Ransomware attack detection method and device and storage system

Abstract

The invention discloses a ransomware attack detection method and device and a storage system, and belongs to the technical field of block storage. And the computer equipment determines whether the storage system has the abnormal LUN or not according to the IO operation for the storage system in the target time period. If the storage system has the abnormal LUN, one or more abnormal logic blocks in the abnormal LUN are obtained, and the abnormal logic blocks are logic blocks subjected to write operation in the target time period in the abnormal LUN. And according to the data content of the one or more abnormal logic blocks, determining whether the abnormal LUN is subjected to ransomware attack in the target time period. According to the method, the abnormal LUN and the abnormal logic block are accurately positioned by performing anomaly screening on the IO operation for the storage system, and whether the storage system is subjected to the ransomware attack or not is accurately judged by further performing anomaly detection on the data content of the abnormal logic block.

Description

Technical Field

[0001] The present application relates to the field of block storage technology, and in particular to a ransomware attack detection method and device, and a storage system. Background Art

[0002] With the rapid development of information technology, data plays an increasingly important role in today's era. Along with this is the development and update of ransomware. These viruses encrypt user data to prevent victims from accessing their own data. At the same time, the virus will blackmail victims to pay a ransom to obtain the decryption key, otherwise the victims will lose their data forever. The emergence of massive data and ransomware is also accompanied by the rise of the data security field. How to detect ransomware attacks to protect user data from ransomware as much as possible is an important security requirement in the current storage field. However, due to the characteristics of block storage (also known as block-level storage) with few input and output (IO) operation types and weak storage data semantics, it is difficult to detect ransomware attacks on block storage. Summary of the invention

[0003] The present application provides a ransomware attack detection method and device, and a storage system, which can realize ransomware attack detection on a storage system using block storage.

[0004] In a first aspect, a method for detecting a ransomware attack is provided. The method comprises: determining whether there is an abnormal logical unit number (LUN) in the storage system according to an IO operation on the storage system in a target period, wherein the IO operation includes one or more of a read operation, a write operation or a delete operation. If there is an abnormal LUN in the storage system, one or more abnormal logical blocks in the abnormal LUN are obtained, and the abnormal logical blocks are logical blocks in the abnormal LUN that have been written to in the target period. According to the data content of the one or more abnormal logical blocks, it is determined whether the abnormal LUN is attacked by a ransomware attack in the target period.

[0005] In this application, by performing abnormal screening on the IO operations of the storage system, the abnormal LUN and abnormal logic block are accurately located, and further by performing abnormal detection on the data content of the abnormal logic block, an accurate judgment on whether the storage system is under a ransomware attack is achieved. By combining IO operation screening and data content detection, the reliability and accuracy of ransomware attack detection are improved.

[0006] Optionally, the implementation process of determining whether there is an abnormal LUN in the storage system according to the IO operation on the storage system in the target period includes: for each LUN in the storage system, obtaining an IO feature set according to the IO operation on the LUN in the target period, the IO feature set including one or more statistical operation counts, each statistical operation count being obtained according to the statistics of one or more IO operations performed on the LUN in the target period. According to the IO feature set, determining whether the LUN is an abnormal LUN.

[0007] This application performs abnormality screening on each LUN in the storage system based on the IO operation of a single LUN in the storage system, and realizes abnormal judgment on each LUN, thereby improving the comprehensiveness and reliability of ransomware attack detection on the storage system.

[0008] Optionally, the one or more statistical operation counts include a read operation count, a write operation count, a delete operation count, a read-overwrite write operation count, a delete-write operation count, a write-delete operation count, a read-delete-write operation count, or a read-write-delete operation count. Among them, the write operation count is obtained according to the write operation count performed on the LUN in the target period. The read operation count is obtained according to the read operation count performed on the LUN in the target period. The delete operation count is obtained according to the delete operation count performed on the LUN in the target period. The read-overwrite write operation count is obtained according to the read operation and write operation count performed on the same logical block in the LUN in the target period. The delete-write operation count is obtained according to the delete operation and write operation count performed on the LUN in the target period. The write-delete operation count is obtained according to the write operation and delete operation count performed on the LUN in the target period. The read-delete-write operation count is obtained according to the read operation, delete operation and write operation count performed on the LUN in the target period. The read-write-delete operation count is obtained based on the read operations, write operations, and delete operations performed on the LUN in the target period.

[0009] In this application, the statistical operation count is set according to the attack behavior of the ransomware virus. If the ransomware virus has other attack operation sequences, the counts of other attack operation sequences can also be used as statistical operation counts for determining the ransomware attack. This application does not limit the type of statistical operation count.

