methodologies, patches, etc. Tracking that additional information can benefit security researchers/experts/law enforcement personnel. Embodiments monitoring social media traffic based upon initial security vulnerability information, perform analysis to detect patterns and create relevant keywords therefrom.

Abstract: An event processing system is disclosed that processes events of an event stream, performs the recovery of events during system failure and preserves the state of the system reliably and accurately while achieving desired system performance. In an embodiment, the event processing system processes a first batch of events of a continuous input stream of events using a continuous query and generates an output stream of events related to an application. The event processing system identifies one or more operators of the continuous query and determines that an operator is a journaled operator. The event processing system generates a journaled snapshot of a current state of the system based on execution of the journaled operator on at least the first batch of events and stores the journaled snapshot of the current state of the system.

Abstract: Computer implemented methods for executing a database query in a database using an electronic computing device are presented, the method including: causing the electronic computing device to provide at least one data structure including at least one object having at least two properties of different data types; identifying a property of the at least one data structure that includes the smallest unique values in terms of type of data stored in that particular property; executing the database query, including any limiting parameters, configured to retrieve only data from the property including the smallest unique values that are retrievable for a record; retrieving a predefined number of results of the executed database query; and for each set of predefined number of retrieved results, executing a new database access thread that is configured to retrieve data that are present in the records identified with the smallest unique values.

Abstract: There is disclosed a computer-implemented method for generating a hierarchical data structure. The computer-implemented method can be executable at a server. The computer implemented method comprises: identifying a plurality of data elements to be searched, the plurality of data elements having a set of descriptors, each descriptor within the set of descriptors being associated with a data type being different from data types of other descriptors within the set of descriptors; defining the hierarchical data structure, having a first level and a second level.

Abstract: Implementations provide an indexing system with an instant failover that uses a moving snapshot window. For example, a method may include receiving, by a processor, a query and determining that a main query processing engine is not responding. The method may further include generating a search result for the query using a secondary query processing engine that applies at least one snapshot record to a portion of a posting list, the snapshot record including the portion of the posting list as it appeared before a modification, and the modification occurring within a predetermined time before receiving the query. The portion is a fixed size smaller than the posting list. Applying the snapshot record can include overlaying the portion of the posting list with the snapshot record beginning at an offset specified by the snapshot record. The main query processing engine generates a search result without applying snapshot records.

Abstract: Systems and methods are provided for allocating memory to dissimilar memory devices. An exemplary embodiment includes a method for allocating memory to dissimilar memory devices. An interleave bandwidth ratio is determined, which comprises a ratio of bandwidths for two or more dissimilar memory devices. The dissimilar memory devices are interleaved according to the interleave bandwidth ratio to define two or more memory zones having different performance levels. Memory address requests are allocated to the memory zones based on a quality of service (QoS).

Abstract: Embodiments as described herein provide systems and methods for sharing secrets between a device and another entity. The shared secret may be generated on the device as a derivative of a secret value contained on the device itself in a manner that will not expose the secret key on the device and may be sent to the entity. The shared secret may also be stored on the device such that it can be used in future secure operations on the device. In this manner, a device may be registered with an external service such that a variety of functionality may be securely accomplished, including, for example, the generation of authorization codes for the device by the external service based on the shared secret or the symmetric encryption of data between the external service and the device using the shared secret.

Abstract: Apparatuses and methods are disclosed for protection of data servers configured for data replication of a database. An example apparatus includes a processing circuit configured to receive records indicating respective modifications performed on a first version of the database stored in a first data server of the plurality of data servers. The processing circuit determines a risk level of a modification indicated by a record based on a set of factors indicated in a security profile, the set of factors being indicative of anomalous data access activity. The processing circuit performs the modification in a second data server, in response to the risk level being less than a threshold level indicated in the security profile. The processing circuit prevents the modification indicated by the record from being performed in the second data server in response to the risk level being greater than or equal to the threshold level.

