Method, computer program and system for triggering backup of objects based on relevance of categories of changes to the objects - Patents.com

Abstract

To provide a method, a computer program and a system for triggering backups of objects based on relevance of categories of changes of the objects.SOLUTION: A solution is proposed for controlling backups of objects in an information technology system. A corresponding method comprises determining change categories of changes of the objects changed after a previous backup of the objects. The backups of the changed objects are triggered according to corresponding trigger indicators based on the change categories of the changes of the changed objects and on relevance weights of the changed objects.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates to the information technology field. More particularly, the present disclosure relates to backing up information technology systems. [Background technology]

[0002] Information technology systems typically store large amounts of data (e.g., related to business / production activities, services provided, etc.), including highly critical data. Data stored in such information technology systems can be (permanently) lost for several reasons. For example, this data loss can be due to failures (e.g., hardware crashes, data corruption, software bugs, supplier dissolution), disasters (e.g., fires, natural disasters), accidental actions (e.g., deletions, errors), or criminal attacks (e.g., theft, harmful code). If the data cannot be restored (e.g., in the case of transactions, passwords), the loss of data can have serious consequences. In either case, data loss incurs relatively high costs (e.g., due to the time spent recreating the data, due to the temporary unavailability of services based on the data loss).

[0003] Therefore, backups of data are performed regularly to avoid or at least limit the risk of data loss. Generally, a backup is a copy of data that can be used to restore the original version in case of data loss. For safety reasons, the backup is preferably stored in a location different from that of the original data (so that it is available even in case of disruption of the original data).

[0004] Typically, backups are performed periodically (e.g., nightly) or in response to a manual request (e.g., after a major update of data). Backups can be of various types. For example, a full backup relates to a complete copy of data. While full backups are easy to restore, they take time and occupy a large amount of storage space. An incremental backup relates only to changes relative to a previous backup (typically between less frequent successive full backups). An incremental backup is faster and occupies less storage space than other types of backups. However, a corresponding restore is time-consuming because it requires starting from the last full backup and then applying all subsequent incremental backups. A differential backup relates only to changes relative to a previous full backup. A differential backup is faster and occupies less storage space than a full backup, and its restore is faster than an incremental backup. However, a restore using a differential backup is slower than using a full backup, and a differential backup occupies more storage space than an incremental backup. Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention aims to provide a method, computer program and system for triggering backup of objects based on the relevance of categories of changes to the objects. [Means for solving the problem]

[0006] A simplified summary of the disclosure is presented herein in order to provide a basic understanding of the disclosure. However, its sole purpose is to introduce some concepts of the disclosure in a simplified form as a prelude to the more detailed description below, and it should not be construed as identifying its key elements or delineating its scope.

[0007] Broadly speaking, the present disclosure is based on the idea of triggering backups according to the relevance of changes.

[0008] In particular, exemplary embodiments provide a method for controlling backup of objects in an information technology system, the method including determining change categories of changes to the object that have been modified since a previous backup of the object, and triggering backup of the changed object according to a corresponding trigger indicator based on the change categories of the changes to the changed object and a relevance weight of the change category.

[0009] According to one aspect of the present invention, there is a method, computer program product, or system, or combination thereof, that performs the following operations (not necessarily in the order listed): detecting, by a computing system, one or more changed objects among objects that have been changed since a previous backup of objects; determining, by the computing system, corresponding changes for the changed objects; determining, by the computing system, corresponding change categories for the changes; calculating, by the computing system, corresponding trigger indicators for the changed objects according to the change categories of the changes of the changed objects and according to relevance weights of the change categories, respectively, wherein the relevance weights indicate the relevance of the corresponding change categories; selecting, by the computing system, one or more critical objects from the changed objects according to the trigger indicators of the changed objects; and triggering, by the computing system, corresponding backups of the critical objects.

[0010] The solution of the present disclosure, as well as further features and advantages thereof, will be best understood by referring to the following detailed description, given purely by way of non-limiting example, to be read in conjunction with the accompanying drawings (wherein, for simplicity, corresponding elements are designated by equal or similar reference numerals and their descriptions are not repeated, and the name of each entity is generally used to indicate both its type and its attributes, e.g., values, contents and representations), in which: [Brief explanation of the drawings]

[0011] [Figure 1A] FIG. 1A illustrates the general principle of the solution according to an embodiment of the present invention. [Figure 1B] FIG. 1B illustrates the general principle of the solution according to an embodiment of the present invention. [Figure 1C] FIG. 1C illustrates the general principle of the solution according to an embodiment of the present invention. [Figure 1D] FIG. 1D illustrates the general principle of the solution according to an embodiment of the present invention. [Figure 2] FIG. 2 shows a schematic block diagram of an information technology system according to one embodiment of the present invention. [Figure 3] FIG. 3 shows the main software components that may be used to implement a solution according to one embodiment of the present invention. [Figure 4A] FIG. 4A shows an activity diagram describing the flow of activity according to one embodiment of the present invention. [Figure 4B] FIG. 4B shows an activity diagram describing the flow of activity according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] With particular reference to FIGS. 1A-1D, the general principles of the solution according to an embodiment of the present disclosure are illustrated.

[0013] Starting with Figure 1A, an information technology system 100A has several objects that should be backed up to limit the risk of object loss. The objects are (software) artifacts that store data, e.g., files, databases, programs, etc. The objects that have been changed (since the object's previous backup) are detected. For each of these changed objects, its one or more (object) changes are determined. Figure 1A has: object 102A, object 104A, object 106A, object 108A, and change list 110A.

