Data protection method and device

Abstract

The invention discloses a data protection method and device, relates to the technical field of storage, and is used for recovering data in storage equipment as completely as possible. The method comprises the steps that the storage device obtains an IO sequence accessing the storage device, a suspicious IO sequence is determined from the IO sequence, the suspicious IO sequence is initiated when a suspicious host accesses first data in the storage device, and the suspicious IO sequence is used for indicating that the suspicious host has the possibility of damaging the data stored in the storage device; data stored in the storage device includes first data. The storage device responds to the determined suspicious IO sequence, a defense mechanism and a snapshot are generated, the snapshot is used for recovering data stored in the storage device, and the defense mechanism is used for preventing the suspicious host from accessing the data stored in the storage device before the snapshot is generated.

Description

Technical Field

[0001] The present application relates to the field of storage technology, and in particular to a data protection method and device. Background Art

[0002] With the rapid development of information technology, data has become one of the most important assets for enterprises and individuals. As the infrastructure supporting data storage and protection, the security of storage devices is particularly important. And with the popularization of the Internet, network security threats such as ransomware are becoming increasingly rampant, and data security issues have become a common problem worldwide. Once a storage device is attacked by a virus, the data in the storage device may not only be destroyed and stolen, but also be blackmailed. In addition, some regulatory and compliance requirements also place high demands on the security of storage devices. Therefore, ensuring the security of storage devices and the data stored in them has become a new demand for enterprises.

[0003] Normally, a storage device periodically generates snapshots of the data in the storage device to restore data when the storage device is attacked by a virus. However, in this method, the data restored by the snapshot may be part of the data in the storage device. For example, if the snapshot is generated every 10 minutes, the storage device has generated a snapshot at 14:00, and the virus attacks the storage device at 14:09, then in this case, the storage device can only restore data based on the snapshot generated at 14:00, and the data that changed in the storage device between 14:00 and 14:09 cannot be restored by the snapshot.

[0004] How to restore the data in the storage device as completely as possible is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides a data protection method and apparatus for restoring user data in a storage device as completely as possible.

[0006] In a first aspect, the present application provides a data protection method, which can be executed by a storage device, or by a protection module in the storage device; or, the method can also be executed by a protection device connected to the storage device. The following takes the execution of the storage device as an example for explanation.

[0007] The method includes: the storage device obtains an input / output (IO) sequence for accessing the storage device, and determines a suspicious IO sequence from the IO sequence, wherein the suspicious IO sequence is initiated by a suspicious host when accessing the first data in the storage device, and the suspicious IO sequence is used to indicate that the suspicious host has the possibility of damaging the user data stored in the storage device, and the user data stored in the storage device includes the first data. Further, the storage device generates a defense mechanism and a snapshot in response to determining the suspicious IO sequence; wherein the snapshot is used to restore the user data stored in the storage device, and the defense mechanism is used to prevent the suspicious host from accessing the user data stored in the storage device before the snapshot is generated. In the above technical solution, after determining the suspicious IO sequence, the storage device generates a defense mechanism and a snapshot, so that the suspicious host that initiates the suspicious IO sequence cannot continue to access the user data in the storage device within the time period from determining the suspicious IO sequence to generating the snapshot. Further, the time point corresponding to the generation of the snapshot is the time point when the suspicious IO sequence is found to exist. Assuming that the suspicious host is the host used to damage the user data stored in the storage device, that is, the suspicious host is an attacking host, then at this time point, the degree of damage to the user data by the attacking host is low. In this way, the storage device can restore the user data in the storage device as completely as possible according to the snapshot.

[0008] In a possible implementation, the defense mechanism is specifically used to prevent the suspicious host from accessing the second data before the snapshot is generated, wherein the second data is user data other than the first data stored in the storage device. In the above technical solution, the storage device protects the second data stored in the storage device through the defense mechanism, and then generates a snapshot of the second data, and the second data can be completely restored according to the snapshot.

[0009] In a possible implementation, the defense mechanism includes one or more of the following A and B: A. denying access requests from suspicious hosts to storage devices before snapshot generation is completed; B. adding preset data to the storage device so that the suspicious host can access the preset data before snapshot generation is completed, wherein the preset data is not user data. The above two methods help the storage device to prevent suspicious hosts from accessing data stored in the storage device during the period from when a suspicious IO sequence is determined to when a snapshot is generated.

[0010] In a possible implementation, after determining the suspicious IO sequence, the storage device may also determine whether the first data is damaged by the suspicious IO sequence. When the storage device determines that the first data is damaged by the suspicious IO sequence, it determines that the suspicious host is an attacking host; and / or, when it determines that the first data is not damaged by the suspicious IO sequence, it determines that the suspicious host is a normal host. In the above technical solution, the storage device further determines whether the suspicious host is an attacking host or a normal host based on whether the first data is damaged, which helps to improve the accuracy of the confirmation.

[0011] In a possible implementation, when the storage device determines whether the first data is damaged by the suspicious IO sequence, the storage device may specifically detect the entropy value of the first data to obtain the entropy value of the first data; when the entropy value is greater than a preset value, it is determined that the first data has been damaged by the suspicious IO sequence; when the entropy value is less than or equal to the preset value, it is determined that the first data has not been damaged by the suspicious IO sequence. In the above technical solution, the storage device evaluates the randomness of the first data according to the entropy value of the first data, and then determines whether the first data is damaged according to the randomness of the first data, which has high accuracy.

[0012] In a possible implementation, when the storage device performs entropy detection on the first data to obtain the entropy value of the first data, the storage device may specifically sample the first data to obtain sampled data, and perform entropy detection on the sampled data to obtain the entropy value of the first data. The above technical solution helps to reduce the computational complexity of the storage device.

[0013] In a possible implementation, after determining that the suspicious host is a host used to destroy user data stored in the storage device (i.e., determining that the suspicious host is an attacking host), the storage device may also display an alarm message, wherein the alarm message is used by the administrator to determine whether to disconnect the connection between the attacking host and the storage device. In the above technical solution, the administrator decides whether to disconnect the connection between the attacking host and the storage device, which helps to improve management flexibility.

[0014] In a possible implementation, after the storage device generates a snapshot for restoring the user data stored in the storage device, it can also remove the defense mechanism so that the suspicious host can normally access the data stored in the storage device. In the above technical solution, the storage device removes the defense mechanism after generating the snapshot, which helps to ensure that the normal host or the normal user application in the attacking host can normally access the user data in the storage device, under the premise of ensuring that the storage device can restore the user data in the storage device as completely as possible according to the snapshot.

[0015] In one possible implementation, when the storage device determines a suspicious IO sequence from an IO sequence, specifically, it may be to determine a first IO sequence for accessing a first file from the IO sequence; the first data is the first file; when the storage device determines that the first IO sequence matches a preset IO sequence greater than a threshold, it determines that the first IO sequence is a suspicious IO sequence, and the preset IO sequence is a pre-learned IO sequence that may damage user data stored in the storage device. The preset IO sequence may be one or more. Exemplarily, this implementation is applicable to a network attached storage (NAS) architecture. In the above technical solution, when it is determined that a certain IO sequence matches a preset IO sequence, the IO sequence is determined to be a suspicious IO sequence, which helps to improve the efficiency and accuracy of determining suspicious IO sequences.

[0016] In a possible implementation, each IO in an IO sequence carries access information, and the access information includes an access address, and optionally, the access information also includes one or more of an access type and an access time; when the storage device determines a suspicious IO sequence from the IO sequence, it may specifically be that according to the access information carried in each IO of the IO sequence, the statistical characteristics of the IO sequence are determined; according to the statistical characteristics of the IO sequence, the suspicious IO sequence is determined from the IO sequence; wherein the user data on the access address of each IO in the suspicious IO sequence constitutes the first data. Exemplarily, this implementation is applicable to a storage area network (SAN) architecture. In the above technical solution, according to the access information of each IO, the statistical characteristics of the IO sequence are determined, and then according to the statistical characteristics of the IO sequence, the suspicious IO sequence is determined from the IO sequence, which helps to improve the efficiency and accuracy of determining suspicious IO sequences.

