A computer readable storage medium may be, for example, but not limited to, an elec- tronic, magnetic, optical, or semiconductor system, appara- tus, or device, or any suitable combination of the foregoing.

A virtual machine image typically emulates a physical computing environment, but requests for central processing unit (CPU), memory, hard disk drive, network interface card, and other hardware resources are managed by a virtualization layer that translates these requests to the underlying physical hardware.

[0029] Clients 110, 112, and 114 may be, for example, mobile data processing systems, such as cellular telephones, smart phones, personal digital assistants, gaming devices, or handheld computers, with wireless communication links to network 102.

For example, sanitization policies 236 may define that passwords and cryptographic keys having an attached high sensitivity level label within a virtual machine are to be deleted.

[0046] Program code 240 is located in a functional form on computer readable media 242 that is selectively removable and may be loaded onto or transferred to data processing system 200 for running by processor unit 204.

Anand Prahlad, East Brunswick, Anand Prahlad, East Brunswick, Anand Prahlad, East Brunswick, NJ (US); Rahul S. Pawar, NJ (US); Rahul S. Pawar, NJ (US); Rahul S. Pawar, Marlboro, NJ (US); Prakash Marlboro, NJ (US); Prakash Marlboro, NJ (US); Prakash Varadharajan, Oceanport, NJ Varadharajan, Oceanport, NJ Varadharajan, Oceanport, NJ (US); Pavan Kumar Reddy (US); Pavan Kumar Reddy (US); Pavan Kumar Reddy Bedadala, Ocean, NJ (US) Bedadala, Ocean, NJ (US) Bedadala, Ocean, NJ (US) Correspondence Address: Correspondence Address: Correspondence Address: PERKINS COE LLP PERKINS COIE LLP PERKINS COIE LLP

Provisional Patent Application No. 61/169,515 filed Apr. 15, Provisional Patent Application No. 61/169,515 filed Apr. 15, 2009 (entitled SYSTEMS AND METHODS FOR MAN 2009 (entitled SYSTEMS AND METHODS FOR MAN- AGEMENT OF VIRTUALIZATION DATA, Attorney AGEMENT OF VIRTUALIZATION DATA, Attorney Docket No. 60692-8050US02), each of which is incorporated Docket No. 60692-8050US02), each of which is incorporated by reference herein in its entirety.

Accordingly, a system that enables the granular restoration of any data (e.g., indi that enables the granular restoration of any data (e.g., indi- vidual files or directories) within a virtual machine using any vidual files or directories) within a virtual machine using any type of operating system would have significant utility.

Accordingly, a system that provides automatic identification of virtual machines that that provides automatic identification of virtual machines that are to be backed up at the time of the backup operation would are to be backed up at the time of the backup operation would have significant utility.

0018 FIG.10 is a block diagram illustrating an example of [0018] FIG. 10 is a block diagram illustrating an example of a data storage enterprise that may employ aspects of the a data storage enterprise that may employ aspects of the invention.

In this work, we present ImageElves, a system to rapidly, reliably and automatically propagate updates system to rapidly, reliably and automatically propagate updates (e.g., patches, software installs, compliance checks) in a data (e.g., patches, software installs, compliance checks) in a data center.

In this work, we propose ImageElves to rapidly, reliably, and automatically we propose ImageElves to rapidly, reliably, and automatically propagate system updates (e.g., patches, software installs, propagate system updates (e.g., patches, software installs, compliance checks) to dormant as well as live virtual machine compliance checks) to dormant as well as live virtual machine images in a data center.

Since ImageElves is designed to be content-oblivious (i.e., does not use expert is designed to be content-oblivious (i.e., does not use expert knowledge about the actual actions performed by updates), knowledge about the actual actions performed by updates), discarding the PoVs or random attributes while classifying discarding the PoVs or random attributes while classifying files is challenging.

This process applied on dormant VMs involved booting up the VM, copying necessary dormant VMs involved booting up the VM, copying necessary files over, running the update installer or script over an files over, running the update installer or script over an ssh connection, and then shutting down VM, similar to the ssh connection, and then shutting down VM, similar to the Microsoft Virtual Machine Servicing Tool [14].