Abstract: Software for reclaiming a storage medium. The software receives a read request targeting data in a storage system. The software reads the targeted data from a first storage medium storing the targeted data. The software responds to the read request with the targeted data. Responsive to reading the targeted data from the first storage medium and responsive to determining that the first storage medium meets a predetermined condition, the software writes the targeted data to a second storage medium for reclamation. The software may also, subsequent to writing the targeted data to the second storage medium for reclamation, explicitly reclaim the data on the first storage medium to the second storage medium, wherein a time required for explicitly reclaiming is reduced due to the targeted data having already been written to the second storage medium.

Abstract: In one embodiment, a computer-implemented method includes producing one or more clean frames by clearing a batch of one or more frames for use in backing virtual memory pages. The producing the one or more clean frames may be performed asynchronously from a unit of work being performed by a processor. The one or more clean frames may be added to a clean frame queue, where the clean frame queue includes a plurality of clean frames that have been cleared. A first request may be received, from the processor, for a frame for use in backing a virtual memory page of the unit of work. A clean frame, of the one or more clean frames, may be removed from the clean frame queue, responsive to the first request. The clean frame may be delivered to the processor, responsive to the first request.

Abstract: Providing high availability multi-way conferencing. Separate signaling and media components may be provided within an MCU or among a cluster of MCUs. A signaling server may control signaling aspects of a conference while a media server may provide media support for the conference. In the event of media server failure, the signaling server may assign a new media server to provide media support for the conference. A backup signaling server may also monitor the signaling server and may provide signaling support for the conference in the event of signaling server failure.

Abstract: In one embodiment, a microprocessor is provided. The microprocessor includes a cache that is controlled by a cache controller. The cache controller is configured to replace cachelines in the cache based on a replacement scheme that prioritizes the replacement of cachelines that are less likely to cause roll back of a transaction of the microprocessor.

Abstract: A file descriptor data structure is configured as a hierarchy of tables. File descriptors are stored as entries in tables that are at the bottom of the hierarchy. When a request to add a file descriptor is received and there are no more entries remaining in the file descriptor tables, the file descriptor data structure is extended by obtaining a lock on a variable containing a maximum number of file descriptors, adding the file descriptor to a new file descriptor table, updating entries in existing upper level tables of the hierarchy so that they point to the new file descriptor table, updating the variable containing the maximum number of file descriptors, and releasing the lock.

Abstract: Methods and systems for managing, storing, and serving data within a virtualized environment are described. In some embodiments, a data management system may manage the extraction and storage of virtual machine snapshots, provide near instantaneous restoration of a virtual machine or one or more files located on the virtual machine, and enable secondary workloads to directly use the data management system as a primary storage target to read or modify past versions of data. The data management system may allow a virtual machine snapshot of a virtual machine stored within the system to be directly mounted to enable substantially instantaneous virtual machine recovery of the virtual machine.

Abstract: Described herein are methods, systems and computer program products for entity resolution. Entity resolution, also known as entity matching or record linkage, seeks to identify equivalent data objects between or among datasets. An example method includes creating a deterministic model by defining an entity to be resolved, selecting two datasets for comparison, defining matching predicates for attributes of the datasets to select a set of candidate matches, and defining a precedence rule for the candidate matches to select a subset of the candidate matches. The method includes running the deterministic model on the two datasets. Running the deterministic model includes applying the matching predicates and the precedence rule to data in the datasets that correspond to the attributes. The method also includes applying a cardinality rule to results of the running, and outputting the matching candidates for which the cardinality rule is satisfied.

Abstract: Described is a technology by which a virtual machine may be safely migrated to a computer system with a different platform. Compatibility of the virtual machine may be checked by comparing the virtual machine's capabilities against those of the new platform. To ensure compatibility, when created the virtual machine may have its capabilities limited by the lowest common capabilities of the different platforms available for migration. Computer systems may be grouped into migration pools based upon similar capabilities, and/or a virtual machine may be mapped to certain computer systems based upon capabilities needed by that virtual machine, such as corresponding to needed performance, fault tolerance and/or flexibility.