[0014] 1B, a (change) category for each change is determined (as shown by change list 110B in environment 100B). Each change category groups changes with similar properties together. For example, the change category may relate to content (e.g., document text, spreadsheet values / formulas, database fields), comments (e.g., statement / cell comments), or operational parameters (e.g., application, system, or network operational parameters).

[0015] 1C, a trigger indicator is calculated for each changed object (as illustrated by change list 110C in environment 100C) according to the change category of the object's changes and according to the relevance weights of the change categories (e.g., according to a weighted sum of the relevance weights). The relevance weight of each change category indicates the relevance of that change category (e.g., information technology system). For example, the relevance weight is high for key operational parameters and low for comments.

[0016] Turning to Figure 1D, possible critical objects are selected from the changed objects according to corresponding trigger indicators. For example, the critical objects are objects whose changes belong to a high-relevance change category (e.g., key operating parameters). Then, backup of the critical objects is triggered. Conversely, no action is taken for other changed objects, such as objects whose changes belong to a low-relevance change category (e.g., comments). Figure 1D includes: object 102D, object 104D, object 106D, object 108D, and change list 110D.

[0017] The above solution adds semantic functionality to the control of the backup: in fact, the backup becomes triggered according to the nature of the changes to the object (and not only according to the amount of changes or the type of object or a combination thereof, but also if the backup can be considered for this purpose).

[0018] In this way, backups can be performed when they are actually useful. This makes the control of backups more effective. For example, it is now possible to distinguish changes that are actually relevant (and then backed up as soon as possible) from other changes that are substantially irrelevant (and then may be backed up later). For example, if an object is affected by even a single major operating parameter change, its backup can be triggered immediately. Conversely, if an object (even an object of a related type) is affected by comment changes (even if there are many), its backup can be postponed.

[0019] As a result, it is possible to save time and storage space for data that is of relatively less importance, and at the same time reduce the risk of loss of very valuable data.

[0020] Referring now to FIG. 2, there is shown a schematic block diagram of an information technology system 200 in which a solution according to an embodiment of the present disclosure may be implemented.

[0021] The information technology system 200 comprises several server computing machines, or simply servers 205d and 205c, communicating among themselves via a (communications) network 210 (e.g., based on the Internet). The servers 205d and 205c comprise one or more data servers 205d and one (or more) control servers 205c. Each of the data servers 205d stores one or more objects to be backed up, which objects are used to implement the services (e.g., WAS, DBRM, SASG, etc.) provided by the data servers 205d. The control servers 205c control the backup of the objects stored on the data servers 205d.

[0022] Each of the servers 205d and 205c includes several units interconnected via a bus structure 215 with one or more levels. In particular, one or more microprocessors (μP) 220 provide the logical functions of the servers 205d and 205c. A non-volatile memory (ROM) 225 stores basic code for bootstrapping the servers 205d and 205c, and a volatile memory (RAM) 230 is used by the microprocessors 220 as working memory. The servers 205d and 205c include mass memory 235 for storing programs and data (e.g., storage devices in a data center where the servers 205d and 205c are implemented). Additionally, the servers 205d and 205c include several controllers or input / output (I / O) units 240 for peripheral devices. For example, peripheral device 240 connects servers 205d, 205c to a data center, and in turn connects it to a data center console (e.g., a personal computer also equipped with a drive for reading and writing removable storage units, e.g., USB keys) for its control, and to the data center's switch / router subsystem for its communication with network 210.

[0023] Referring now to FIG. 3, there are shown major software components that may be used to implement a solution according to an embodiment of the present disclosure.

[0024] In particular, all software components (programs and data) are generally designated by the reference numeral 300. The software components 300 are typically stored in mass memory and are loaded (at least partially) into the working memory of the servers 205d, 205c during program execution. The programs are installed in mass memory, for example, by being read from a removable storage unit or downloaded from a network, or a combination thereof. In this regard, each program may be a module, segment, or portion of code, which comprises one or more executable instructions for implementing a specified logical function.

[0025] Starting with each data server 205d (only one is shown in the figure), it includes the following components: The data server 205d stores corresponding objects to be backed up, indicated by reference numeral 305 (e.g., configuration files for WAS, databases for DBRM, documents for SASG, etc.). The configuration repository 310 defines configuration information for the backup of the objects 305. In particular, the configuration repository 310 lists the objects 305 to be backed up by their corresponding identifiers (e.g., their absolute file paths). The configuration repository 310 stores a control period for controlling backups according to trigger indicators and a mandatory period for performing backups indiscriminately (e.g., to comply with audit requirements). The mandatory period is strictly longer than the control period (e.g., equal to 10 to 50 times). In this way, backup control can be performed frequently (e.g., every 1-24 hours) to back up critical objects as soon as possible (fast process), while all objects are backed up less frequently (e.g., every 1-7 days) anyway (slow process). The configuration repository 310 stores inspection instructions (inspection instructions) for objects 305. For each type of object 305 (indicated by a corresponding identifier, e.g., file extension for configuration files, databases, documents, spreadsheets, etc.), the inspection instructions specify how to determine the object changes that belong to one or more change categories (e.g., parameters, permissions and comments for configuration files, fields, tables, permissions and comments for databases, text, documents, permissions and comments for cells, permissions and comments for spreadsheets, etc.).