The related work to ImageElves can broadly be classified The related work to ImageElves can broadly be classified into semantic mining of virtual servers, online system man- into semantic mining of virtual servers, online system man- agement tools, and offline updation tools.

“Products.” Articles published on the Internet, “Revolutionary Secu "Products," Articles published on the Internet, "Revolutionary Secu- rity for a New Computing Paradigm' regarding SurfinGateTM, 7 pp. rity for a New Computing Paradigm" regarding SurfinGateTM 7 pp. “Release Notes for the Microsoft ActiveX Development Kit,” Aug. "Release Notes for the Microsoft ActiveX Development Kit," Aug. 13, 1996, activex.adsp.or.jp/inetsdk/readme.txt, pp. 1-10.

The present invention is preferably used within a network The present invention is preferably used within a network gateway or proxy, to protect an intranet against viruses and gateway or proxy, to protect an intranet against viruses and This application is a continuation-in-part of assignee's This application is a continuation-in-part of assignee's other malicious mobile code.

There is further provided in accordance with a preferred There is further provided in accordance with a preferred embodiment of the present invention a computer-readable embodiment of the present invention a computer-readable storage medium storing program code for causing a computer 65 storage medium storing program code for causing a computer to perform the steps of receiving content from the Internet on to perform the steps of receiving content from the Internet on its destination to an Internet application, selectively diverting its destination to an Internet application, selectively diverting Conventional anti-virus Software scans a computer file sys Conventional anti-virus software scans a computer file sys- tem by searching for byte patterns, referred to as signatures tem by searching for byte patterns, referred to as signatures that are present within known viruses.

Another drawback with prior art network security software Another drawback with prior art network security software is that it is unable to recognize combined attacks, in which an is that it is unable to recognize combined attacks, in which an exploit is split among different content streams.

FIG. 6 is a simplified flowchart of operation of a parser for FIG. 6 is a simplified flowchart of operation of a parser for a specific content language within an ARB content Scanner, in a specific content language within anARB content scanner, in accordance with a preferred embodiment of the present accordance with a preferred embodiment of the present invention; invention; FIG. 7 is a simplified block diagram of a system for seri FIG. 7 is a simplified block diagram of a system for seri- alizing binary instances of ARB content scanners, transmit alizing binary instances of ARB content scanners, transmit- ting them to a client site, and regenerating them back into ting them to a client site, and regenerating them back into binary instances at the client site, in accordance with a pre binary instances at the client site, in accordance with a pre- ferred embodiment of the present invention; ferred embodiment of the present invention; FIG. 8 illustrates a representative hierarchy of objects cre FIG. 8 illustrates a representative hierarchy of objects cre- ated by a builder module, in accordance with a preferred ated by a builder module, in accordance with a preferred embodiment of the present invention; embodiment of the present invention; FIG.9 is a simplified block diagram of a desktop computer FIG. 9 is a simplified block diagram of a desktop computer implementation of an ARB content scanner, in accordance implementation of an ARB content scanner, in accordance with a preferred embodiment of the present invention; with a preferred embodiment of the present invention; FIG. 10 is a simplified block diagram of a rule server that FIG. 10 is a simplified block diagram of a rule server that updates rule databases for the desktop computer of FIG.9, in updates rule databases for the desktop computer of FIG. 9, in accordance with a preferred embodiment of the present accordance with a preferred embodiment of the present invention; invention; FIG. 11 is a simplified block diagram of a network security FIG. 11 is a simplified block diagram of a network security system that takes advantage of distributed ARB scanners to system that takes advantage of distributed ARB scanners to populate a central security profile cache, in accordance with a populate a central security profile cache, in accordance with a preferred embodiment of the present invention; and preferred embodiment of the present invention; and FIG. 12 is a simplified block diagram of an integrated FIG. 12 is a simplified block diagram of an integrated content scanner including a general behavioral Scanner and a content scanner including a general behavioral scanner and a sandbox scanner, in accordance with a preferred embodiment sandbox scanner, in accordance with a preferred embodiment of the present invention.