[0010] Optionally, the counting granularity used for statistical operation counting is the logical block size in the LUN. Since the length of IO operations for the storage system is not fixed, by uniformly splitting the IO operations according to the logical block size and then counting them, the reliability and accuracy of the statistical operation counting in determining the result of the ransomware attack can be improved.

[0011] Optionally, an implementation method of determining whether a LUN is an abnormal LUN based on an IO feature set includes: inputting the IO feature set into an IO detection model, obtaining a first determination result output by the IO detection model, and the first determination result indicates normal or abnormal. The IO detection model is trained based on multiple sample IO feature sets, and each sample IO feature set is respectively labeled with a normal label or an abnormal label. When the first determination result indicates abnormality, the LUN is determined to be an abnormal LUN.

[0012] This application can use an IO detection model to judge LUN abnormality, or can also directly judge LUN abnormality based on an IO feature set. For example, count thresholds corresponding to multiple statistical operation counts are set respectively, and if the number of counts in the multiple statistical operation counts that exceeds the corresponding count threshold meets certain conditions, the LUN is judged as an abnormal LUN.

[0013] Optionally, the IO feature set is labeled according to the first determination result to obtain a new sample IO feature set, and the new sample IO feature set is used to update the IO detection model.

[0014] This application can store the training samples of the IO detection model in the local file system, and continuously update the training samples of the model during the ransomware attack detection process to regularly update the IO detection model, so that the IO detection model can better adapt to user business, thereby improving the accuracy of ransomware attack detection.

[0015] Optionally, the implementation process of determining whether the abnormal LUN is attacked by ransomware within the target period according to the data content of one or more abnormal logical blocks includes: for an abnormal logical block, obtaining a data feature set according to the data content of the abnormal logical block, the data feature set including the autocorrelation coefficient between the current data content of the abnormal logical block and the original data content and / or the entropy value of the current data content of the abnormal logical block. According to the data feature set, determining whether the data of the abnormal logical block is encrypted. When the number of abnormal logical blocks with encrypted data in one or more abnormal logical blocks reaches a threshold, it is determined that the abnormal LUN is attacked by ransomware within the target period.

[0016] The present application can perform abnormal content detection on each abnormal logical block in the abnormal LUN according to the data content of the abnormal logical block in the abnormal LUN, and determine whether the data of the abnormal logical block is encrypted, thereby improving the comprehensiveness and reliability of ransomware attack detection on the storage system.

[0017] Optionally, the entropy value includes a Markov entropy value and / or a Shannon entropy value. The entropy value is used to reflect the uncertainty of the data. The greater the uncertainty of the data, the higher the entropy value. The uncertainty of encrypted data is higher than that of non-encrypted data, so the entropy value of encrypted data is higher than that of non-encrypted data. In other words, the higher the entropy value of the data content, the higher the possibility that the data is encrypted.

[0018] Optionally, an implementation method of determining whether the data of the abnormal logic block is encrypted based on the data feature set includes: inputting the data feature set into the content detection model, obtaining a second determination result output by the content detection model, and the second determination result indicates whether the data is encrypted. The content detection model is trained based on multiple sample data feature sets, and each sample data feature set is respectively annotated with a label indicating whether the data is encrypted. When the second determination result indicates that the data is encrypted, it is determined that the data of the abnormal logic block is encrypted.

[0019] The present application may use a content detection model to determine whether the data of an abnormal logic block is encrypted, or may directly determine whether the data of an abnormal logic block is encrypted based on a data feature set. For example, an autocorrelation coefficient threshold and an entropy value threshold are set. If the autocorrelation coefficient between the current data content of the logic block and the original data content is less than the autocorrelation coefficient threshold, and / or the entropy value of the current data content of the logic block is greater than the entropy value threshold, it is determined that the data of the logic block is encrypted.

[0020] Optionally, the data feature set is labeled according to the second determination result to obtain a new sample data feature set, and the new sample data feature set is used to update the content detection model.

[0021] The present application can store the training samples of the content detection model in the local file system and continuously update the training samples of the model during the ransomware attack detection process to regularly update the content detection model, so that the content detection model can better adapt to user business and thus improve the accuracy of ransomware attack detection.

[0022] In a second aspect, a ransomware attack detection device is provided. The device includes multiple functional modules, and the multiple functional modules interact with each other to implement the method in the above first aspect and its various embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on specific implementations.