Abstract: An identity management system is augmented to provide for automated provisioning of user accounts in an IAM system. A user account is autoprovisioned based on detected attribute patterns. Responsive to a user request from a requesting user for access to a first target, it is determined that access will require a creation of a new account on the first target. A set of existing account information is retrieved. The retrieved set of existing account information is analyzed to discover attribute patterns in the existing account information. Next, an account template is generated according to the discovered attribute patterns. Using the generated account template, a new account on the first target is created giving the user access to the target.

Abstract: Described are data replication techniques that may include receiving, on a host, a write operation that writes first data to a target location on a first logical device having storage provisioned on a first data storage system; determining, on the host and in accordance with one or more criteria, whether the first data is to be replicated on a second logical device on a second data storage system; and issuing the write operation from the host to the first data storage system, wherein the write operation denotes whether to disable replication of the first data to the second logical device on the second data storage system. Such techniques may include partitioning a single write operation into multiple write operations and setting an indicator in each of the multiple writes denoting whether remote replication of the write operation is enabled or disabled.

Abstract: Systems, methods, and other embodiments associated with a software product release automation framework are described. In one embodiment, a system includes a repository configured to store activity instances and process instances. Each activity instance includes parameters and a plurality of blocks of executable code for performing the activity. Each block of executable code is associated with a target platform. Each process instance includes activity instances and a sequence in which the activity instances are to be performed. The system includes interpreter logic configured to retrieve a requested process instance and read the process instance to identify activity instances and parameter values for the parameters in the activity instances. The interpreter logic reads the activity instances to identify the block of code for the platform and combines the parameter values and the block of code to create a target definition for an execution application on the target's platform.

Abstract: Systems and methods for providing contextual and dynamic views in a workspace are provided. A view can be based on contextual data from a workspace and page parameters that are associated with a location in the workspace. The view is then generated and loaded into the user interface of a workspace. Contextual data operations can be performed through the contextual and dynamically generated views.

Abstract: Present invention embodiments enable the handling of various index-memory architectures for a virtual supercomputer that would allow for a heterogeneous storage of variable length index words with non-sequential addressing, and also dynamic changes to the index-memory architecture. A computer-implemented system, method, and apparatus allow for different types of node index memory (NIM) architectures for the virtual supercomputer. The first type allows for homogenous NIM segments, and implementing sequential node-number addressing. A second type of architecture allows for heterogeneous IW configurations (variable length and field structure), but sill uses sequential node-number addressing. A third type allows for non-sequential node-number addressing, but still uses homogeneous IW configurations. To implement this, a new virtual hardware element is required, an Index-Word Address Table.

Abstract: A system and method for online payments over the Internet, able to handle several transactions coming from various participants and contributing to a single payment on a merchant's bank account. In many cases, the modifications designed to make a merchant server capable of managing transactions from several participants contributing to a single payment are difficult, even impossible, to carry out since the server's architecture is imposed by the structure of the e-commerce platform used. A server (4), called mirror authorization server, is added and connected to a set typically formed by a customer computer (1), a merchant server (2) and a bank authorization server (3). In particular, the mirror authorization server is used to replace the actual bank authorization server for the purpose of performing certain operations.

Abstract: Systems and methods authorizing access to storage system resources are presented herein. A scoped permission assignment can be associated with an operation related to a type of at least one resource. The scoped permission assignment can be assigned to a role; and the role can be associated with user(s). A resource, or one or more resources of a resource group, can be associated with user(s) or user group(s). Further, a user can be authorized to perform the operation on the resource and/or one or more resources based on, at least in part, permission assignments directly granted to the user or granted in a role of the user. In addition, one or more resource flags can be assigned to the one or more resources. Accordingly, the user can be authorized to perform the operation based on, at least in part, the one or more resource flags and the scoped permission assignment.