The method further comprises lower operating costs , due to reduced spending on comput lower operating costs, due to reduced spending on comput- establishing an encapsulated port mirroring session from the establishing an encapsulated port mirroring session from the ing hardware , software , and support .

1 is a block diagram of a hybrid cloud computing monitoring of network traffic that is transmitted to and from FIG. 1 is a block diagram of a hybrid cloud computing monitoring of network traffic that is transmitted to and from system 100 in which one or more embodiments of the virtual machines managed by a tenant and that may be system 100 in which one or more embodiments of the virtual machines managed by a tenant and that may be present disclosure may be utilized .

VMs 120 run on top of a software interface layer , referred to herein as environment 156 that supports the execution of a plurality of environment 156 that supports the execution of a plurality of run on top of a software interface layer, referred to herein as a hypervisor 116 , that enables sharing of the hardware 60 virtual machines 172 across hosts 162.

Virtual of a multi - tenant cloud service with logically isolated vir of a multi-tenant cloud service with logically isolated vir- data centers 180 provide an environment where VM 172 can data centers 180 provide an environment where VM 172 can tualized computing resources on a shared physical infra tualized computing resources on a shared physical infra- be created , stored , and operated , enabling complete abstrac be created, stored, and operated, enabling complete abstrac- structure .

In one implementation, decapsulator VM 240 may leverage the iptables application made available by NetFil- As previously mentioned , hybridity director 174 performs As previously mentioned, hybridity director 174 performs leverage the iptables application made available by NetFil- ter , having a target designated as “ NFQUEUE ” to read management functions for virtual machines instantiated in management functions for virtual machines instantiated in ter, having a target designated as "NFQUEUE" to read packets into packet processor 242 , which strips the header cloud - based computing system 200.

The threat described earlier in the text is partly attributed to a fundamental The threat described earlier in the text is partly attributed to a fundamental limitation on the defensive side: Most host-based antimalware systems are in- limitation on the defensive side: Most host-based antimalware systems are in- stalled and executed inside the very hosts that they are monitoring and protect- stalled and executed inside the very hosts that they are monitoring and protect- ing (Figure 1(a)).

To address this problem, there have recently been a number of solutions To address this problem, there have recently been a number of solutions [Dunlap et al. 2002; Garfinkel and Rosenblum 2003; Joshi et al. 2005] that ad- [Dunlap et al. 2002; Garfinkel and Rosenblum 2003; Joshi et al. 2005] that ad- vocate placing the intrusion detection facilities outside of the (virtual) machine vocate placing the intrusion detection facilities outside of the (virtual) machine being monitored.

More specifi- cally, VMwatcher instantiates the general virtual machine introspection (VMI) cally, VMwatcher instantiates the general virtual machine introspection (VMI) [Garfinkel and Rosenblum 2003] methodology in a nonintrusive manner, so [Garfinkel and Rosenblum 2003] methodology in a nonintrusive manner, so that it can inspect the low-level VM states and events without perturbing the that it can inspect the low-level VM states and events without perturbing the VM’s execution.

For open-source VMMs such as Xen, QEMU, and UML, we develop VM introspection extensions to obtain full VM state, which includes the VM’s reg- introspection extensions to obtain full VM state, which includes the VM's reg- isters, memory, and disk and to capture system calls made by processes in the isters, memory, and disk and to capture system calls made by processes in the VM.

This capability has direct applications in a number of scenarios, such as system This capability has direct applications in a number of scenarios, such as system call-based anomaly detection [Provos 2003], forensic analysis [King and Chen call-based anomaly detection [Provos 2003], forensic analysis [King and Chen 2003], and malware experimentation [Jiang and Xu 2004; Jiang et al. 2005].