[0017] In a second aspect, the present application provides a data protection device, which may be a storage device, or a protection module in a storage device; or, the device may also be a protection device connected to the storage device.

[0018] The device includes: an acquisition module, which is used to acquire an IO sequence for accessing a storage device; a determination module, which is used to determine a suspicious IO sequence from the IO sequence, wherein the suspicious IO sequence is initiated by a suspicious host when accessing first data in a storage device, and the suspicious IO sequence is used to indicate that the suspicious host has the possibility of damaging user data stored in the storage device, and the user data stored in the storage device includes the first data; a generation module, which is used to generate a defense mechanism and a snapshot in response to the determination module determining the suspicious IO sequence; wherein the snapshot is used to restore the user data stored in the storage device, and the defense mechanism is used to prevent the suspicious host from accessing the user data stored in the storage device before the snapshot is generated. In a possible implementation, the defense mechanism is specifically used to prevent the suspicious host from accessing the second data before the snapshot is generated, and the second data is the user data stored in the storage device except the first data.

[0019] In one possible implementation, the defense mechanism includes one or more of the following A and B: A. denying a suspicious host's access request to a storage device before completing the generation of a snapshot; B. adding preset data to the storage device so that the suspicious host can access the preset data before completing the generation of the snapshot, wherein the preset data is not user data.

[0020] In one possible implementation, after determining the suspicious IO sequence, the determination module is further used to: determine whether the first data is damaged by the suspicious IO sequence; when it is determined that the first data is damaged by the suspicious IO sequence, determine that the suspicious host is an attacking host; and / or, when it is determined that the first data is not damaged by the suspicious IO sequence, determine that the suspicious host is a normal host.

[0021] In a possible implementation, when determining whether the first data is damaged by a suspicious IO sequence, the determination module is specifically used to: perform entropy value detection on the first data to obtain an entropy value of the first data; when the entropy value is greater than a preset value, determine that the first data is damaged by the suspicious IO sequence; when the entropy value is less than or equal to the preset value, determine that the first data is not damaged by the suspicious IO sequence.

[0022] In a possible implementation, when the determination module performs entropy value detection on the first data to obtain the entropy value of the first data, it is specifically used to: sample the first data to obtain sampled data; and perform entropy value detection on the sampled data to obtain the entropy value of the first data.

[0023] In a possible implementation, after determining that the suspicious host is an attacking host, the determination module is further configured to: display alarm information, wherein the alarm information is used by the administrator to determine whether to disconnect the connection between the attacking host and the storage device.

[0024] In a possible implementation, after the generation of the snapshot is completed, the generation module is further configured to: release the defense mechanism so that the suspicious host can normally access the data stored in the storage device.

[0025] In a possible implementation, when the determination module determines a suspicious IO sequence from the IO sequence, it is specifically used to: determine a first IO sequence for accessing a first file from the IO sequence; the first data is the first file; when it is determined that the matching degree between the first IO sequence and a preset IO sequence is greater than a threshold, determine that the first IO sequence is a suspicious IO sequence, and the preset IO sequence is a pre-learned IO sequence that is likely to damage user data stored in a storage device.

[0026] In a possible implementation, each IO in an IO sequence carries access information, the access information includes an access address, and the access information also includes one or more of an access type and an access time; when the determination module determines a suspicious IO sequence from the IO sequence, it is specifically used to: determine a statistical feature of the IO sequence according to the access information carried in each IO of the IO sequence; determine a suspicious IO sequence from the IO sequence according to the statistical feature of the IO sequence; wherein user data on the access address of each IO in the suspicious IO sequence constitutes the first data.

[0027] In a third aspect, the present application provides a computer-readable storage medium, in which a computer program or instructions are stored. When the computer program or instructions are executed by a computing device, the above-mentioned first aspect or any one of the methods in the first aspect is implemented.

[0028] In a fourth aspect, the present application provides a computer program product, which includes a computer program or instructions. When the computer program or instructions are executed by a computing device, the above-mentioned first aspect or any one of the methods in the first aspect is implemented.

[0029] In a fifth aspect, the present application provides a computing device, including a processor, the processor is connected to a memory, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the computing device executes the above-mentioned first aspect or any one of the methods in the first aspect.

[0030] In a sixth aspect, the present application provides a storage system, including a computing device and a storage medium, the computing device and the storage medium are connected, the storage medium is used to store data, and the computing device is used to execute the above-mentioned first aspect or any one of the methods in the first aspect.

[0031] The technical effects that can be achieved in any of the second to sixth aspects mentioned above can refer to the description of the beneficial effects in the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A possible NAS architecture diagram is shown below;

[0033] Figure 2 A possible SAN architecture diagram is shown below;

[0034] Figure 3 A schematic diagram of the structure of a data protection system provided for this application;

[0035] Figure 4 A structural diagram of another data protection system provided by this application;

[0036] Figure 5 A flowchart of the first data protection method provided for this application;

[0037] Figure 6 A flowchart of the second data protection method provided for this application;

[0038] Figure 7 A schematic diagram of an application scenario provided for this application;

[0039] Figure 8 A flowchart of the third data protection method provided for this application;

[0040] Fig. 9 A schematic diagram of another application scenario provided for this application;

[0041] Fig.10 A schematic diagram of the structure of a data protection device provided in this application;

[0042] Fig.11 A schematic diagram of the structure of another data protection device provided in this application. DETAILED DESCRIPTION

[0043] In order to facilitate the explanation of the embodiments of the present application, the professional terms and technologies involved in the embodiments of the application are first explained.

[0044] Ransomware: Use various encryption algorithms to encrypt files in the attacked / infected host. The infected host must obtain the decryption private key to crack it. For example, once the ransomware file enters the local computer, it will automatically run and delete the ransomware sample to avoid detection and analysis. Subsequently, the ransomware uses the local Internet access rights to connect to the hacker's host, upload local information and download the encryption public key, and use the public key to encrypt the file.

[0045] Snapshot: Capture all the data on a hard disk or volume at a certain point in time, and it is completed very quickly, just like a camera shutter. Snapshots are used to prevent data from being "contaminated" or logically damaged. For example, when a virus infects a large area, configuration information is corrupted, or the system crashes, the electronic data can be rolled back using the snapshot and start over from the snapshot point in time, or multiple clones can be created from the data image at that point in time.

[0046] Network file system (NFS): is both a distributed file system and a network protocol used to access and share files between devices on the same local area network (LAN). NFS is a low-cost network file sharing option that enables users and applications to access, store, and update files on remote computers as if they were using direct-attached storage. NFS uses the Remote Procedure Call protocol to route requests between clients and servers. Although participating devices must support NFS, they do not need to understand the details of the network.

[0047] Network attached storage (NAS): literally means a device connected to the network with data storage function. NAS is defined as a special dedicated data storage device. NAS includes storage media (such as disk arrays, drives or removable storage media) and embedded system software, which can provide cross-platform file sharing functions. NAS usually occupies its own node on a local area network, allowing users to access data on the network without the intervention of the host. NAS centrally manages and processes all data on the network, unloading the load from the host and effectively reducing the total cost of ownership. Figure 1 The figure is a possible NAS architecture diagram, which includes a host and a storage device, which are connected via an Ethernet switch, and the Ethernet switch can support protocols such as NFS, CIFS, FTP, HTTP, etc. The storage device includes a file system and a storage medium, the storage medium is used to store data, and the file system is used to manage the data stored in the storage medium.

[0048] Storage area network (SAN): is a block-based storage that uses a high-speed architecture to connect hosts to storage devices. The storage devices include logical disk units (LUNs), which are a series of blocks configured through a shared storage pool. The host partitions and formats these blocks, usually using a file system, so that data can be stored on the LUN just like on local disk storage. In the SAN architecture, storage devices are independent logical units that can be accessed by hosts or other storage devices. At the same time, multiple storage devices can form a storage pool to provide larger storage space, higher data throughput, and better manageability. Figure 2 The following is a possible SAN architecture diagram, which includes a host and a storage device, which are connected via a fiber channel (FC) switch. The storage device includes a storage medium, which is used to store data, and the storage medium includes multiple LUNs. A file system is deployed in the host to manage the data stored in the storage medium, and the storage device can perform two actions, read and write, according to commands from the host.