Abstract: Mapping table entries that map logical block addresses to physical block addresses can be intercepted and compressed to save space. In some cases, the mapping table entries can be compressed into compression units, which can hold multiple mapping table entries. Portions of the mapping table entries can be arranged into groups, and a group can be compressed with a unique compression method. The compression method used to compress a group may be based on data characteristics of the group. When data corresponding to the mapping table entries are read or modified, the compressed data can be decompressed and provided to a requesting controller or processor. When the mapping table entry is modified, the updated mapping entry may be arranged into groups, and the groups can be compressed and stored to the compression units.

Abstract: In an approach for connecting an access point in a client region to an access point within a cluster of server regions for a transaction process, a processor receives a connect request to a cluster of server regions sharing a network end point from a client region. A processor reroutes the connect request by a connection balancing mechanism to a network end point corresponding to a server region within the cluster of server regions. A processor transmits connection information to the client region, wherein the connection information allows the client region to connect to the server region within the cluster of server regions. A processor connects the server region within the cluster of server regions to the client region.

Abstract: A method in a data storage system includes receiving a host I/O request from a host-side interface specifying a range of logical block addresses (LBAs) of a mapped logical storage unit (MLU) mapped through a device-side interface to underlying units of storage. Mapping information is obtained for extents of the underlying logical storage units mapped to sub-ranges of the range of LBAs. Sub-I/O requests for the extents are concurrently issued to the device-side interface based on the mapping information, subject to a throttling mechanism to manage performance. The device-side interface provides transfer initiation responses to initiate transfer of the extents, the responses being forwarded to the host-side interface to cause the host-side interface to transfer the extents in a transfer phase. The transfer initiation responses may be re-ordered as necessary to enable the host-side interface to transfer the extents in address order in satisfaction of the host I/O request.

Abstract: In an approach for connecting an access point in a client region to an access point within a cluster of server regions for a transaction process, a processor receives a connect request to a cluster of server regions sharing a network end point from a client region. A processor reroutes the connect request by a connection balancing mechanism to a network end point corresponding to a server region within the cluster of server regions. A processor transmits connection information to the client region, wherein the connection information allows the client region to connect to the server region within the cluster of server regions. A processor connects the server region within the cluster of server regions to the client region.

Abstract: Data records may be managed in a relational database by monitoring, a record length for a first data record in a page of memory, an amount of free space in the page, and a page length. In response to receiving an operator command to replace the first data record with a second data record, a database management system may determine whether an estimated record length of a compressed second data record is outside of the amount of free space in the page. In response to determining the estimated record length of a compressed second data record is outside of the amount of free space in the page, the database management system may determine whether an estimated length of a compressed page is outside of the page length. In response to determining the estimated length of a compressed page is within the page length, the page may be compressed.

Abstract: Technical solutions are described for analyzing a system dump. An example computer implemented method includes determining a fingerprint of the system dump, which identifies a model of the system and a type of the system dump. The method further includes receiving, from a first user device, a request to identify system dumps matching a set of system dump criteria and identifying the first user device based on the fingerprint of the system dump matching the set of system dump criteria specified, and sending access information of the system dump. The method also includes recording a query and its result as executed by the first user device against the system dump and sending, for receipt by a second user device, access information of the result of the query in the database, in response to the second user device requesting identification of system dumps matching said set of system dump criteria.

Abstract: Embodiments described herein relate to an improved technique for blocking access to data records associated with an entity in a network comprising a plurality of systems. The operations include accessing and analyzing determination criteria associated with the entity to determine in which systems the data should be blocked. An end-of-purpose determination can be performed in one or more of the systems based on whether the current system is a master system, a dependent system of the master system, or a standalone system of the plurality of systems. Access to the entity data records can then be blocked from the appropriate systems when an end of purpose for the data has been reached for any processes running on the system.

Abstract: A method for creating processes in a software application. The method includes obtaining an activity fragment. The activity fragment includes an activity fragment name and an activity fragment configuration. The method further includes obtaining a process specification specifying an activity, and obtaining activity configuration instructions. The activity configuration instructions specify inclusion of the activity fragment in the activity. The method also includes building, based on the process specification, a process. Building the process includes associating the activity fragment with the activity. In addition, the method includes deploying the software application, including the process.