[0026] The configuration repository 310 stores corresponding relevance weights for the (trigger) parameters used to calculate trigger indicators for the objects 305. In particular, the trigger parameters include all possible change categories of the objects 305. Moreover, the trigger parameters may also include the time since the previous backup of each of the objects 305, one or more subjects (indicated by corresponding identifiers, e.g., user IDs) defined by users of the data server 205d that may change the objects 305, all possible object types of the objects 305, and the frequency of changes of each of the objects 305.

[0027] A backup agent 315 performs a backup of objects 305. The backup agent 315 accesses objects 305 (in read mode) and copies them to a backup repository, which is stored in another server (not shown) at a remote location. A change detector 320 detects objects 305 that have changed since the object's previous backup. The change detector 320 accesses objects 305 (in read mode) and the configuration repository 310. A scheduler 325 activates the change detector 320 (according to a control period) and the backup agent 315 (according to a enforcement period). The scheduler 325 accesses the configuration repository 310 (in read mode). A change inspector 330 determines changes to objects 305. The change inspector 330 accesses the configuration repository 310 (in read mode), and the change inspector 330 exploits one or more tracking services 335. The tracking service 335 tracks changes in one or more change categories. The tracking service 335 can be either local (as shown in the figure) or remote, e.g., running on a control server 205c (not shown in the figure). For example, the tracking service 335 includes a Version Control Service (VCS), e.g., RCS, for determining changes in document / spreadsheet content (e.g., parameters, comments, text, and cells), and a pattern matching engine for determining changes in binary type objects via system / application logs or audit files (e.g., permissions, fields, tables).

[0028] Turning to the control server 205c, the control server 205c includes the following components: A change repository 340 represents the changes that have been determined in the data servers 205c. For example, the change repository has an entry for each changed object. The entry stores the identifier of the changed object, its object type, the change category of the corresponding change, the identifier of the data server 205d where the changed object is stored (e.g., its network address), the identifier of the subject that changed the subject, the identifiers of the possible objects (data server 205d and objects) affected by the change, the (backup) result (success or failure), and the possible backup (backup) time of the changed object. The change repository 340 is accessed (in write mode) by the change inspectors 330 of all data servers 205c.

[0029] A dependency detector 345, such as IBM Tivoli Application Dependency Discovery Manager (TADDM) by IBM Corporation (a trademark of IBM Corporation), detects objects affected by any changed object in the information technology system, either in the same data server or in different data servers. The dependency detector 345 accesses (in a read / write mode) a system topology repository 350, which stores the system topology of the information technology system defined by the correlations between those objects (e.g., defined by clusters, dependencies, etc.). A backup manager 355 manages the control of backups of the data server 205d. For example, the backup manager 355 is implemented by a neural network based on a linear regression model.

[0030] A neural network is a data processing component that approximates the operation of the human brain. It contains basic processing elements (neurons), which perform operations defined by activation functions based on corresponding weights. The neurons are connected via unidirectional channels (synapses) that transfer information between them. Each neuron is organized into multiple layers, each performing a different operation. It always has an input layer and an output layer for receiving input information and providing output information. In a linear regression model, a neural network has only two layers (i.e., an input layer and an output layer, with no deep layers between them), and the activation function is linear. The backup manager 355 accesses the change repository 340 (in read mode), which controls the backup agents 315 of all data servers 205d. The training module 360 trains the neural network of the backup manager 355 using supervised learning techniques. Training a neural network is the process of finding weight values that optimize the performance of the neural network. In supervised learning techniques, training is based on a training set of input information and corresponding output information, which has been manually validated. Training module 360 accesses (in read mode) configuration repository 310 of all data servers 205d, and receives corresponding feedback indicators of backups entered by an operator. Each feedback indicator indicates the utility of the corresponding backup. Anomaly detector 365 detects possible anomalies in the changes of changed objects with respect to the system topology of the information technology system. Anomaly detector 365 accesses (in read mode) change repository 340 and system topology repository 350.

[0031] 4A-4B, activity diagrams are shown that describe the flow of activities involved in implementing a solution according to one embodiment of the present disclosure.

[0032] In particular, the activity diagram represents an exemplary process that may be used to control backups in an information technology system using method 400. In this regard, each block may correspond to one or more executable instructions at each workstation for implementing a specified logical function.

[0033] Starting from a swim-lane of the generic data server, the process passes from block 402 to block 404 whenever the scheduler detects that a control period (from a previous control of backup) has expired. In response, a loop is entered using a change detector that takes into account the (current) objects listed in the configuration repository (starting with the first object in any order). In block 406, the change detector verifies whether the object has been modified since its last backup. For this purpose, for example, the change detector registers with a corresponding API of the data server's operating system and receives a notification every time an object is modified. In response, the change detector asserts a corresponding change flag (which is deasserted every time the object is backed up). The flow of activity branches in block 408 according to the result of this verification. If the object has been modified (the change flag is asserted), in block 410, the change inspector determines the object type of the modified object (according to its file extension). At block 412, the change inspector determines the changes of the changed object (via the inspection command corresponding to that object type). Accordingly, at block 414, the change inspector determines the change category of the change (in response to the detection of the change by the corresponding tracking service). At block 416, the change inspector determines the subject that changed the changed object (e.g., from its metadata). At block 418, the change inspector uploads the information so determined about the changed object (indicated by its identifier) (i.e., object type, change category, and subject) along with the data server identifier to the control server. The process then continues at block 420. If the object has not changed (the change flag is deasserted), the process returns to the same point directly from block 408. At this point, the change detector verifies whether the last object has been processed.If not, the process returns to block 404 to repeat the same operations for the next object. Conversely, if all objects have been processed, the loop terminates by returning to block 402 to await the expiration of the next control period.