[0049] In combination with the above professional terms and technical explanations, the embodiments of the present application are described in detail as follows.

[0050] like Figure 3 A data protection system applicable to a data protection method provided exemplarily in this application, the data protection system includes one or more hosts ( Figure 3 Hosts 1 to 3 are shown as examples, but the present application does not limit the number of hosts), and storage devices.

[0051] The architecture between one or more hosts and the storage device can be a NAS architecture or a SAN architecture. One or more user applications run in each host, and each user application can access user data in the storage device through its host, such as writing user data to the storage device, reading user data in the storage device, etc.

[0052] A storage device can be a centralized storage device (or centralized storage system) or a distributed storage device (or distributed storage system). A centralized storage device is composed of one or more host devices, and a centralized storage device has a unified entrance for the host to access the centralized storage device. A distributed storage device includes multiple independent storage nodes, and the host can access each independent storage node, and each storage node has processing and storage functions.

[0053] Furthermore, the storage device includes a protection module, which can be used to protect the user data in the storage device. Specifically, the protection module obtains the IO sequence when the host accesses the user data in the storage device, identifies one or more suspicious IO sequences from the IO sequence, and then protects the user data. It can be understood that in the above NAS architecture, the storage device includes not only the file system and the storage medium ( Figure 3 In the above SAN architecture, the storage device includes not only the storage medium ( Figure 3 (not shown) and also includes a protection module. When the protection module is located on the storage device, it can be located in the computing module of the storage device, for example, it can be located on the controller of the storage device. Exemplarily, when the storage device is a distributed storage device, the controller of each independent storage node includes a protection module, and the protection module is used to protect the user data in the storage node where it is located; or, the distributed storage device includes a protection module, and the protection module is used to protect the user data in the multiple independent storage nodes; or, the distributed storage device includes multiple protection modules, each protection module is used to protect the user data in one or more independent storage nodes in the distributed storage device, wherein the correspondence between the protection module and the storage node can be set by the administrator.

[0054] like Figure 4 A data protection system applicable to another data protection method provided by the present application, the data protection system includes one or more hosts ( Figure 3 Hosts 1 to 3 are shown as examples, but the present application does not limit the number of hosts), storage devices, and protection devices. The storage devices may be centralized storage devices or distributed storage devices.

[0055] Exemplarily, when the storage device is a distributed storage device, each independent storage node is connected to a protection device, and the protection device is used to protect the user data in the storage node to which it is connected; or, the data protection system includes one protection device, and multiple independent storage nodes are commonly connected to the protection device, and the protection device is used to protect the user data in the multiple independent storage nodes; or, the data protection system includes multiple protection devices, and each protection device is used to protect the user data in one or more independent storage nodes in the distributed storage device, wherein the correspondence between the protection device and the storage node can be set by the administrator.

[0056] Understandably, Figure 4 The protective equipment in Figure 3 The difference between the protection modules in Figure 4The storage device and the protection device are two independent devices, that is, the protection device can communicate with the storage device to protect the user data in the storage device. Figure 4 For details about how the host accesses the user data in the storage device and how the protection device protects the user data in the storage device, see Figure 3 It is described in , and will not be repeated here.

[0057] When a storage device is attacked by a virus, in order to restore the user data in the storage device as completely as possible, the present application provides a data protection method, in which when the storage device is accessed by a host, the protection module (or protection device) in the storage device will identify whether the IO sequence initiated by the host is a suspicious IO sequence. If it is determined that the IO sequence initiated by the host is a suspicious IO sequence, a defense mechanism and a snapshot are generated, so that the host cannot continue to access the user data in the storage device during the period from determining the suspicious IO sequence to generating the snapshot. Among them, the host can be called a suspicious host, and the suspicious host is a host that may be infected by a virus and then attack the storage device. The virus is used to destroy the user data in the storage device, and the virus can specifically be a ransomware virus. That is, the suspicious host has the possibility of destroying a certain user data in the storage device when accessing the user data. It can be understood that the time point of generating the snapshot is the time point when the suspicious IO sequence is found. Assuming that the suspicious host is the attacking host, the degree of damage to the user data by the attacking host at this time point is low. In this way, the storage device can restore the user data in the storage device as completely as possible according to the snapshot.

[0058] Figure 5 The flowchart of the first data protection method provided by this application is applicable to Figure 3 In the data protection system shown, the data protection method can be executed by a storage device. Specifically, the data protection method can be executed by a protection module in the storage device.

[0059] Step 501: The storage device obtains an IO sequence for accessing the storage device.

[0060] In the first possible way, when accessing the storage device, the host can send an access request to the storage device, and one access request can be considered as an IO. Accordingly, the storage device performs corresponding actions according to the IO, and records the IO in the log. It can be understood that the log records one or more IOs from the host. Further, the storage device can periodically obtain an IO sequence of a first preset duration from the log, and the IO sequence includes multiple IOs, and the multiple IOs can be initiated by one or more hosts accessing the storage device. For example, the storage device obtains the IO sequence from the current moment to the 5 minutes before the current moment from the log every 3 minutes, that is, the first preset duration is 5 minutes. The storage device can obtain the IO sequence from the log in the period from the 6th minute to the 10th minute at the 10th minute, and obtain the IO sequence from the log in the period from the 9th minute to the 13th minute at the 13th minute.

[0061] In the second possible way, when accessing the storage device, the host can send an access request to the storage device, and the access request is considered to be an IO. Accordingly, the storage device can intercept the IO from the host in real time, and then obtain multiple IOs (i.e., IO sequences) within the first preset time length. For example, the storage device obtains the IO sequence from the current moment to the 5 minutes after the current moment every 3 minutes, that is, the first preset time length is 5 minutes. Further, the storage device can obtain the IO sequence from the 6th minute to the 10th minute, and obtain the IO sequence from the 9th minute to the 13th minute starting from the 9th minute.

[0062] Compared with the first possible method, in the second possible method, the IO obtained by the storage device is the IO sent by the host in real time. The storage device can detect suspicious IO sequences more timely (see the description in step 502 below), and then protect the user data in the storage device in time, which helps to restore the user data in the storage device as completely as possible.

[0063] Exemplarily, the IO sequence may include one or more of the following: an IO for writing user data to a storage medium of a storage device (which may be referred to as a write IO for short); an IO for reading user data from a storage medium of a storage device (which may be referred to as a read IO for short); an IO for deleting user data (which may be referred to as a delete IO for short); an IO for renaming a user file in the storage medium of a storage device (which may be referred to as a rename IO for short), etc.

[0064] Step 502: The storage device determines a suspicious IO sequence from the IO sequence.

[0065] The suspicious IO sequence has the possibility of damaging the first data; or in other words, the suspicious host that initiates the suspicious IO has the possibility of damaging the user data stored in the storage device.

[0066] based on Figure 1 or Figure 2 In different architectures, storage devices determine suspicious IO sequences in different ways:

[0067] In NAS architecture:

[0068] Each IO can be used to access a certain user file. Exemplarily, each IO carries the access information of the IO, and the access information may include one or more of the index information, access type, and access time of the user file accessed by the IO, wherein the index information may specifically be a file path or file name, etc., and the access type may be used to indicate whether the IO is a write IO, a read IO, a delete IO, or a rename IO, etc. Further, the storage device first determines multiple IOs for accessing the same user file from the IO sequence within the first preset time length according to the index information carried in each IO, and forms the multiple IOs into a first IO sequence, and then matches the first IO sequence with the preset IO sequence to determine the matching degree between the first IO sequence and the preset IO sequence.

[0069] Among them, the preset IO sequence is an IO sequence that is pre-learned by the storage device and has the possibility of damaging the user data stored in the storage device. The preset IO sequence can be one or more. Exemplarily, a preset IO sequence includes read IO, write IO, delete IO and rename IO in sequence, that is, when a host performs read action, write action, delete action and rename action on a user file in sequence, it indicates that the host may first read the user file (that is, the unencrypted user file) from the storage device, and then encrypt the read unencrypted user file to obtain an encrypted user file, and then write the encrypted user file to the storage device, delete the unencrypted user file in the storage device, and rename the encrypted user file.