Abstract: Examples are disclosed for allocating a block of persistent storage or accessing a block of persistent storage based on a storage service string that includes a universally unique identifier and associated metadata.

Abstract: A server system (9) in provided with: a first server (91) that operates in an active mode; and a plurality of second servers (92) that operate in a standby mode as a standby server for the first server (91), wherein the plurality of second servers (92) includes a location information control unit (921) that, in response to an access from a client, transmits a location information which indicates a location of the client to the first server (91), and a switching processing unit (922) that, upon reception of a switching instruction information transmitted from the first server (91), performs switching so as to cause the second server itself to change its mode from the standby mode to the active mode, and wherein the first server (91) includes a switching destination determination unit (911) that, on the basis of the location information transmitted by the second server (92), determines, as a switching destination, a second server (92) which constitutes the plurality of second servers (92) and which exists at

Abstract: A method or system comprises reading content of a plurality of system files from storage media of a storage device, generating a master storage device system file, and storing the master storage device system file on the storage media at a master system file location. The location of the master system file is provided to boot firmware or hardware. As a result, when the system boots up, the master system file is read into a temporary cache.

Abstract: An approach is provided for suggesting data for deletion from an electronic data storage medium. An external device detects initiation of transfer of data from first storage medium to second storage medium. Next, the external device determines an available storage in the second storage medium for the data. Then, the external device generates a list to suggest content for deletion within the second storage medium to accommodate the data.

Abstract: In a state of a system in which a processor of the system is not accessing a first memory, a controller in the system determines whether system boot code from the first memory in the system is compromised, wherein the first memory is accessible by the processor and the controller over a bus. In response to determining that the system boot code is compromised, the controller retrieves system boot code from a second memory in the computing device to replace the system boot code in the first memory, where the second memory is electrically isolated from the bus and is inaccessible by the processor.

Abstract: A maintenance planner receives an installation request for installation of a software product and associated update on a client system, and provides a media download for installing the software product and associated update, along with an installation file characterizing both the software product and a delta file. The delta file describes differences between the software product, the associated update, and any additional update used to satisfy the installation request.

Abstract: A method for sharing information among multiple devices is provided. The method includes a sensing device sensing signals of at least one object associated with a targeting device and extracting at least one feature of the object from the sensed signals. The method also includes the sensing device broadcasting the extracted feature of the object on a determined network containing a plurality of targeting devices and receiving feedbacks from the plurality of targeting devices on the network in response to the broadcasting. Further, the method includes the sensing device automatically identifying one of the plurality of targeting devices based on the received feedbacks, synchronizing information with the identified targeting device and displaying the information to a user of the sensing device.

Abstract: Aspects of the subject matter described herein relate to reducing update conflicts when maintaining views. In aspects, a transaction in snapshot isolation may update a materialized view. Instead of being able to view the update within the transaction, the update is hidden to prevent the transaction from obtaining inconsistent data. When a transaction is not supposed to see an update to a materialized view that occurs within the transaction, additional information associated with the materialized view may indicate this. When a query of the materialized view is made within the transaction, the query engine may use the additional information to exclude data from the update in the result.

Abstract: Embodiments disclose techniques for migrating a logical partition from a source computing system with an inactive I/O server to another target computing system. In one embodiment, a computing system collects and stores the resource configuration of the logical partition, upon detecting a change in a resource configuration of a logical partition on the source computing system. Once the computing system detects that a I/O server on the source computing system is inactive for a migration of the logical partition, the computing system uses the collected resource configuration to configure the logical partition on the target computing system.

Abstract: Techniques for selectively permitting a device to boot an operating system. Before any operating system is loaded on the device, a BIOS component analyzes a set of files residing on the device to create state data that describes a current state of the set of files. This enables the state data to identify whether any files have been unexpectedly modified or are outdated. The BIOS component attempts to send the state data to a server over a network. The BIOS component then determines whether to permit the device to boot the operating system based on whether the network was detected and on the contents of any response, sent by the server, responsive to the state data.