[0034] Referring to the control server swimlane, information about any changed objects being uploaded by the corresponding data server (in this case, at block 418) is added to the change repository (in its corresponding (new) entry) at block 422. At block 424, the backup manager determines the time elapsed since the previous backup of the same changed object (equal to the difference between the current time and the backup time of the most recent entry with the same identifier for the changed object in the change repository). At block 426, the backup manager determines the change frequency of the changed object (equal to the average difference between the backup times of each pair of consecutive entries with the identifier for the changed object in the change repository). At block 428, the backup manager determines input information for its neural network according to the trigger parameters of the changed object. In particular, the trigger parameters include the change category, elapsed time, subject, object type, and change frequency of the changed object. The input information instead includes a (category) flag corresponding to a change category (asserted for the changed object's change category and deasserted otherwise), an elapsed time, a corresponding (subject) flag for the subject (asserted for the changed object's subject and deasserted otherwise), a (type) flag corresponding to the object type (asserted for the changed object's object type and deasserted otherwise), and a change frequency. The change manager then applies the input information to a neural network, which then provides corresponding output information having trigger indicators for the changed objects (e.g., ranging from 0 to 1 in ascending order of the changed object's backup usefulness).

[0035] The flow of activity branches at block 430 according to the trigger indicator. If the trigger indicator is (perhaps strictly) higher than the trigger threshold (e.g., 0.6-0.8), this means that backing up the changed object is likely to be very useful. Therefore, at block 432, the dependency detector determines possible objects that may be affected (directly or indirectly) by the change of the changed object, and the dependency detector updates the change repository accordingly. To this end, the dependency detector determines affected objects that are correlated with the changed object (according to the system topology of the corresponding repository), (further) affected objects that are correlated with these affected objects, and so on, until no more affected objects are determined. At block 434, the backup manager triggers backup of the changed object and its affected objects on the corresponding data servers, which may be the same or different from each other (as indicated in the change repository). In this way, a consistent configuration of the information technology system (given by the changed object and its affected objects) can be backed up. For example, in the case of changes to a WAS application, the WAS application is backed up together with the corresponding database. The process then returns from block 434 (if the trigger indicator is (perhaps strictly) below the trigger threshold, meaning that backing up the changed object is likely to be completely useless), or directly from block 430, to block 422 to await the upload of information regarding the next changed object.

[0036] In block 434 (the same as the block mentioned above in the figure), as the backup moves to the swim lane of each data server triggered by the control server, the backup agent is activated accordingly in block 436 for the changed / affected objects stored in the data server. The same point is reached again from block 438 whenever the scheduler detects that the enforcement period has expired since the previous (complete) backup of the data server. In this case, the backup agent is activated for all objects of the data server listed in the configuration repository. In both cases, in block 440, the backup agent copies the objects to be backed up to the backup repository. In block 442, the backup agent returns the backup result (success or failure for the corresponding object) to the control server. The process then returns to block 436 to await the next activation of the backup agent.

[0037] Referring again to the control server, at block 444, the backup manager receives the backup results (from block 442 in the example in question) from any data servers. In response to this, at block 446, the control manager updates the corresponding entry in the change repository accordingly (by adding the backup results and setting the backup time to the current time). The process then returns to block 444 to wait for the next backup result.

[0038] The process passes from block 448 to block 450 whenever a (training) event occurs that triggers training of the backup manager's neural network by the training module in a completely independent manner. For example, this occurs in response to the addition of a (new) data server to the information technology system (manually notified by an operator) or the execution of a (previous) backup (notified by the backup manager). The flow of activity then branches according to the training event. In particular, in the case of a new (new) data server, blocks 452-454 are executed, while in the case of a previous backup, blocks 456-460 are executed. In both cases, the process then returns to block 448 to await the next training event. With particular reference to block 452 (new data server), the training module obtains relevance weights from the configuration repository for the new data server (they are set to random values either manually or automatically by an operator). In block 454, the training module initializes the neural network accordingly. In the particular example of the problem (a neural network based on a linear regression model), the neural network has an input layer with corresponding neurons for all data server trigger parameters (change category, elapsed time, subject, object type, and change frequency), and an output layer with a single neuron for the trigger indicator. The activation function of each neuron in the input layer multiplies the portion of the input information corresponding to that trigger parameter by its relevance weight, and the activation function of a neuron in the output layer sums the results provided by all neurons in the input layer. Therefore, the trigger indicator is calculated as a (weighted) sum corresponding to the trigger parameters.