[0070] If the storage device determines that the matching degree between the first IO sequence and a preset IO sequence is greater than a threshold, the first IO sequence is determined to be a suspicious IO sequence, that is, the first IO sequence has the possibility of damaging the user files accessed by it; if the storage device determines that the matching degree between the first IO sequence and each preset IO sequence is less than or equal to the threshold, the IO sequence is determined not to be a suspicious IO sequence, that is, the first IO sequence does not have the possibility of damaging the user files accessed by it. Of course, it is also possible that if the storage device determines that the matching degree between the first IO sequence and a preset IO sequence is greater than or equal to the threshold, the first IO sequence is determined to be a suspicious IO sequence, and if the storage device determines that the matching degree between the first IO sequence and each preset IO sequence is less than the threshold, the first IO sequence is determined not to be a suspicious IO sequence. The threshold can be set manually by the administrator, and the threshold is, for example, 80%.

[0071] For example, there is one preset IO sequence, and the preset IO sequence includes read IO, write IO, delete IO, and rename IO in sequence. The IO sequence within the first preset duration is shown in Table 1. The storage device can extract the first IO sequence from the IO sequence for file name 1, that is, IO 2, IO 3, IO 6, and IO 8. The storage device determines that IO 2, IO 3, IO 6, and IO 8 are read IO, write IO, delete IO, and rename IO in sequence, that is, it is determined that the match degree between the extracted first IO sequence and the preset IO sequence is 100%, and thus the IO sequence is determined to be a suspicious IO sequence. The storage device can extract the first IO sequence from the IO sequence for file name 2, that is, IO 1, IO 4, IO 5, and IO 7. The storage device determines that IO 1, IO 4, IO 5, and IO 7 are read IO, read IO, write IO, and rename IO in sequence, that is, it is determined that the match degree between the extracted first IO sequence and the preset IO sequence is 25%, and thus the IO sequence is determined not to be a suspicious IO sequence.

[0072] Table 1

[0073] IO Sequence file name IO 1 File name 2 IO 2 File name 1 IO 3 File name 1 IO 4 File name 2 IO 5 File name 2 IO 6 File name 1 IO 7 File name 2 IO 8 File name 1 IO 9 File name 3 IO 10 File name 4

[0074] In the present application, the user file accessed by the first IO sequence may be referred to as the first data or the first file.

[0075] In SAN architecture:

[0076] Each IO can be used to access a certain address in the storage device (ie, the access address).

[0077] Exemplarily, each IO carries access information of the IO, and the access information may include one or more of an access address, an access type, and an access time of the IO access, wherein the access address is, for example, a logical block address (LBA), and the access type may be used to indicate whether the IO is a write IO, a read IO, a delete IO, or a rename IO, etc.

[0078] In one possible implementation, the storage device first determines multiple IOs for accessing the same access address from the IO sequences within a first preset time length according to the access address carried in each IO, and forms the multiple IOs into a first IO sequence, and then matches the first IO sequence with the preset IO sequence to obtain the matching degree between the two. The preset IO sequence can be one or more. Furthermore, if the storage device determines that the matching degree between the first IO sequence and a preset IO sequence is greater than a threshold, it determines that the IO sequence is a suspicious IO sequence, that is, the IO sequence has the possibility of damaging the user data in the address it accesses; if the storage device determines that the matching degree between the IO sequence and each preset IO sequence is less than or equal to the threshold, it determines that the IO sequence is not a suspicious IO sequence, that is, the IO sequence does not have the possibility of damaging the user data in the address it accesses. For details of this possible implementation, please refer to the description in the above NAS architecture.

[0079] In another possible implementation, the storage device determines statistical features within the first preset time length based on access information of each IO in the IO sequence within the first preset time length, wherein the statistical features include statistical features in time and space dimensions. Exemplarily, a feature extraction model is pre-stored in the storage device, and the feature extraction model is used to determine the statistical features within the first preset time length based on the access information of each IO in the IO sequence. Subsequently, the storage device determines multiple target IOs from the IO sequence to form a suspicious IO sequence based on the statistical features within the first preset time length. Exemplarily, a detection model is pre-stored in the storage device, and the detection model can extract multiple target IOs from the IO sequence based on the statistical features to form a suspicious IO sequence. The storage device can input the IO sequence and the statistical features into the detection model to obtain the suspicious IO sequence output by the detection model.

[0080] In this application, the access address of each target IO access stores a data block. For the convenience of description, the user data composed of the data blocks corresponding to each target IO can be called the first data; the access address carried in the target IO can be called the index information of the first data.

[0081] Step 503: The storage device generates a defense mechanism and a snapshot in response to the determined suspicious IO sequence.

[0082] The snapshot is used by the storage device to restore the user data stored in the storage device, and the defense mechanism is used to prevent a suspicious host from accessing the user data stored in the storage device before the storage device completes generating the snapshot.

[0083] In one possible implementation, the defense mechanism is specifically used to prevent a suspicious host from accessing second data before the storage device completes generating a snapshot, wherein the second data is user data stored in the storage device except the first data.

[0084] The storage device generates a defense mechanism in response to the determined suspicious IO sequence, and then generates a snapshot after the defense mechanism is generated. Alternatively, the storage device generates a defense mechanism and a snapshot synchronously in response to the determined suspicious IO sequence.

[0085] The following is an explanation of the defense mechanism generated by the storage device:

[0086] Defense mechanism 1: within a second preset time period after determining a suspicious IO sequence, when the storage device receives an access request for second data from a suspicious host, the storage device rejects the access request.

[0087] Defense mechanism 2: When the storage device receives an access request for the second data from a suspicious host, it waits for a second preset time before executing the operation corresponding to the access request. The access request includes index information of the second data. For example, in the NAS architecture, the access request includes the file name or storage path of the second data (or the second file); in the SAN architecture, the access request includes the access address of the second data. For example, in the NAS architecture, the access request is a read IO, and the access request includes the file name of the second data. After receiving the access request, the storage device can wait for the second preset time, determine the second data according to the file name of the second data, and send an access response to the suspicious host, and the access response includes the second data.

[0088] Furthermore, the second preset duration may be input into the storage device by an administrator, or may be determined by the storage device according to the duration required for it to generate a snapshot. Exemplarily, the second preset duration is greater than or equal to the duration required for the storage device to generate a snapshot. Exemplarily, when the storage device receives an access request from a suspicious host, it starts a timer in the storage device, the timing duration of the timer is the second preset duration, and when the timer expires, the storage device sends an access response corresponding to the access request to the suspicious host. In another exemplary embodiment, when the storage device receives an access request from a suspicious host, it starts a timer in the storage device, and when the timer reaches the second preset duration, the storage device sends an access response corresponding to the access request to the suspicious host.

[0089] In addition, in the NAS architecture, the storage device stores multiple user files in sequence, and accordingly, in one possible way, the suspicious host reads the multiple user files in sequence. Based on this, the present application also provides a defense mechanism 3: after determining the suspicious IO sequence, the storage device can create a preset file (i.e., preset data, or bait file) before or after the next user file (i.e., the second file) that the suspicious host wants to access, according to the storage order of multiple user files and the access order of the suspicious host to access the user files, so that the suspicious host first accesses the preset file and then continues to access the second file. Specifically, when the access order is sequential, the storage device creates a preset file before the second file; when the access order is reverse, the storage device creates a preset file after the second file. Among them, the preset file can be one or more. In this way, it is ensured that the suspicious host cannot continue to access the second file within the second preset time length, so as to achieve the effect of protecting the second file through the preset file. It can be understood that if the suspicious host is an attacking host, then only the preset file is destroyed, and the preset file is not a user file, even if it is destroyed, it does not matter.

