# US 8,544,094 B2 · Suspicious node detection and recovery in MapReduce computing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,544,094 B2 - Document ID: US8544094B2 - Status: Granted - Kind: B2 - Application number: 13/407,696 - Filed: 2012-02-28 - Published: 2012-06-21 - Granted: 2013-09-24 - Earliest claimed: 2009-12-31 - Assignees: International Business Machines Corporation - Applicants: Bryan E. Aupperle; David L. Kaminsky - Inventors: Bryan E. Aupperle; David L. Kaminsky - Web page: https://patentgrep.com/patent/US8544094B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/552: {involving long-term monitoring or reporting} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments of the present invention address deficiencies of the art in respect to distributed computing for large data sets on clusters of computers and provide a novel and non-obvious method, system and computer program product for detecting and correcting malicious nodes in a cloud computing environment (e.g., MapReduce computing). In one embodiment of the invention, a computer-implemented method for detecting and correcting malicious nodes in a cloud computing environment can include selecting a task to dispatch to a first worker node, setting a suspicion index threshold for the selected task, determining a suspicion index for the selected task, comparing the suspicion index to the suspicion index threshold and receiving a result from a first worker node. The method further can include applying a recovery action when the suspicion index exceeds the selected suspicion index threshold. ## Claims ### Claim 1 A computer-implemented method for detecting and correcting malicious nodes in a cloud computing environment, the method comprising: selecting a task to dispatch to a first worker node; setting a suspicion index threshold for the selected task; determining a suspicion index for the selected task; comparing the suspicion index to the suspicion index threshold; receiving a result from the first worker node when the suspicion index does not exceed the selected suspicion index threshold; and applying a recovery action when the suspicion index exceeds the selected suspicion index threshold; wherein the applying a recovery action comprises: selecting a second worker node for selected task; comparing results returned by the first worker node to results returned by the second worker node; and resetting the suspicion index of the first worker node to a minimum value conditioned upon a positive match of the results returned by the first worker node to the results returned by the second worker node. ### Claim 2 (depends on 1) The method of claim 1, wherein the setting a suspicion index threshold for the selected task comprises: identifying an expected processing time for the selected task; and, identifying a configuration type of the first worker node. ### Claim 3 (depends on 1) The method of claim 1, wherein determining a suspicion index for the selected task comprises: applying a suspicion detector function for calculating the suspicion index over time for the selected task; identifying a configuration type of the first worker node; and, determining a current workload of the first worker node. ### Claim 4 (depends on 1) The method of claim 1, wherein determining an initial value for the suspicion index for the selected task, comprises: determining prior performance of the first worker node. ### Claim 5 (depends on 4) The method of claim 4, wherein the suspicion index is set to minimum value when the prior performance of the worker node was timely and the returned results were correct. ### Claim 6 (depends on 4) The method of claim 4, wherein the suspicion index is set to minimum value when no prior performance of the worker node was known. ### Claim 7 A computer-implemented method for detecting and correcting malicious nodes in a cloud computing environment, the method comprising: selecting a task to dispatch to a first worker node; setting a suspicion index threshold for the selected task; determining a suspicion index for the selected task; comparing the suspicion index to the suspicion index threshold; receiving a result from the first worker node when the suspicion index does not exceed the selected suspicion index threshold; and applying a recovery action when the suspicion index exceeds the selected suspicion index threshold; wherein the applying a recovery action comprises: selecting a second worker node and a third worker node for the selected task; comparing results returned by the first worker node to results returned by the second worker node and to the results returned by the third worker node; and, stopping use of the first worker node conditioned upon a negative match of the results returned by the first worker node to the results returned by the second worker node and the results returned by the third worker node. ### Claim 8 (depends on 7) The method of claim 7, wherein the setting a suspicion index threshold for the selected task comprises: identifying an expected processing time for the selected task; and, identifying a configuration type of the first worker node. ### Claim 9 (depends on 7) The method of claim 7, wherein determining a suspicion index for the selected task comprises: applying a suspicion detector function for calculating the suspicion index over time for the selected task; identifying a configuration type of the first worker node; and, determining a current workload of the first worker node. ### Claim 10 (depends on 7) The method of claim 7, wherein determining an initial value for the suspicion index for the selected task, comprises: determining prior performance of the first worker node. ### Claim 11 (depends on 10) The method of claim 10, wherein the suspicion index is set to minimum value when the prior performance of the worker node was timely and the returned results were correct. ### Claim 12 (depends on 10) The method of claim 10, wherein the suspicion index is set to minimum value when no prior performance of the worker node was known. ### Claim 13 A computer-implemented method for detecting and correcting malicious nodes in a cloud computing environment, the method comprising: selecting a task to dispatch to a first worker node; setting a suspicion index threshold for the selected task; determining a suspicion index for the selected task; comparing the suspicion index to the suspicion index threshold; receiving a result from the first worker node when the suspicion index does not exceed the selected suspicion index threshold; and applying a recovery action when the suspicion index exceeds the selected suspicion index threshold; wherein the applying a recovery action comprises: selecting a second worker node and a third worker node for a new selected task; comparing results returned by the first worker node to results returned by the second worker node and to the results returned by the third worker node; and, lowering the suspicion index of the first worker node conditioned upon a positive match of the results returned by the first worker node to the results returned by the second worker node and the results returned by the third worker node. ### Claim 14 (depends on 13) The method of claim 13, wherein the setting a suspicion index threshold for the selected task comprises: identifying an expected processing time for the selected task; and, identifying a configuration type of the first worker node. ### Claim 15 (depends on 13) The method of claim 13, wherein determining a suspicion index for the selected task comprises: applying a suspicion detector function for calculating the suspicion index over time for the selected task; identifying a configuration type of the first worker node; and, determining a current workload of the first worker node. ### Claim 16 (depends on 13) The method of claim 13, wherein determining an initial value for the suspicion index for the selected task, comprises: determining prior performance of the first worker node. ### Claim 17 (depends on 16) The method of claim 16, wherein the suspicion index is set to minimum value when the prior performance of the worker node was timely and the returned results were correct. ### Claim 18 (depends on 16) The method of claim 16, wherein the suspicion index is set to minimum value when no prior performance of the worker node was known.