[0039]

number

[0040] where TI is the trigger indicator (e.g., further normalized to the range 0–1), Ncc is the number of change categories, and Wcc i is the relevance weight of the ith change category, and Fcc i is the category flag of the ith change category (1 if asserted and 0 if deasserted), Wet is the relevance weight of the elapsed time, te is the elapsed time, Nu is the number of subjects, and Wu i is the relevance weight of the i-th subject, and Fu i is the subject flag of the i-th subject (1 if asserted, 0 if deasserted), Not is the number of object types, and Wot i is the relevance weight of the i-th object type, and Fot iwhere ω is the type flag of the i-th object type (1 if asserted, 0 if deasserted), Wcf is the relevance weight of the change frequency, and fc is the change frequency. Referring now to block 456 (previous backup), the training module prompts the operator to input a corresponding feedback indicator (according to its usefulness). For example, the feedback indicator ranges from 0 (the previous backup was deemed completely useless) to 1 (the previous backup was deemed completely useful). In block 458, the training module obtains (from the change repository) trigger parameters used to calculate the trigger indicator of the previous backup. In block 460, the training module trains a neural network (for the backup object) according to the trigger parameters and the feedback indicator. For example, the training is an iterative process based on the Stochastic Gradient Descent (SGD) algorithm. In this case, the training module determines a change in the relevance weight that should reduce the difference between the trigger indicator (provided by the neural network in response to input information corresponding to the trigger parameter) and the feedback indicator (considered to be its correct value). The direction and amount of change is given by the gradient of the error function with respect to the relevance weights, which is approximated using a backpropagation algorithm. The same operation is repeated until an acceptable difference (between the trigger indicator and the feedback indicator) is obtained, or until changing the relevance weights no longer provides any significant improvement (i.e., a minimum, or at least a local, or flat region of the error function, has been found). The relevance weights are modified with the addition of random noise to find various (and better, possible) local minima and identify flat regions of the error function. In this way, the relevance weights self-adapt over time to automatically improve the accuracy of the neural network.

[0041] In a completely independent manner, the process passes from block 462 to block 464 each time a (validation) event occurs that triggers a change validation. In response, the anomaly detector retrieves (from the corresponding repository) information about changes detected since the previous validation, such as, for each of them, the change category and the identifier of the data server. In block 466, the anomaly detector validates these changes against the system topology (from the corresponding repository), for example, according to one or more validation rules. The flow of activity branches in block 468 according to the result of this validation. If one or more (non-compliant) changes do not conform to the system topology, in block 470, the anomaly detector detects a corresponding anomaly. For example, this occurs when a key operating parameter is changed only in a subset of a group of data servers that contribute to providing a certain service. A typical scenario is when a data server is a node of a cluster (such as a WAS-type) that functions as a single logical entity (providing a service in response to corresponding requests sent to it, which are automatically distributed among all data servers of the cluster that perform the same task). In this case, the anomaly detector outputs a corresponding error message (e.g., by displaying it on a monitor of the control server). For example, the error message indicates each non-compliant change along with a description of the non-compliance with the system topology. In this way, an operator may intervene quickly to correct the anomaly. The process then returns to block 462 from block 470, or directly from block 468 (if no anomaly is detected), to wait for the next validation event.

[0042] Naturally, those skilled in the art may apply many logical or physical modifications and changes, or combinations thereof, to the present disclosure to meet local and specific requirements. More specifically, while the present disclosure has been described with a certain degree of particularity with reference to one or more embodiments thereof, it should be understood that various omissions, substitutions, and changes in form and details, as well as in other embodiments, are possible. In particular, different embodiments of the present disclosure may even be practiced without specific details (e.g., numerical values) set forth in the foregoing description to provide a more thorough understanding thereof. Conversely, well-known functions may be omitted or simplified so as not to obscure the description with unnecessary detail. Furthermore, it is expressly intended that specific elements or method steps, or combinations thereof, described in connection with any embodiment of the present disclosure, may be incorporated into any other embodiment as a matter of general design choice. Furthermore, items presented in the same group and different embodiments, examples, or alternatives should not be construed as de facto equivalents to each other (but are separate and autonomous entities). In all cases, each numerical value should be read as modified according to the applicable tolerance. In particular, unless otherwise specified, terms such as "substantially," "about," "approximately," etc., should be understood as within 10%, preferably 5%, and even more preferably 1%. Moreover, each range of numerical values should be intended to explicitly identify any possible number along a continuum within the range, including its endpoints. Ordinal numbers or other qualifiers are used merely as labels to distinguish between like-named elements and do not in themselves imply any priority, precedence, or order.The terms "include," "comprise," "have," "contain," "involve," and the like are intended to be open, non-exhaustive (i.e., not limited to the listed items), and like terms are intended to be non-exclusive (i.e., including possible additional variables), the term "a / an" is intended to mean one or more items (unless otherwise expressly stated), and the term (or any means-plus-function formulation) is intended to mean any structure adapted or configured to perform the associated function.

[0043] For example, one embodiment provides a method for controlling the backup of objects in an information technology system, although the objects may be of any number and any type (e.g., partial, different, or additional objects relative to those described above) and they may be provided in any information computing system (e.g., any information computing system with a distributed architecture, a standalone architecture, stored on any number and types of physical / virtual computing machines, etc.).

[0044] In one embodiment, the method comprises the following steps under the control of a computing system: However, the computing system may be of any type (see below).

[0045] In one embodiment, the method includes detecting (by a computing system) one or more changed objects among the objects that have changed since a previous backup of the objects. However, the changed objects may be detected in any manner (e.g., by subscribing to corresponding notifications, by polling the objects, etc.). In either case, the changed objects may be detected centrally (by receiving an indication thereof from a computing machine on which the objects are stored) or locally (directly in the respective objects).