[0090] For example, user files 1 to 5 are stored in sequence in the storage device, and the suspicious host accesses them sequentially (i.e., accesses user files 1 to 5 in sequence). Furthermore, when the suspicious host accesses user file 1, the storage device generates a defense mechanism for the suspicious host, i.e., creates a preset file before user file 2. Accordingly, the suspicious host will access user files 2 to 5 only after it has accessed the preset file in the storage device. In this way, user files 2 to 5 can be effectively protected. In addition, the suspicious host can also access in reverse order (i.e., accesses user files 5 to 1 in sequence). When the suspicious host accesses user file 5, the storage device generates a defense mechanism for the suspicious host, i.e., generates a preset file after user file 4. Accordingly, the suspicious host will access user files 4 to 1 only after it has accessed the preset file in the storage device. In this way, user files 4 to 1 can be effectively protected.

[0091] Furthermore, in the NAS architecture, the storage device may select one of the defense mechanisms 1 to 3; or, defense mechanism 2 and defense mechanism 3 may be used in combination, which is not limited in this application.

[0092] It should be added that in the NAS architecture, preset files can not only be used as a defense mechanism, but also can be used by storage devices to identify suspicious IO sequences. Exemplarily, the storage device creates a preset file before the user file, and when the suspicious host sequentially accesses the user files in the storage device, it pre-accesses the preset file in the storage device. Another exemplary example is that the storage device creates a preset file after the user file, and when the suspicious host accesses the user files in the storage device in reverse order, it pre-accesses the preset file in the storage device. Furthermore, the storage device identifies the suspicious host, or identifies the suspicious IO sequence initiated by the suspicious host, and then generates a defense mechanism. In this case, the suspicious host has only accessed the preset file in the storage device, but has not yet accessed the user file, which helps to further protect the integrity of the user files.

[0093] Furthermore, when the storage device generates a snapshot, it may specifically generate a snapshot of the second data, or generate a snapshot of the storage directory where the second data is located, or generate a snapshot of the user data in the entire storage device. The time required for the storage device to generate the snapshot is less than or equal to the second preset time, that is, after the second preset time, even if the suspicious host continues to access the second data and the second data is destroyed by the suspicious host, the storage device can restore the second data based on the snapshot that has been generated.

[0094] It should be added that, in the above step 502, assuming that the storage device has identified the suspicious IO sequence before the suspicious IO sequence accesses the first data in the storage device, then the defense mechanism generated by the storage device can also be used to prevent the suspicious host from accessing the first data before the storage device completes the generation of the snapshot. In this way, it also helps to ensure the integrity of the first data in the storage device. For specific implementation, please refer to the description of the above storage device protecting the second data, and "second data" can be replaced with "first data".

[0095] It can be understood that in the above step 502, the storage device only identifies a suspicious IO sequence, that is, identifies a suspicious host that may damage the user data stored in the storage device. However, in fact, the suspicious host may be a host used to damage the user data stored in the storage device, that is, the suspicious host is an attacking host; or, the suspicious host may not be a host used to damage the user data stored in the storage device, that is, the suspicious host is a normal host.

[0096] To this end, the storage device needs to further perform the following step 504.

[0097] Step 504: The storage device determines whether the suspicious host is an attacking host.

[0098] Specifically, when the storage device determines that the first data is destroyed by the suspicious IO sequence, it determines that the suspicious IO sequence is an IO sequence that destroys the first data, and / or determines that the suspicious host is an attacking host, and further, the storage device may execute the following step 505. When the storage device determines that the first data is not destroyed by the suspicious IO sequence, it determines that the suspicious IO sequence is not an IO sequence used to destroy the first data, and / or determines that the suspicious host is not an attacking host, that is, it determines that the suspicious host is a normal host, and further, the storage device may execute the following step 506.

[0099] When the storage device determines whether the first data is damaged by the suspicious IO sequence, there are two specific methods:

[0100] Method 1

[0101] The storage device obtains the index information of the first data from the suspicious IO sequence, and then obtains the first data from the storage device based on the index information of the first data. In the NAS architecture, the index information of the first data may be a file path or a file name. The storage device may extract the file path or file name of the first data from the suspicious IO sequence, and then read the first data from the storage medium of the storage device based on the file path or file name of the first data. In the SAN architecture, the suspicious IO sequence includes multiple target IOs, and the first data is composed of data blocks at the access address carried in each target IO. The storage device may read the data blocks at each access address from the storage medium of the storage device based on the access address carried by each target IO (i.e., the index information of the first data), and then form the first data.

[0102] After acquiring the first data from the storage device, the storage device may perform content detection on the first data to obtain a detection result, and then determine whether the first data is damaged by the suspicious IO sequence according to the detection result.

[0103] Among them, content detection is such as entropy detection. Specifically, the storage device calculates the entropy value of the first data. If the obtained entropy value is greater than a preset value, it is determined that the first data is destroyed by a suspicious IO sequence; if the obtained entropy value is less than or equal to the preset value, it is determined that the first data is not destroyed by the suspicious IO sequence. Alternatively, the storage device calculates the entropy value of the first data. If the obtained entropy value is greater than or equal to the preset value, it is determined that the first data is destroyed by a suspicious IO sequence; if the obtained entropy value is less than the preset value, it is determined that the first data is not destroyed by the suspicious IO sequence. It is explained that the entropy value of the first data can be used to indicate the randomness of the first data. The higher the randomness, the higher the entropy value. When the first data is destroyed by a suspicious IO sequence, the randomness of the corresponding first data will be greatly increased, that is, the entropy value will be greatly increased.

[0104] Method 2

[0105] Considering that the amount of the first data is large, the storage device may first sample the first data to obtain the sampled data. The storage device then performs content detection on the sampled data to obtain a detection result, and then determines whether the sampled data is damaged by a suspicious IO sequence based on the detection result, wherein the content detection is, for example, entropy detection (for specific implementation, see the description in method 1). Further, when the storage device determines that the sampled data is damaged by a suspicious IO sequence, it determines that the first data is damaged by the suspicious IO sequence; when the storage device determines that the sampled data is not damaged by the suspicious IO sequence, it determines that the first data is not damaged by the suspicious IO sequence.

[0106] In a specific implementation, the storage device samples the first data to obtain multiple segments of data, and the lengths of the multiple segments of data are the same or different. Subsequently, the storage device performs a splicing operation on the multiple segments of data, performs content detection on the result after the splicing operation, and then determines whether the first data is damaged by the suspicious IO sequence according to the obtained detection result; or the storage device performs content detection on the multiple segments of data respectively, and then determines whether the first data is damaged by the suspicious IO sequence according to the obtained detection results corresponding to the multiple segments of data.

[0107] Exemplarily, the multiple segments of data include front segment data, middle segment data, and rear segment data in the first data, and the front segment data, middle segment data, and rear segment data are all preset data lengths. In another exemplary embodiment, when the storage device performs entropy value detection on the multiple segments of data respectively, if any entropy value corresponding to the multiple segments of data is greater than a preset value, it is determined that the first data is damaged by a suspicious IO sequence; if the entropy values ​​corresponding to the multiple segments of data are all less than or equal to the preset value, it is determined that the first data is not damaged by the suspicious IO sequence.

[0108] In addition, the storage device may also directly sample the first data from the storage medium of the storage device according to the index information of the first data, and then perform content detection on the sampling result.

[0109] In this way, the storage device can help reduce the amount of calculation when performing content detection on the first data.

[0110] In the present application, the order of step 504 and step 503 is not limited. It can be understood that after the storage device determines the suspicious IO sequence, it generates a defense mechanism and determines whether the suspicious host is an attacking host.

[0111] Step 505: The storage device displays warning information.

[0112] The warning information can be used to display at least one or more of the following information to the administrator: the identification of the attacking host, the index information of the first data, the index information of the second data, the identification of the user application running in the attacking host, and the virus information. Optionally, the storage device can display the warning information in the display interface of the storage device.

[0113] When the administrator sees the alarm information, the administrator can choose whether to disconnect the connection between the attacking host and the storage device, and send a corresponding instruction to the storage device. In one example, the administrator sends a disconnect instruction to the storage device, and the storage device disconnects the connection between the attacking host and the storage device based on the disconnect instruction from the administrator. In another example, the administrator sends a keep-connected instruction to the storage device, and the storage device keeps the connection between the attacking host and the storage device based on the keep-connected instruction from the administrator.

