Systems and methods are described for a data breach detection based on snapshot analytics. The described systems and methods identify a plurality of snapshots of a data structure, identify a plurality of leaf nodes of the data structure for each of the snapshots, generate a vector of data attributes for each of the leaf nodes, assign a weight to each of the vectors to produce a set of weighted vectors for each of the snapshots, compute a distance metric between each pair of the snapshots based on the corresponding sets of weighted vectors, and detect an abnormal snapshot among the plurality of snapshots based on the distance metrics.

A reference snapshot of a storage is stored. Data changes that modify the storage are received. The data changes are captured by a write filter of the storage. The received data changes are logged. The data changes occurring after an instance time of the reference snapshot are applied to the reference snapshot to generate a first incremental snapshot corresponding to a first intermediate reference restoration point. The data changes occurring after an instance time of the first incremental snapshot are applied to the first incremental snapshot to generate a second incremental snapshot corresponding to a second intermediate reference restoration point.

Techniques for shrinking a storage space involve determining a used storage space in a storage pool allocated to a plurality of file systems, and determining a usage level of a storage space in the storage pool based on the used storage space in and a storage capacity of the storage pool. The techniques further involve shrinking a storage space from one or more of the plurality of file systems based on the usage level of the storage pool. Such techniques may automatically shrink storage space in one or more file systems from the global level of the storage pool, which determines an auto shrink strategy according to overall performance of the storage pool, thereby improving efficiency of auto shrink and balancing system performance and saving space.

The functions of a mainframe environment are expanded by leveraging the functions of an open environment. A second storage of an open system externally connected to a first storage of a mainframe system comprises a second main volume of an open environment generated in association with a main logical device of the second storage, and a second sub volume of an open environment generated in association with a sub logical device of the second storage; the first storage comprises a first main volume of a mainframe environment generated in association with the main logical device of the second storage, and a first sub volume of a mainframe environment generated in association with the sub logical device of the second storage; when the first storage receives a data processing request from a host, the first storage reflects the processing request in the second storage and completes the processing; and when the first storage receives an execution request of a prescribed function, the first storage causes the second storage to execute the function.

The operational performance and the I/O performance of Snapshots in a storage system are balanced. In a storage system, meta information of data appended to a log structured area is composed of meta information of a first tier and meta information of a second tier which correlate location information of data in a logical volume and location information of data in the log structured area. When creating a snapshot of the logical volume, a data management unit creates, in the same meta information area as a replication source, a replication of the meta information of the first tier stored in a plurality of meta information areas assigned to a plurality of controllers. A data control unit accesses the data of the log structured area from the logical volume, and accesses the data of the log structured area from the snapshot.

A memory system includes a memory device including memory blocks, and a controller configured to generate a result indicative of whether a number of free memory blocks satisfies a reference after beginning of garbage collection for the memory device, selectively perform a journaling operation for a request based on the result, and program data, collected by the garbage collection, in the memory device.

The disclosed technology relates to a system configured to detect a modification to a node in a tree data structure. The node is associated with a content item managed by a content management service as well as a filename. The system may append the filename and a separator to a filename array, determine a location of the filename in the filename array, and store the location of the filename in the node.

Modifying a clone image of a dataset, including: generating, based on metadata describing one or more updates to a dataset, a tracking copy of replica data on a target data repository; generating, after receiving an indication to begin accepting modifications to the tracking copy of the replica data, a cloned image of the dataset that is modifiable without modifying the tracking copy of the replica data; and responsive to a storage operation directed to the target data repository, modifying the cloned image of the dataset without modifying the tracking copy of the replica data.

In some examples, a data management system generates snapshots in a distributed file system based on a protocol or a user triggered event, The data management system identifies a snappable file in a distributed file system and a first data block in the snappable file, the first data block including data and attribute data. The system scans an index file to access the attribute data of the first data block and initiates construction of a patch file based on the accessed attribute data. The system repeats the scanning of the index file to access attribute data of at least a further second data block, the second data block including data and attribute data, and completes construction of the patch file based on the accessed attribute data of the first and second data blocks. The system generates conversion simulation information by collecting attribute data for all the data blocks of the constructed patch file, and writes the simulation information to a patch file image.

Methods and systems for generating a computer program for a governance, risk, compliance (GRC) system are described. In an example, a processor may detect a change among a plurality of objects in the GRC system. The processor may generate a snapshot of the plurality of objects in response to the detected change. The snapshot may include the detected change among the plurality of objects. The processor may train a machine learning model using the snapshot. The trained machine learning model may indicate relationships among a set of related objects, where the related objects may be among the plurality of objects. The processor may generate a computer program based on the trained machine learning model. The computer program may include a set of instructions for setting a field value of an object among the set of related objects.