[0046] In one embodiment, the method includes determining (by the computing system) corresponding changes to the modified objects. However, the changes may be of any type (e.g., related to content, metadata, permissions, etc.), and the changes may be determined in any manner (e.g., in a local tracking service that is partially different from or additional to the ones described above, in a centralized tracking service such as GIT, etc.). In either case, the changes may be determined centrally (by receiving an indication thereof from a computing machine on which the objects are stored) or locally (directly in the respective objects).

[0047] In one embodiment, the method includes determining (by the computing system) corresponding change categories of the changes. However, the changes may be of any number and type (e.g., partial, different, or additional change categories relative to those above), and the changes may be determined in any manner (e.g., defined directly by the tracking service that determined the corresponding changes by distinguishing between various change categories of the same tracking service according to corresponding rules, such as global and local parameters in a configuration file, values and schemas in a database, etc.). In any case, the change categories may be determined centrally (by receiving an indication thereof from a computing machine on which the objects are stored) or locally (directly in each object of the objects).

[0048] In one embodiment, the method includes calculating (by the computing system) a corresponding trigger indicator for the modified object. However, the trigger indicator may be of any type (e.g., an index that may be discrete / continuous within any range, Boolean, etc.), and the trigger indicator may be calculated in any manner (e.g., machine learning techniques, algorithms, etc.).

[0049] In one embodiment, each trigger indicator is calculated according to the change category of the change of the changed object and according to the relevance weight of the change category. However, the trigger indicator may be calculated according to the change category and the relevance weight in any way (e.g., based on a linear / non-linear function, e.g., a weighted sum, a logarithmic / exponential combination, according to the change category only, or further according to other trigger parameters, partially, different from, or additional to the above, etc.).

[0050] In one embodiment, the relevance weights indicate the relevance of the corresponding change categories, but the relevance weights may indicate the relevance of change categories for any purpose (e.g., for an information technology system, its users, its organizations, etc.) and in any manner (e.g., increasing / decreasing their values on / off, according to linear / nonlinear laws).

[0051] In one embodiment, the method includes selecting (by the computing system) one or more critical objects of the changed objects according to trigger indicators of the changed objects, although the critical objects may be selected in any manner (e.g., by comparing the trigger indicators with any static / dynamic thresholds, directly according to the logic values of the trigger indicators, according to the trend of the values of each trigger indicator over time, etc.).

[0052] In one embodiment, the method includes triggering (by the computing system) corresponding backups of the critical objects. However, the backups of the critical objects may be triggered in any manner (e.g., by having them executed on another computing machine on which the critical objects are stored, or by executing them directly on the same computing machine for each of the critical objects or for a group thereof stored on the same computing machine, etc.).

[0053] Further embodiments provide additional advantageous features, however, which may be omitted altogether in the basic implementation.

[0054] In particular, in one embodiment, the method includes receiving (by the computing system) a corresponding feedback indicator of the backup indicating the usefulness of the backup. However, the feedback indicator may be of any type (e.g., either the same or different with respect to the trigger indicator), and the feedback indicator may be received in any manner (e.g., entered locally, transmitted from a computing machine on which the backup was being performed, etc.).

[0055] In one embodiment, the method includes updating (by the computing system) the relevance weights according to the feedback indicators. However, the relevance weights may be updated in any manner (e.g., using machine learning techniques, using adaptive algorithms, etc.) and at any time (e.g., after every backup, after a predefined number of backups, periodically, etc.).

[0056] In one embodiment, the method includes updating (by the computing system) the relevance weights according to the feedback indicators using machine learning techniques, which may be of any type (e.g., neural networks trained based on any method, such as Stochastic Gradient Descent, Real-Time Recurrent Learning and similar algorithms, based on linear regression, convolutional and similar types, etc.).

[0057] In one embodiment, the method includes determining (by the computing system) one or more possible affected objects that are affected by the change of each of the critical objects. However, the affected objects may be any number (down to none) and any type (e.g., only directly affected by the changed object, indirectly affected at any level, or affected within a maximum level, etc.). The affected objects may be determined in any manner. For example, it is possible to determine the objects affected by each critical object, determine the objects affected by each changed object, and then calculate the trigger indicators of the objects to select the critical objects from all of them.

[0058] In one embodiment, the affected objects are determined according to the object correlations between the objects, although the object correlations can be of any type (e.g., clusters, dependencies, prerequisites, interactions, etc.).

[0059] In one embodiment, the method includes triggering (by the computing system) a corresponding backup of the affected objects for each of the critical objects, although the backup of the affected objects may be triggered in any manner (same or different with respect to the critical objects).

[0060] In one embodiment, the information technology system comprises a plurality of computing machines, each storing one or more objects, although the computing machines may be of any number and type, each storing any number of objects (e.g., physical / virtual machines communicating over any local, wide area, global, cellular, or satellite network, using any type of wired or wireless connection or combination thereof).

[0061] In one embodiment, the method comprises (by the computing system) Multiple Triggering the backup of the critical object and of the corresponding affected objects at a corresponding one of the computing machines, however, this result may be achieved in any manner (e.g., via a remote command, message, etc.).

[0062] In one embodiment, the method includes detecting (by the computing system) one or more anomalies according to a comparison of the changes to the object correlations, although the anomalies may be detected in any manner (e.g., using compliance rules, artificial intelligence techniques, etc.).

[0063] In one embodiment, the method includes outputting (by the computing system) an indication of the anomaly, although the indication of the anomaly may be detected in any manner (e.g., by displaying, printing, remotely notifying, etc.).