Abstract: Techniques for switching mastership from one service in a first data center to a second (redundant) service in a second data center are provided. A service coordinator in the first data center is notified about the master switch. The service coordinator notifies each instance of the first service that the first service is not a master. Each instance responds with an acknowledgement. After it is confirmed that all instances of the first service have responded with an acknowledgement, a client coordinator in the first and/or second data center is updated to indicate that the second service is the master so that clients may send requests to the second service. Also, a service coordinator in the second data center is notified that the second service is the master. The service coordinator notifies each instance of the second service that the second service is the master. Each instance responds with an acknowledgement.

Abstract: This disclosure relates system(s) and method(s) for overlaying functionalities, text, annotations, and/or features on video advertisements and content videos.

Abstract: Various embodiments provide a method and apparatus for allocating resources to applications (e.g., application processes) using pre-provisioned resource configurations (e.g., VMs or containers) that are based on clustered historical resource usage data. In particular, the set of pre-provisioned resources required to support elasticity in a set of applications is reduced by determining a subset of pre-provisioned resource configurations that are able to be reused across multiple applications. A pre-provisioned resource configuration being based on a determined dominant center for the resource cluster associated with the pre-provisioned resource configuration.

Abstract: The disclosed computer-implemented method for time-shifted detection of security threats may include (1) collecting history data that describes activity of the computing system during a past time period, (2) archiving the history data in association with the past time period, (3) identifying a potential security threat to the computing system that was unknown to a software security system during the past time period, and (4) in response to identifying the potential security threat, replaying the history data through the software security system to enable the software security system to determine whether the computing system was affected by the potential security threat during the past time period. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: Methods, systems, apparatuses, and/or computer-readable media for providing device management via application modification may be provided. In some embodiments, a request to perform an action may be received. Upon determining that the action is associated with a metered resource, a further determination may be made as to whether the request complies with at least one management policy. In response to determining that the request complies with the at least one management policy, the requested action may be authorized and/or caused to be performed.

Abstract: A computer program product is provided for extending network services addresses. The computer program product comprises a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to identify a network event affecting a node of a sub-cluster of nodes of a network, wherein the node provides external access to the network using an Internet Protocol (IP) address. The program instructions are also executable by the processor to cause the processor to, in response to identifying the network event, identify an attribute associated with the IP address of the node. Finally, the program instructions are executable by the processor to cause the processor to, based on the attribute associated with the IP address of the node, determine whether to move the IP address of the node to another node of the sub-cluster.

Abstract: A technology to isolate user software installations is described. A package database of software packages is maintained. A file system for a user account is isolated by setting a root directory of a file system hierarchy in the file system to be a user directory structure for the user account. A software package is installed from the package database into the user directory structure by linking files from the package database into the user directory structure.

Abstract: Systems and methods for redundant object storage are disclosed. A method may include storing at least two copies of each of a plurality of objects among a plurality of nodes communicatively coupled to one another in order to provide redundancy of each of the plurality of objects in the event of a fault of one of the plurality of nodes. The method may also include monitoring access to each object to determine a frequency of access for each object. The method may additionally include redistributing one or more of the copies of the objects such that at least one particular node of the plurality of nodes includes copies of only objects accessed at a frequency below a predetermined frequency threshold based on the determined frequency of access for each object. The method may further include placing the at least one particular node in a reduced-power mode.

Abstract: A control apparatus, which is configured to control a plurality of processors corresponding to a plurality of storage areas arranged at an interface for accessing the storage areas, comprises: an update unit configured to, in a case a command sequence including each command outputted to one of the storage areas is inputted, update, by each one of the processors, a load applied by a command currently being executed to the storage area corresponding to the processor; a selection unit configured to, for one command of the command sequence, based on a load applied by a command currently executed at the processor updated by the update unit, select a processor out of the processors as an allocation destination of the one command; and an output unit configured to output the one command to the processor selected by the selection unit.