4 Datacenter Inventory 55 4 Datacenter Inventory 55 Inventory Overview for the Web Services SDK 55 Inventory Overview for the Web Services SDK 55 Inventory Hierarchies and ServiceInstance 55 Inventory Hierarchies and Servicelnstance 55 Folders in the Hierarchy 56 Folders in the Hierarchy 56 ESXi Inventory Hierarchy 57 ESXi Inventory Hierarchy 57 Accessing Inventory Objects 57 Accessing Inventory Objects 57 Creating Inventory Objects 58 Creating Inventory Objects 58 Privileges Required for Inventory Management 59 Privileges Required for Inventory Management 59 Privileges 59 Privileges 59 Permissions 59 Permissions 59 Managed and Standalone ESXi Hosts 60 Managed and Standalone ESXi Hosts 60 5 Property Collector 62 5 Property Collector 62 Introduction to the PropertyCollector 62 Introduction to the PropertyCollector 62 Data Retrieval 63 Data Retrieval 63 Inventory Traversal and Object Selection 63 Inventory Traversal and Object Selection 63 vSphere Data Objects for Property Collection 63 vSphere Data Objects for Property Collection 63 vSphere Methods for Property Collection 64 vSphere Methods for Property Collection 64 Retrieve Properties with the PropertyCollector 64 Retrieve Properties with the PropertyCollector 64 Simple Property Collector Program in Java for Web Services SDK 67 Simple Property Collector Program in Java for Web Services SDK 67 Inventory Traversal 72 Inventory Traversal 72 TraversalSpec Traversal 72 TraversalSpec Traversal 72 Traverse the Inventory By Using the Property Collector 74 Traverse the Inventory By Using the Property Collector 74 Inventory Traversal Example in Java 75 Inventory Traversal Example in Java 75 SelectionSpec Traversal 80 SelectionSpec Traversal 80 Client Data Synchronization (WaitForUpdatesEx) 86 Client Data Synchronization (WaitForUpdatesEx) 86 Property Filters 87 Property Filters 87 VMware, Inc. VMware, Inc. vSphere Web Services SDK Programming Guide vSphere Web Services SDK Programming Guide WaitForUpdatesEx 87 WaitForUpdatesEx 87 Server Data Transmission 89 Server Data Transmission 89 PropertyCollector Performance 89 PropertyCollector Performance 89 SearchIndex 90 Searchlndex 90 6 Authentication and Authorization 91 6 Authentication and Authorization 91 Objects for Authentication and Authorization Management 91 Objects for Authentication and Authorization Management 91 Authentication and Authorization for ESXi and vCenter Server 92 Authentication and Authorization for ESXi and vCenter Server 92 ESXi User Model 93 ESXi User Model 93 vCenter Server User Model 94 vCenter Server User Model 94 vSphere Security Model 94 vSphere Security Model 94 Setting Up Users, Groups, and Permissions 96 Setting Up Users, Groups, and Permissions 96 Obtaining User and Group Information from UserDirectory 96 Obtaining User and Group Information from UserDirectory 96 RetrieveUserGroups Method 97 RetrieveUserGroups Method 97 Managing ESXi Users with HostLocalAccountManager 97 Managing ESXi Users with HostLocalAccountManager 97 Methods Available for Local Account Management 98 Methods Available for Local Account Management 98 Create a Local User Account on an ESXi System 98 Create a Local User Account on an ESXi System 98 Managing Roles and Permissions with AuthorizationManager 99 Managing Roles and Permissions with AuthorizationManager 99 Using Roles to Consolidate Sets of Privileges 100 Using Roles to Consolidate Sets of Privileges 100 Modifying Sample Roles to Create New Roles 101 Modifying Sample Roles to Create New Roles 101 Granting Privileges Through Permissions 102 Granting Privileges Through Permissions 102 Authenticating Users Through SessionManager 104 Authenticating Users Through SessionManager 104 Using VMware Single Sign On for vCenter Server Sessions 105 Using VMware Single Sign On for vCenter Server Sessions 105 Using the Credential Store for Automated Login 105 Using the Credential Store for Automated Login 105 Credential Store Libraries 106 Credential Store Libraries 106 Credential Store Methods 106 Credential Store Methods 106 Credential Store Backing File 107 Credential Store Backing File 107 Credential Store Samples 107 Credential Store Samples 107 Specifying Roles and Users with the Credential Store 108 Specifying Roles and Users with the Credential Store 108 Managing Licenses with LicenseManager 109 Managing Licenses with LicenseManager 109 7 Hosts 110 7 Hosts 110 Host Management Objects 110 Host Management Objects 110 Retrieving Host Information 111 Retrieving Host Information 111 Configuring and Reconfiguring Hosts 112 Configuring and Reconfiguring Hosts 112 Managing the Host Lifecycle 112 Managing the Host Lifecycle 112 Reboot and Shutdown 112 Reboot and Shutdown 112 Using Standby Mode 112 Using Standby Mode 112 Disconnecting and Reconnecting Hosts 113 Disconnecting and Reconnecting Hosts 113 Querying and Changing the Host Time 113 Querying and Changing the Host Time 113 Querying Virtual Machine Memory Overhead 114 Querying Virtual Machine Memory Overhead 114