[0064] In one embodiment, the method includes calculating (by the computing system) the trigger indicator for each of the modified objects further according to the time elapsed since a previous one of the backups of the modified object. However, the trigger indicator may be calculated according to the time elapsed (e.g., according to any corresponding relevance weight, the same or different as above, according to its value or a predefined range thereof, etc.) down to zero in any manner.

[0065] In one embodiment, the method includes calculating (by the computing system) the trigger indicator for each of the modified objects further according to the corresponding subject that performed the modification of the modified object. However, the trigger indicator may be calculated according to subject (e.g., according to any corresponding relevance weight, the same or different as above, for subjects individually or for their roles) in any manner down to zero.

[0066] In one embodiment, the method includes calculating (by the computing system) the trigger indicator for each of the modified objects further according to the object type of the modified object. However, the trigger indicator may be calculated according to the object type in any way down to zero (e.g., according to any corresponding relevance weight, the same or different as above, using object types defined in any way, e.g., file extensions, logical functions, etc.).

[0067] In one embodiment, the method includes determining (by the computing system) a corresponding modification frequency of the modifications of the modified object. However, the modification frequency may be determined in any manner (e.g., over any number of previous backups, where the backups are notified, triggered, or performed, or triggered and performed, locally or remotely, etc.).

[0068] In one embodiment, the method includes calculating (by the computing system) the trigger indicator for each of the modified objects further according to the modification frequency of the modified object. However, the trigger indicator may be determined according to the modification frequency in any manner down to zero (e.g., according to any corresponding relevance weight, the same or different in respect of the above, according to its value or a predefined range thereof, etc.).

[0069] In one embodiment, the method includes triggering (by the computing system) a backup of the object in response to a maximum delay since a previous one of the backups. However, the maximum delay may have any value (individually or globally), and the maximum delay may be used to trigger indiscriminate backups of the object in any manner (e.g., for each object associated with a previous backup of the object, for all objects on all computing machines associated with any previous backup of the object, for all objects on an information technology system associated with any previous backup of the object, etc.).

[0070] In one embodiment, the method includes performing each of the backups in response to triggering the backup (by the computing system), however, the backups may be performed in any manner (e.g., by copying the corresponding objects to a local / remote disk, tape, etc., by the same or a different computing machine than the computing machine that triggers them, etc.).

[0071] Generally, similar considerations apply if the same solution is implemented using an equivalent method (by using more steps or some of the same steps with the same functionality, by removing some unnecessary steps, or by adding further optional steps), and these steps may also be performed (at least in part) in a different order, simultaneously, or in an interleaved manner.

[0072] One embodiment provides a computer program configured to cause a computing system to perform the above-described method. One embodiment provides a computer program product, the computer program product having a computer-readable storage medium with program instructions embedded therein. The program instructions are executable by a computing system to cause the computing system to perform the same method. However, the computer program may also be implemented as a stand-alone module, as a plug-in for, or directly within, an existing software program (e.g., a backup application). Moreover, the computer program may be executed on any computing system (see below). In any case, the solution according to the embodiments of the present disclosure is suitable for implementation itself in a hardware structure (e.g., by electronic circuitry integrated within one or more chips of semiconductor material), or even using a combination of appropriately programmed or otherwise configured software and hardware.

[0073] One embodiment provides a system comprising means configured to perform the steps of the above-described method. One embodiment provides a system comprising circuitry (i.e., any hardware suitably configured, e.g., by software) for performing each step of the above-described method. However, the system may be of any type (e.g., a control computing machine controlling one or more computing machines on which objects are stored, each computing machine, a combination of the control computing machine and the data computing machine, etc.).

[0074] In general, similar considerations apply if the system has differently structured or equivalent components or if the system has other operational characteristics. In either case, all of the components may be separated into more elements, or two or more components may be combined together into a single element. Moreover, each component may be replicated to support parallel execution of corresponding operations. Moreover, unless otherwise specified, interactions between different components generally need not be sequential, and interactions between different components may be either direct or indirect via one or more intermediaries.

[0075] The present invention may be a system, method, or computer program product, or combination thereof, at any level of technical detail that may be integrated. The computer program product may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the present invention. The computer-readable storage media may be a tangible device capable of holding and storing instructions for use by an instruction-execution device.

[0076] The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as a punch card or a ridge structure in a groove in which instructions are recorded, or any suitable combination thereof.

[0077] As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses traveling through a fiber optic cable), or electrical signals transmitted over electrical wires. The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to an individual computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may be comprised of copper transmission cables, optical fiber, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to the individual computing / processing device for storage in a computer-readable storage medium.

[0078] The computer-readable program instructions for carrying out operations of the present invention may be either assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, such as object-oriented programming languages, object-oriented programming languages (e.g., Smalltalk, C++, etc.), procedural programming languages (e.g., the "C" programming language or similar programming languages), etc. The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, partially on a user's computer as a stand-alone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, such as a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., over the Internet using an Internet Service Provider).

[0079] In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions by utilizing state information from the computer-readable program instructions to personalize the electronic circuitry to perform aspects of the invention. Aspects of the invention are described herein with reference to flowchart illustrations or block diagrams, or combinations thereof, of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations, block diagrams, or combinations thereof, and combinations of blocks in the flowchart illustrations, block diagrams, or combinations thereof, can be implemented by computer-readable program instructions. These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing device to create a machine, such that the instructions, executing via the processor of the computer or other programmable data processing device, generate means for implementing the functions / acts identified in one or more blocks of the flowchart illustrations, block diagrams, or combinations thereof.