[0114] Of course, in this application, when the storage device determines that the suspicious host is an attacking host, it can also disconnect the connection between the attacking host and the storage device by itself to maximize the retention of user data in the storage device. In addition, the storage device may not determine whether the suspicious host is an attacking host, but directly display an alarm message to the administrator. The alarm message can be used to display one or more of the following information to the administrator: the identifier of the suspicious host, the index information of the first data, the index information of the second data, the identifier of the user application running in the suspicious host, etc., and then the administrator determines whether to disconnect the connection between the suspicious host and the storage device. The specific implementation can be seen in the above description.

[0115] Optionally, the administrator may send a restore command to the storage device, and the storage device responds to the restore command and restores the user data stored in the storage device according to the snapshot. Alternatively, the storage device restores the user data stored in the storage device according to the snapshot after generating the snapshot for a third preset time.

[0116] Step 506: The storage device releases the defense mechanism so that a normal host can normally access the user data stored in the storage device.

[0117] Among them, the defense mechanism is lifted, that is, when the storage device receives an access request from a normal host for data stored in the storage device, it no longer rejects the access request. Alternatively, when the storage device receives an access request from a normal host for data stored in the storage device, it no longer performs delay processing (such as a timer), but directly executes the operation corresponding to the access request. Alternatively, the storage device deletes a preset file in the storage device.

[0118] Figure 6 The flowchart of the second data protection method provided by the present application is shown in FIG. Figure 5The difference is that after the storage device generates a snapshot, the defense mechanism is lifted.

[0119] Step 601: The storage device obtains an IO sequence for accessing the storage device. For specific implementation, please refer to the description in step 501.

[0120] Step 602: The storage device determines a suspicious IO sequence from the above IO sequences. For specific implementation, please refer to the description in step 502.

[0121] Step 603: The storage device generates a defense mechanism and a snapshot in response to the determined suspicious IO sequence. The snapshot is used to restore the user data stored in the storage device, and the defense mechanism is used to prevent the suspicious host from accessing the user data stored in the storage device before the snapshot is generated. For specific implementation, please refer to the description in step 503.

[0122] Step 604: the storage device removes the defense mechanism so that the suspicious host can normally access the user data stored in the storage device. For specific implementation, please refer to the description in step 506.

[0123] In this embodiment, the storage device can remove the defense mechanism after generating the snapshot (without having to determine that the suspicious host is not the attacking host). Accordingly, the suspicious host can continue to access the user data stored in the storage device normally. In this way, when the suspicious host is a normal host, the normal host can resume access to the user data stored in the storage device as soon as possible.

[0124] In addition, multiple user applications may be running in the suspicious host, including virus-carrying applications installed by hackers in the suspicious host, as well as normal user applications. After the storage device generates a snapshot, disabling the defense mechanism can ensure that normal user applications can access the storage device normally.

[0125] For example, user applications 1 to 5 may be running in a suspicious host, and user application 1 is a virus-containing application installed by a hacker in the suspicious host, that is, user application 1 will damage user data 1 when accessing user data 1 in the storage device, while user applications 2 to 4 are all normal applications, that is, user applications 2 to 4 are all normal accesses when accessing user data 2 to 4 in the storage device respectively (without causing damage to user data 2 to user data 4). In this case, the storage device removes the defense mechanism after generating the snapshot, which helps to ensure that user applications 2 to 4 running on the suspicious host can normally access the user data they need. Moreover, even if user application 1 (suspicious host) also damages other user data (such as user data 6) after the defense mechanism is removed, the storage device can also restore the user data 6 based on the snapshot that has been generated.

[0126] In step 605, the storage device determines whether the suspicious host is an attacking host. For specific implementation, please refer to the description in step 504. Further, when the storage device determines that the suspicious host is an attacking host, step 606 is continued.

[0127] Step 606: The storage device displays the warning information. For specific implementation, please refer to the description in step 505.

[0128] based on Figure 5 and Figure 6 The flowchart shown is Figure 7 The following is a schematic diagram of an application scenario provided for example in this application, which includes hosts 1 to 3 and a storage device. Furthermore, the storage device can execute business IO processes, IO monitoring processes, ransomware detection processes and defense processes. The description of each process is as follows:

[0129] Business IO process: The storage device receives IO from any host from host 1 to host 3, and performs corresponding operations according to the IO. For example, the storage device receives a read IO from host 1, and the storage device obtains the user data corresponding to the index information from the storage medium according to the index information in the read IO, and returns the user data to host 1. For another example, the storage device receives a write IO from host 2, and the storage device stores the user data in the write IO in the storage medium.

[0130] IO monitoring process: the storage device identifies a suspicious IO sequence from the IO sequence, and determines the suspicious host that initiated the suspicious IO sequence from host 1 to host 3. For specific implementation, please refer to the description in the above steps 501 and 502.

[0131] Ransomware detection process: The storage device obtains the first data accessed by the suspicious IO sequence from the storage medium according to the index information in the suspicious IO sequence, performs content detection on the first data, and then determines that the suspicious host is an attacking host according to the result of the content detection. For specific implementation, please refer to the description in the above step 504.

[0132] Defense process: After identifying the suspicious IO sequence, the storage device generates a defense mechanism and a snapshot, and the specific implementation can refer to the description in the above step 503 and step 603. The storage device also removes the defense mechanism, and the specific implementation can refer to the description in the above step 506 or the description in the above step 604 respectively.

[0133] In addition, after determining that the suspicious host is the attacking host, the storage device also outputs an alarm message, and after receiving the disconnection instruction from the administrator, disconnects the connection between the attacking host and the storage device, as described in the above steps 505 and 606. For example, if the attacking host is host 1, the storage device disconnects the connection between host 1 and the storage device.

[0134] Figure 8 The flowchart of the third data protection method provided by this application is applicable to Figure 4 In the data protection system shown, the data protection method can be executed by a protection device.

[0135] Step 801: The protection device obtains an IO sequence for accessing a storage device.

[0136] In one example, each time the storage device receives an IO, it forwards the IO to the protection device, and accordingly, the protection device can obtain the IO sequence within the first preset time. In another example, the storage device records the IO from the host in a log, and the protection device reads the log in the storage device to obtain the IO sequence within the first preset time.

[0137] For the contents not described in detail in step 801 , please refer to the description in the above step 501 .

[0138] Step 802: The protection device determines a suspicious IO sequence from the IO sequence. The contents not described in detail in step 802 can be referred to the description in step 502 above, and the “storage device” can be replaced with the “protection device” for understanding.

[0139] Step 803-a, in response to the determined suspicious IO sequence, the protection device sends a defense instruction and a snapshot instruction to the storage device, wherein the defense instruction is used to instruct the storage device to generate a defense mechanism, and the snapshot instruction is used to instruct the storage device to generate a snapshot for recovering user data stored in the storage device. Accordingly, the storage device receives the defense instruction and the snapshot instruction from the protection device.

[0140] Step 803-b, the storage device generates a defense mechanism and a snapshot.

[0141] The defense instruction may be a first defense instruction, and the first defense instruction is used to instruct the storage device to reject the access request after receiving the access request from the suspicious host.

[0142] The defense indication may be a second defense indication, which is used to instruct the storage device to delay for a second preset time period before allowing the suspicious host to access the user data stored in the storage device.

[0143] In one example, the protection device determines a second preset duration, carries the second preset duration in a second defense indication, and sends it to the storage device. The second preset duration may be input into the protection device by an administrator. Alternatively, the second preset duration may be determined by the protection device based on the duration required for the storage device to generate a snapshot. Exemplarily, the second preset duration is greater than or equal to the duration required for the storage device to generate a snapshot. Exemplarily, the protection device sends a request to the storage device for requesting the duration required for snapshot generation, and correspondingly, the storage device sends the duration required for the snapshot generation to the protection device. In another example, after receiving the second defense indication from the protection device, the storage device determines the second preset duration on its own. Exemplarily, the second preset duration is determined by the storage device based on the duration required for the storage device to generate a snapshot. Exemplarily, the second preset duration is greater than or equal to the duration required for the storage device to generate a snapshot.