16 Events and Alarms 248 16 Events and Alarms 248 Event and Alarm Management Objects 248 Event and Alarm Management Objects 248 Understanding Events 249 Understanding Events 249 Managing Events with EventManager 249 Managing Events with EventManager 249 Event Data Objects 250 Event Data Objects 250 Formatting Event Message Content 251 Formatting Event Message Content 251 Creating Custom Events 251 Creating Custom Events 251 Using an EventHistoryCollector 253 Using an EventHistoryCollector 253 Creating an EventHistoryCollector Filter 254 Creating an EventHistoryCollector Filter 254 Managing the HistoryCollector 254 Managing the HistoryCollector 254 Using Alarms 254 Using Alarms 254 Obtaining a List of Alarms 255 Obtaining a List of Alarms 255 Creating an Alarm 255 Creating an Alarm 255 Defining Alarms Using the AlarmSpec Data Object 256 Defining Alarms Using the AlarmSpec Data Object 256 Specifying Alarm Trigger Conditions with AlarmExpression 257 Specifying Alarm Trigger Conditions with AlarmExpression 257 Specifying Alarm Actions 258 Specifying Alarm Actions 258 Deleting or Disabling an Alarm 259 Deleting or Disabling an Alarm 259 Sample Code Reference 259 Sample Code Reference 259 17 vSphere Performance 261 17 vSphere Performance 261 vSphere Performance Data Collection 261 vSphere Performance Data Collection 261 PerformanceManager Objects and Methods 263 PerformanceManager Objects and Methods 263 Retrieving vSphere Performance Data 265 Retrieving vSphere Performance Data 265 Performance Counter Example (QueryPerf) 266 Performance Counter Example (QueryPerf) 266 Large-Scale Performance Data Retrieval 274 Large-Scale Performance Data Retrieval 274 Using the QueryPerf Method as a Raw Data Feed 275 Using the QueryPerf Method as a Raw Data Feed 275 Comparison of Query Methods 275 Comparison of Query Methods 275 Retrieving Summary Performance Data 276 Retrieving Summary Performance Data 276 Performance Counter Metadata 276 Performance Counter Metadata 276 PerfCounterInfo 276 PerfCounterinfo 276 Performance Intervals 277 Performance Intervals 277 ESXi Server Performance Intervals 278 ESXi Server Performance Intervals 278 VMware, Inc. VMware, Inc. vSphere Web Services SDK Programming Guide vSphere Web Services SDK Programming Guide vCenter Server Performance Intervals 278 vCenter Server Performance Intervals 278 vSphere Performance and Data Storage 279 vSphere Performance and Data Storage 279 Modifying Historical Intervals 279 Modifying Historical Intervals 279 Modifying Performance Counter Collection Levels 280 Modifying Performance Counter Collection Levels 280 Sample Code Reference 281 Sample Code Reference 281 18 Diagnostics and Troubleshooting 283 18 Diagnostics and Troubleshooting 283 Troubleshooting Best Practices 283 Troubleshooting Best Practices 283 Overview of Configuration Files and Log Files 284 Overview of Configuration Files and Log Files 284 ESXi Log File 285 ESXi Log File 285 Virtual Machine Log Files 285 Virtual Machine Log Files 285 vCenter Server Log Files 286 vCenter Server Log Files 286 Modifying the Log Level to Obtain Detailed Information 286 Modifying the Log Level to Obtain Detailed Information 286 Setting the Log Level on ESXi Systems 287 Setting the Log Level on ESXi Systems 287 Generating Logs 287 Generating Logs 287 Setting the Log Level on vCenter Server Systems 288 Setting the Log Level on vCenter Server Systems 288 Using DiagnosticManager 288 Using DiagnosticManager 288 Using the MOB to Explore the DiagnosticManager 290 Using the MOB to Explore the DiagnosticManager 290 Generating Diagnostic Bundles 291 Generating Diagnostic Bundles 291 Export Diagnostic Data By Using the vSphere Client 291 Export Diagnostic Data By Using the vSphere Client 291 19 Managed Object Browser 292 19 Managed Object Browser 292 Using the MOB to Explore the Object Model 292 Using the MOB to Explore the Object Model 292 Accessing the MOB 292 Accessing the MOB 292 Using the MOB to Navigate the VMware Infrastructure Object Model 293 Using the MOB to Navigate the VMware Infrastructure Object Model 293 Using the MOB to Invoke Methods 294 Using the MOB to Invoke Methods 294 Passing Primitive Datatypes to Method 294 Passing Primitive Datatypes to Method 294 Passing Arrays of Primitives to Methods 294 Passing Arrays of Primitives to Methods 294 Passing Complex Structures to Methods 295 Passing Complex Structures to Methods 295 Using the MOB Along With the API Reference 298 Using the MOB Along With the API Reference 298 20 HTTP Access to vSphere Server Files 300 20 HTTP Access to vSphere Server Files 300 Introduction to HTTP Access 300 Introduction to HTTP Access 300 URL Syntax for HTTP Access 301 URL Syntax for HTTP Access 301 Datastore Access (/folder) 301 Datastore Access (/folder) 301 Host File Access (/host) 302 Host File Access (/host) 302 Update Package Access (/tmp) 303 Update Package Access (/tmp) 303 Privilege Requirements for HTTP Access 303 Privilege Requirements for HTTP Access 303 21 Sample Program Overview 304 21 Sample Program Overview 304 Java Sample Programs (JAXWS Bindings) 304 Java Sample Programs (JAXWS Bindings) 304 C# Sample Programs 308 C# Sample Programs 308