[0080] These computer-readable program instructions may also be stored in a computer-readable storage medium capable of instructing a computer-programmable data processing apparatus or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium having stored thereon instructions comprises an article of manufacture containing instructions that implement aspects of the functions / operations identified in one or more blocks of the flowchart or block diagram, or combination thereof. The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to produce a computer-implemented process, such that the instructions, which execute on the computer, other programmable data processing apparatus, or other device, implement the functions / operations identified in one or more blocks of the flowchart or block diagram, or combination thereof.

[0081] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing one or more specified logical functions. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be accomplished as a single step performed simultaneously, substantially simultaneously, partially, or fully in a time-overlapping manner, depending on the functionality involved, or the blocks may be performed in the reverse order. It should be noted that each block of the block diagrams or flowchart diagrams or combinations thereof, and combinations of multiple blocks in the block diagrams or flowchart diagrams or combinations thereof, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations, or may execute a combination of special-purpose hardware and computer instructions.

Claims

1. the computing system detecting one or more changed objects among the objects that have been changed since a previous backup of the objects; the computing system determining corresponding changes to the changed object; the computing system determining a corresponding change category of the change; the computing system respectively calculating corresponding trigger indicators of the changed objects according to the change categories of the changes of the changed objects and according to relevance weights of the change categories, where the relevance weights indicate the relevance of the corresponding change categories; the computing system selecting one or more critical objects of the changed objects according to a trigger indicator of the changed objects; the computing system triggering a corresponding backup of the critical object; receiving, by the computing system, a corresponding feedback indicator of the backup indicating the usefulness of the backup; and the computing system updating the relevance weights according to the feedback indicators. A method comprising:

2. The method of claim 1, wherein each feedback indicator indicates the utility of the corresponding backup.

3. the computing system updates the relevance weights according to the feedback indicators using machine learning techniques. The method of claim 1 or 2, further comprising:

4. The computing system determines one or more possible affected objects of an object that are affected by the change of each of the critical objects according to object correlations between the objects; and the computing system triggering a corresponding backup of the affected objects for each of the critical objects. The method of claim 1 further comprising:

5. the computing system causing the backup of the critical object and the corresponding affected object at a corresponding one of a plurality of computing machines. The method of claim 4 further comprising:

6. the computing system detecting one or more anomalies according to a comparison of the changes to the object correlations; and said computing system outputting an indication of the anomaly; The method of claim 4 or 5, further comprising:

7. the computing system calculating the trigger indicator for each of the modified objects further according to the time elapsed since a previous one of the backups of the modified object. The method of any one of claims 1 to 6, further comprising:

8. the computing system calculating the trigger indicator for each of the modified objects further according to a corresponding subject that performed the modification of the modified object. The method of any one of claims 1 to 6, further comprising:

9. the computing system calculating the trigger indicator for each of the modified objects further according to the object type of the modified object. The method of any one of claims 1 to 6, further comprising:

10. the computing system determining a corresponding change frequency of the change of the changed object; and the computing system calculating the trigger indicator for each of the modified objects further according to the modification frequency of the modified object. The method of any one of claims 1 to 6, further comprising:

11. The computing system triggers a backup of the object in response to a maximum delay since a previous backup of the backups. The method of any one of claims 1 to 6, further comprising:

12. the computing system executing each of the backups in response to triggering the backups. The method of any one of claims 1 to 11, further comprising:

13. In a computing system, detecting one or more changed objects among the objects that have changed since a previous backup of the objects; determining corresponding changes to the modified object; determining a corresponding change category for said change; calculating corresponding trigger indicators of the changed objects according to the change categories of the changes of the changed objects and according to relevance weights of the change categories, respectively, where the relevance weights indicate the relevance of the corresponding change categories; selecting one or more critical objects of the changed objects according to a trigger indicator of the changed objects; triggering a corresponding backup of said critical objects; receiving a corresponding feedback indicator of the backup indicating its usefulness; and updating the relevance weights according to the feedback indicators; A computer program that executes the following:

14. The computer program of claim 13, wherein each feedback indicator indicates the utility of a corresponding backup.

15. The computing system includes: updating the relevance weights according to the feedback indicators using machine learning techniques; 15. The computer program product according to claim 13 or 14, further comprising:

16. The computing system includes: determining one or more possible affected objects of the object affected by the change of each of the critical objects according to object correlations between the objects; and Triggering a corresponding backup of the affected objects for each of the critical objects.

14. The computer program product of claim 13, further comprising:

17. The computing system includes: calculating the trigger indicator for each of the modified objects further according to the time elapsed since a previous one of the backups of the modified object; The computer program according to any one of claims 13 to 16, further comprising:

18. The computing system includes: determining a corresponding change frequency of the change of the changed object; and calculating the trigger indicator for each of the modified objects further according to the frequency of modification of the modified object; The computer program according to any one of claims 13 to 16, further comprising:

19. The computing system includes: triggering a backup of the object in response to a maximum delay since a previous one of the backups; and performing, by the computing system, a backup of the object in response to the triggering. The computer program according to any one of claims 13 to 16, further comprising:

20. 13. A system for controlling the backup of objects in an information technology system, the system comprising a processor and one or more computer-readable storage media having computer-readable program instructions, causing the processor to perform the steps of the method of any one of claims 1 to 12.

Images