[0144] In addition, in the NAS architecture, the defense instruction can also be a third defense instruction, which is used to instruct the storage device to create a preset file before or after the next user file (such as the second file) that the suspicious host wants to access according to the storage order of multiple user files and the access order of the suspicious host to access the user files, so that the suspicious host first accesses the preset file and then continues to access the second file. Alternatively, the protection device can also obtain the storage order of multiple user files in the storage device and the access order of the suspicious host to access the user files from the storage device, and then create a preset file according to the storage order and access order, and determine the placement position of the preset file, and carry the preset file and the placement position in the third defense instruction to send to the storage device; accordingly, the storage device places the preset file at the position corresponding to the placement position (such as before or after the second file) according to the third defense instruction.

[0145] Optionally, after generating the snapshot, the storage device sends a snapshot completion indication to the protection device to inform the protection device that the current snapshot has been completed. Alternatively, the protection device determines that the current snapshot of the storage device has been generated after a fourth preset time period has passed since the snapshot indication was sent to the storage device, wherein the fourth preset time period is greater than or equal to the time period required for the storage device to generate the snapshot.

[0146] Among them, the contents not described in detail in step 803-a and step 803-b can be found in the description of the above step 503.

[0147] Step 804: The protection device determines whether the suspicious host is an attacking host.

[0148] In one possible manner, the protection device obtains index information of the first data from the suspicious IO sequence, obtains the first data from the storage device according to the index information, and then performs content detection on the first data to obtain a detection result, and determines whether the first data is damaged by the suspicious IO sequence according to the detection result.

[0149] In another possible manner, considering that the first data is relatively large, after obtaining the first data from the storage device, the protection device may first sample the first data to obtain the sampled data. Subsequently, the protection device performs content detection on the sampled data to obtain a detection result, and then determines whether the sampled data is damaged by a suspicious IO sequence according to the detection result. In addition, the protection device may directly sample the first data from the storage medium of the storage device according to the index information of the first data, and then perform content detection on the sampled result.

[0150] Further, when the protection device determines that the first data is destroyed by the suspicious IO sequence, it can determine that the suspicious IO sequence is an IO sequence that destroys the first data, and / or determine that the suspicious host is an attacking host. Further, the protection device can execute step 805; when the protection device determines that the first data is not destroyed by the suspicious IO sequence, it can determine that the suspicious IO sequence is not an IO sequence used to destroy the first data, and / or determine that the suspicious host is a normal host. Further, the protection device can execute step 806 (including step 806a and step 806b).

[0151] In the present application, the order of step 804 and step 803 (including step 803a and step 803b) is not limited. It can be understood that after the protection device determines the suspicious IO sequence, it can instruct the storage device to generate a defense mechanism and a snapshot, and determine whether the suspicious host is an attacking host.

[0152] For the contents not described in detail in step 804 , please refer to the description in the above step 504 .

[0153] Step 805: The protection device displays the warning information. For the contents not described in detail in step 805, please refer to the description in step 505 above, and the "storage device" can be replaced by the "protection device".

[0154] Optionally, after determining that the suspicious host is an attacking host, the protection device may also instruct the storage device to display an alarm message to the administrator. Exemplarily, the protection device sends the alarm message to the storage device, and then the storage device displays the alarm message to the administrator in a display interface.

[0155] Optionally, the administrator may also send a first recovery instruction to the protection device, and the protection device sends a second recovery instruction to the storage device in response to the first recovery instruction. Accordingly, the storage device responds to the second recovery instruction and recovers the user data stored in the storage device according to the snapshot. Alternatively, after the storage device generates the snapshot for a third preset time, it recovers the user data stored in the storage device according to the snapshot. Alternatively, after determining that the storage device has generated the snapshot for a fifth preset time, the protection device sends a second recovery instruction to the storage device, and accordingly, the storage device responds to the second recovery instruction and recovers the user data stored in the storage device according to the snapshot.

[0156] Step 806-a, the protection device sends a defense release instruction to the storage device, the defense release instruction is used to instruct the storage device to release the defense mechanism. Correspondingly, the storage device receives the defense release instruction from the protection device.

[0157] Step 806 - b , the storage device releases the defense mechanism so that a normal host can normally access the user data stored in the storage device.

[0158] For the contents not described in detail in step 806a and step 806b, please refer to the description in the above step 506.

[0159] It should be added that, after determining that the storage device has generated a snapshot, the protection device can also send a defense release instruction to the storage device (without having to determine that the suspicious host is not the attacking host). Accordingly, the storage device releases the defense mechanism, and the suspicious host can continue to access the user data stored in the storage device normally. In this way, in the case that the suspicious host is a normal host, the normal host can restore access to the user data in the storage device as soon as possible; or in the case that there are normal user applications running in the attacking host, the normal user applications can restore access to the user data in the storage device as soon as possible. This specific implementation can be found in the above Figure 6 and Figure 8 It has been described in the relevant embodiments and will not be repeated here.

[0160] based on Figure 8 The flowchart shown is Fig. 9 Another application scenario diagram provided for example in this application includes hosts 1 to 3, storage devices, and protection devices. Furthermore, the storage device can execute the business IO process, and the protection device can execute the IO monitoring process, the ransomware detection process, and the defense process. The description of each process can be found in the above Figure 7 Description of the related embodiments.

[0161] Further, in the IO monitoring process, the protection device can obtain the IO sequence from the storage device, and then identify the suspicious IO sequence from the IO sequence. For specific implementation, please refer to the description in the above steps 801 and 802. In the ransomware detection process, the protection device can obtain the first data from the storage device. Specifically, the protection device first instructs the storage device to load the first data, and then obtains the first data from the storage device. For specific implementation, please refer to the description in the above step 804. In the defense process, the protection device can deploy the generated defense mechanism in the storage device. Specifically, the protection device instructs the storage device to reject the access request of the suspicious host, or delays the delay of the suspicious host accessing the user data stored in the storage device, or the protection device instructs the storage device to add a preset file in the storage device. For specific implementation, please refer to the description in the above step 803. After determining that the suspicious host is an attacking host, the protection device can also instruct the storage device to display the alarm information. After receiving the disconnection instruction from the administrator, the storage device disconnects the connection between the attacking host and the storage device. For specific implementation, please refer to the description in the above step 805.

[0162] Based on the above content and the same idea, Fig.10 This is a schematic diagram of the structure of a possible data protection device provided by the present application. These data protection devices can be used to implement the functions of the storage device or protection device in the above method embodiment, and thus can also achieve the beneficial effects possessed by the above method embodiment.

[0163] In this application, the data protection device may be as follows: Figure 3 The storage device shown may also be Figure 4 The protection device shown may also be a module (such as a chip) applied to a storage device or a protection device.

[0164] like Fig.10 As shown, the data protection device 1000 includes an acquisition module 1001, which is used to acquire an IO sequence for accessing a storage device; a determination module 1002, which is used to determine a suspicious IO sequence from the IO sequence, wherein the suspicious IO sequence is initiated by a suspicious host when accessing the first data in the storage device, and the suspicious IO sequence is used to indicate that the suspicious host has the possibility of damaging the user data stored in the storage device, and the user data stored in the storage device includes the first data; a generation module 1003, which is used to generate a defense mechanism and a snapshot in response to determining the suspicious IO sequence; wherein the snapshot is used to restore the user data stored in the storage device, and the defense mechanism is used to prevent the suspicious host from accessing the user data stored in the storage device before the snapshot is generated. In a possible implementation, the defense mechanism is specifically used to prevent the suspicious host from accessing the second data before the snapshot is generated, and the second data is the user data stored in the storage device except the first data.

[0165] Based on the above content and the same concept, the present application also provides a computing device 1100. Fig.11 As shown, the computing device 1100 includes: a bus 1101, a processor 1102, a memory 1103 and a communication interface 1104. The processor 1102, the memory 1103 and the communication interface 1104 communicate with each other through the bus 1101. The computing device 1100 may be a server. It should be understood that the present application does not limit the number of processors and memories in the computing device 1100.

[0166] The bus 1101 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.11 The bus 1101 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 1101 may include a path for transmitting information between various components of the computing device 1100 (for example, the memory 1103, the processor 1102, and the communication interface 1104).

[0167] The processor 1102 may include any one or more processors such as a CPU, a GPU, a microprocessor (MP), or a digital signal processor (DSP).

