# US 11,307,940 B2 · Cognitive data backup > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,307,940 B2 - Document ID: US11307940B2 - Status: Granted - Kind: B2 - Application number: 16/539,320 - Filed: 2019-08-13 - Published: 2021-02-18 - Granted: 2022-04-19 - Earliest claimed: 2019-08-13 - Assignees: Kyndryl, Inc. - Applicants: Kyndryl, Inc. - Inventors: Ana Maria Bezerra Maimoni; Gavin Charles O'Reilly; Clea Anne Zolotow; Marci Devorah Formato; Jack Louis Cherkas - Web page: https://patentgrep.com/patent/US11307940B2 ## CPC - G06F 11/1461: {Backup scheduling policy} - G06F 11/1464: {for networked environments} - G06N 20/00: Machine learning - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 2201/80: Database-specific techniques - G06F 2201/835: Timestamp - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method, system and computer program product for data backup based on a workload behavior includes a first computer identifying, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer. The first computer processes the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload, and compares the list of frequently accessed files to backup policy rules active on the first computer. Based on the comparison, the first computer identifies a mismatch between the list of frequently accessed files and the backup policy rules, and specifies a new backup rule to update the backup policy rules for each identified mismatch between the list of frequently accessed files and the backup policy rules. ## Claims ### Claim 1 A computer-implemented method for data backup based on a workload behavior, comprising: identifying by a first computer, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer; processing, by the first computer, the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload; creating, by the first computer, a timestamp for each of the frequently accessed files in the list of frequently accessed files, the timestamp comprising a time at which a file was last modified, a file creation time, a time the file was last accessed, a time file metadata was changed, or a time the file was last backed up, wherein the timestamp allows the list of frequently accessed files to be compared with backup policy rules active on the first computer, comparing, by the first computer, the list of frequently accessed files to the backup policy rules; based on the comparison, identifying, by the first computer, a mismatch between the list of frequently accessed files and the backup policy rules; and for each identified mismatch between the list of frequently accessed files and the backup policy rules, specifying, by the first computer, a new backup rule to update the backup policy rules. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending, by the first computer, a first message comprising information regarding the new backup rule. ### Claim 3 (depends on 1) The method of claim 1, further comprising: based on the new backup rule being accepted, updating, by the first computer, the policy rules with the new backup rule. ### Claim 4 (depends on 3) The method of claim 3, further comprising: sending, by the first computer, a second message comprising information regarding the updating of the policy rules with the new backup rule. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, by the first computer, using machine learning tools, the backup policy rules, iNode and data blocks information. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining, by the first computer, the workload behavior based on data access statistics associated to an access of the workload to system files; and collecting, by the first computer, the data access statistics using a first database management tool. ### Claim 7 (depends on 6) The method of claim 6, wherein the data access statistics comprises a high rate of Input/Output operations per second (IOPS). ### Claim 8 (depends on 1) The method of claim 1, further comprising: capturing, by the first computer, data associated with each of the timestamped frequently accessed files to a second database management tool. ### Claim 9 (depends on 1) The method of claim 1, further comprising: automatically capturing, by the first computer, data associated with a type, a content, or a time of transactions made locally to a database log file of an IoT device, the automatically captured data comprising event logs or syslog associated with an activity on the IoT device. ### Claim 10 A computer system for data backup based on a workload behavior, comprising: one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising: identifying by a first computer, using machine learning tools, data associated with frequently accessed files on the first computer by a workload being processed by a second computer; processing, by the first computer, the identified data associated with the frequently accessed files to generate a list of frequently accessed files by the workload; creating, by the first computer, a timestamp for each of the frequently accessed files in the list of frequently accessed files, the timestamp comprising a time at which a file was last modified, a file creation time, a time the file was last accessed, a time file metadata was changed, or a time the file was last backed up, wherein the timestamp allows the list of frequently accessed files to be compared with backup policy rules active on the first computer; comparing, by the first computer, the list of frequently accessed files to the backup policy; based on the comparison, identifying, by the first computer, a mismatch between the list of frequently accessed files and the backup policy rules; and for each identified mismatch between the list of frequently accessed files and the backup policy rules, specifying, by the first computer, a new backup rule to update the backup policy rules. ### Claim 11 (depends on 10) The computer system of claim 10, further comprising: sending, by the first computer, a first message comprising information regarding the new backup rule. ### Claim 12 (depends on 10) The computer system of claim 10, further comprising: based on the new backup rule being accepted, updating, by the first computer, the policy rules with the new backup rule. ### Claim 13 (depends on 12) The computer system of claim 12, further comprising: sending, by the first computer, a second message comprising information regarding the updating of the policy rules with the new backup rule. ### Claim 14 (depends on 10) The computer system of claim 10, further comprising: determining, by the first computer, using machine learning tools, the backup policy rules, iNode and data blocks information. ### Claim 15 (depends on 10) The computer system of claim 10, further comprising: determining, by the first computer, the workload behavior based on data access statistics associated to an access of the workload to system files; and collecting, by the first computer, the data access statistics using a first database management tool. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the data access statistics comprises a high rate of Input/Output operations per second (IOPS). ### Claim 17 (depends on 10) The computer system of claim 10, further comprising: capturing, by the first computer, data associated with each of the timestamped frequently accessed files to a second database management tool. ### Claim 18 (depends on 10) The computer system of claim 10, further comprising: automatically capturing, by the first computer, data associated with a type, a content, or a time of transactions made locally to a database log file of an IoT device, the automatically captured data comprising event logs or syslog associated with an activity on the IoT device.