c# public int minute { public int minute { set; get; } set; get; } You can extrapolate the getter and setter methods that are available in the client proxy interface from the You can extrapolate the getter and setter methods that are available in the client proxy interface from the vSphere API Reference.

■ Organizational components: Folder and Datacenter n Organizational components: Folder and Datacenter When you manage the virtual infrastructure, you access objects and their properties and methods based When you manage the virtual infrastructure, you access objects and their properties and methods based on their location in the inventory.

* ComputeResource HostSystem ResourcePool —VirtualMachine DistributedVirtualPortOroup Network DistributedVirtualSwitch Folder * Datastore VirtualApp * VirtualMachine Legend: * : Objects can be nested.

Virtual Disk Programming Guide Virtual Disk Programming Guide vSphere Storage APIs for Data Protection (VADP) 6.0 vSphere Storage APIs for Data Protection (VADP) 6.0 Virtual Disk Development Kit (VDDK) 6.0 Virtual Disk Development Kit (VDDK) 6.0 This document supports the version of each product listed and This document supports the version of each product listed and supports all subsequent versions until the document is replaced supports all subsequent versions until the document is replaced by a new edition.

To develop and test VADP programs, you need a vCenter Server and ESXi hosts, preferably with shared cluster storage.

VADP take snapshots of virtual machines running on ESXi, enabling full or incremental backup and restore.

• Manipulate virtual disks to defragment, expand, convert, rename, or shrink the file system image.

VixDiskLib opens and VixTransport handles the temporary linked clone and hot attachment of virtual disks.