[0168] The memory 1103 may include a volatile memory, such as a random access memory (RAM). The processor 1102 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0169] The memory 1103 stores executable program codes, and the processor 1102 executes the executable program codes to implement the functions of the aforementioned acquisition module 1001, determination module 1002, or generation module 1003, thereby implementing the aforementioned data protection method. That is, the memory 1103 stores some or all computer program instructions for executing the data protection method.

[0170] The communication interface 1104 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1100 and other devices or a communication network.

[0171] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function according to the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid state drive (SSD).

[0172] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0173] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0174] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0175] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0176] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data protection method, characterized in that: include: Get the input and output IO sequence for accessing the storage device; Determining a suspicious IO sequence from the IO sequence, wherein the suspicious IO sequence is initiated by a suspicious host when accessing first data in the storage device, and the suspicious IO sequence is used to indicate that the suspicious host has the possibility of damaging data stored in the storage device, and the data stored in the storage device includes the first data; In response to determining the suspicious IO sequence, a defense mechanism and a snapshot are generated; wherein the snapshot is used to recover the data stored in the storage device, and the defense mechanism is used to prevent the suspicious host from accessing the data stored in the storage device before completing the generation of the snapshot.

2. The method according to claim 1, characterized in that The defense mechanism is used to prevent the suspicious host from accessing second data before completing the generation of the snapshot, where the second data is data stored in the storage device other than the first data.

3. The method according to claim 1, characterized in that The defense mechanism includes one or more of the following A and B: A. before completing the generation of the snapshot, denying the access request of the suspicious host to the storage device; B. Adding preset data in the storage device so that the suspicious host can access the preset data before completing the generation of the snapshot.

4. The method according to claim 1, characterized in that After determining the suspicious IO sequence, the method further includes: determining whether the first data is destroyed by the suspicious IO sequence; When it is determined that the first data is destroyed by the suspicious IO sequence, the suspicious host is determined to be an attacking host; and / or when it is determined that the first data is not destroyed by the suspicious IO sequence, the suspicious host is determined to be a normal host.

5. The method according to claim 4, characterized in that The determining whether the first data is destroyed by the suspicious IO sequence includes: Performing entropy value detection on the first data to obtain an entropy value of the first data; When the entropy value is greater than a preset value, it is determined that the first data is destroyed by the suspicious IO sequence; when the entropy value is less than or equal to the preset value, it is determined that the first data is not destroyed by the suspicious IO sequence.

6. The method according to claim 5, characterized in that The performing entropy value detection on the first data to obtain the entropy value of the first data includes: Sampling the first data to obtain sampled data; The entropy value detection is performed on the sampled data to obtain the entropy value of the first data.

7. The method according to claim 4, characterized in that After determining that the suspicious host is an attacking host, the method further includes: The alarm information is displayed, wherein the alarm information is used by an administrator to determine whether to disconnect the connection between the attacking host and the storage device.

8. The method according to claim 1, characterized in that After the snapshot is generated, the following is further included: The defense mechanism is released so that the suspicious host can normally access the data stored in the storage device.

9. The method according to any one of claims 1 to 8, characterized in that The determining a suspicious IO sequence from the IO sequence includes: Determine a first IO sequence for accessing a first file from the IO sequence; the first data is the first file; When it is determined that the matching degree between the first IO sequence and a preset IO sequence is greater than a threshold, the first IO sequence is determined to be the suspicious IO sequence, and the preset IO sequence is a pre-learned IO sequence that may damage user data stored in the storage device.

10. The method according to any one of claims 1 to 8, characterized in that Each IO in the IO sequence carries access information, wherein the access information includes an access address, and the access information further includes one or more of an access type and an access time; The determining a suspicious IO sequence from the IO sequence includes: Determining statistical features of the IO sequence according to access information carried in each IO of the IO sequence; The suspicious IO sequence is determined from the IO sequence according to the statistical characteristics of the IO sequence; wherein the data on the access address of each IO in the suspicious IO sequence constitutes the first data.

11. A data protection device, characterized in that: include: An acquisition module is used to acquire an input and output IO sequence for accessing a storage device; a determination module, configured to determine a suspicious IO sequence from the IO sequence, wherein the suspicious IO sequence is initiated when a suspicious host accesses first data in the storage device, and the suspicious IO sequence is used to indicate that the suspicious host has a possibility of damaging data stored in the storage device, and the data stored in the storage device includes the first data; A generation module is used to generate a defense mechanism and a snapshot in response to the determination module determining the suspicious IO sequence; wherein the snapshot is used to recover the data stored in the storage device, and the defense mechanism is used to prevent the suspicious host from accessing the data stored in the storage device before completing the generation of the snapshot.

12. The device according to claim 11, characterized in that The defense mechanism is used to prevent the suspicious host from accessing second data before completing the generation of the snapshot, where the second data is data stored in the storage device other than the first data.

13. The device according to claim 12, characterized in that The defense mechanism includes one or more of the following A and B: A. before completing the generation of the snapshot, denying the access request of the suspicious host to the storage device; B. Adding preset data in the storage device so that the suspicious host can access the preset data before completing the generation of the snapshot.

14. The device according to claim 12, characterized in that After determining the suspicious IO sequence, the determination module is further used to: determining whether the first data is destroyed by the suspicious IO sequence; When it is determined that the first data is destroyed by the suspicious IO sequence, the suspicious host is determined to be an attacking host; and / or when it is determined that the first data is not destroyed by the suspicious IO sequence, the suspicious host is determined to be a normal host.

15. The device according to claim 14, characterized in that When determining whether the first data is damaged by the suspicious IO sequence, the determining module is specifically used to: Performing entropy value detection on the first data to obtain an entropy value of the first data; When the entropy value is greater than a preset value, it is determined that the first data is destroyed by the suspicious IO sequence; when the entropy value is less than or equal to the preset value, it is determined that the first data is not destroyed by the suspicious IO sequence.

16. The device according to claim 15, characterized in that When the determination module performs entropy value detection on the first data to obtain the entropy value of the first data, the determination module is specifically used to: Sampling the first data to obtain sampled data; The entropy value detection is performed on the sampled data to obtain the entropy value of the first data.

17. The device according to claim 14, characterized in that After determining that the suspicious host is an attacking host, the determining module is further used to: display alarm information, wherein the alarm information is used by the administrator to determine whether to disconnect the connection between the attacking host and the storage device.

18. The device according to claim 12, characterized in that After completing the generation of the snapshot, the generation module is further used to: The defense mechanism is released so that the suspicious host can normally access the data stored in the storage device.

19. The device according to any one of claims 12 to 18, characterized in that When the determining module determines a suspicious IO sequence from the IO sequence, it is specifically used to: Determine a first IO sequence for accessing a first file from the IO sequence; the first data is the first file; When it is determined that the matching degree between the first IO sequence and a preset IO sequence is greater than a threshold, the first IO sequence is determined to be the suspicious IO sequence, and the preset IO sequence is a pre-learned IO sequence that may damage user data stored in the storage device.

20. The device according to any one of claims 12 to 18, characterized in that Each IO in the IO sequence carries access information, wherein the access information includes an access address, and the access information further includes one or more of an access type and an access time; When the determining module determines a suspicious IO sequence from the IO sequence, it is specifically used to: Determining statistical features of the IO sequence according to access information carried in each IO of the IO sequence; The suspicious IO sequence is determined from the IO sequence according to the statistical characteristics of the IO sequence; wherein the data on the access address of each IO in the suspicious IO sequence constitutes the first data.

21. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program or instruction, and when the computer program or instruction is executed by a computing device, the method according to any one of claims 1 to 10 is implemented.

22. A computer program product, characterized in that The computer program product comprises a computer program or instructions, and when the computer program or instructions are executed by a computing device, the method according to any one of claims 1 to 10 is implemented.

23. A computing device, characterized in that The computer comprises a processor connected to a memory, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the computing device executes the method according to any one of claims 1 to 10.

24. A storage system, characterized in that: The method comprises a computing device and a storage medium, wherein the computing device and the storage medium are connected, the storage medium is used to store data, and the computing device is used to execute the method according to any one of claims 1 to 10.

Images