[0023] In a third aspect, a computer device is provided, comprising: a processor and a memory;

[0024] The memory is used to store a computer program, wherein the computer program includes program instructions;

[0025] The processor is used to call the computer program to implement the method in the above-mentioned first aspect and each implementation manner.

[0026] Optionally, the computer device is integrated into a storage system, or the computer device is communicatively connected to the storage system.

[0027] In a fourth aspect, a storage system is provided, including: a controller and a storage medium, wherein the storage medium is used to store data in a block storage manner, and the controller is used to access data in the storage medium to implement the method in the first aspect and its various embodiments. Wherein, accessing data includes reading data, writing data, or deleting data.

[0028] Optionally, the storage system is a storage area network (SAN) storage system.

[0029] In a fifth aspect, a computer-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a processor, the method in the above-mentioned first aspect and its various embodiments is implemented.

[0030] In a sixth aspect, a computer program product is provided, including a computer program, which, when executed by a processor, implements the method in the above-mentioned first aspect and its various embodiments.

[0031] In a seventh aspect, a chip is provided, the chip comprising a programmable logic circuit and / or program instructions, and when the chip is running, the method in the above-mentioned first aspect and its various embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a schematic diagram of an application architecture provided by an embodiment of the present application;

[0033] Figure 2 This is another application architecture diagram provided by an embodiment of the present application;

[0034] Figure 3 This is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0035] Figure 4 It is a flowchart of a ransomware attack detection method provided in an embodiment of the present application;

[0036] Figure 5 It is a schematic diagram of determining whether a LUN is abnormal based on an IO detection model provided in an embodiment of the present application;

[0037] Figure 6 It is a schematic diagram of determining whether data of a logic block is encrypted based on a content detection model provided by an embodiment of the present application;

[0038] Figure 7 It is a structural diagram of a storage system provided in an embodiment of the present application;

[0039] Figure 8 It is a structural schematic diagram of a ransomware attack detection device provided in an embodiment of the present application;

[0040] Fig. 9 It is a schematic diagram of the hardware structure of a computer device provided in an embodiment of the present application;

[0041] Fig.10 It is a structural diagram of a storage system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0043] Ransomware attacks are malicious acts that make the victim's computer or specific data unavailable or unreadable. Only when the victim pays the ransom can the key used to restore the computer or decrypt the encrypted data be obtained. After a ransomware attack, personal data and documents may be lost at the least, or the business operation of the enterprise may be suspended and unsustainable. Building an anti-ransomware system to achieve real-time security protection of user data is an important technical means urgently needed in the current market, with great market prospects and commercial value. The key to building an anti-ransomware system is how to detect ransomware attacks in a timely and effective manner.

[0044] At present, most of the ransomware attack detection technologies proposed for data storage products are aimed at file storage, such as network attached storage (NAS) systems. Compared with file storage, block storage has the characteristics of fewer IO operation types, weak storage data semantics, and no file system structure, which makes it difficult to detect ransomware attacks on block storage. There are two main technical means for detecting ransomware attacks on block storage in the related art, one is IO behavior detection, and the other is content detection. In the IO behavior detection method, only feature extraction is performed on read operations and write operations. This detection method can detect ransomware behaviors that overwrite source files, but cannot detect ransomware behaviors that delete source data after new encryption, so there will be missed detection of ransomware behaviors. In the content detection method, data entropy value features are currently mainly used. Based on the high entropy characteristics of encrypted data, the entropy value of the data block is calculated to determine whether the data block is encrypted, so as to determine whether the data block is attacked by ransomware. However, since the compressed data also has a high entropy value, this detection method is prone to false detection of ransomware behaviors in data compression scenarios. From the above, we can see that the reliability of the current ransomware attack detection solution for block storage is low.

[0045] Based on this, the present application proposes a ransomware attack detection scheme for a storage system using block storage. In the technical scheme provided by the present application, firstly, based on the IO operations on the storage system within the target time period, it is determined whether there are abnormal LUNs in the storage system that may be attacked by ransomware. If there are abnormal LUNs in the storage system, the abnormal logical blocks in the abnormal LUN that have been written to within the target time period are located, and further, it is determined whether the abnormal LUN is attacked by ransomware based on the data content of the abnormal logical blocks. Among them, IO operations include one or more of read operations, write operations or delete operations. The present application achieves precise positioning of abnormal LUNs and abnormal logical blocks by performing abnormal screening on IO operations on the storage system, and further achieves accurate judgment on whether the storage system is attacked by ransomware by performing abnormal detection on the data content of abnormal logical blocks. By combining IO operation screening and data content detection, the reliability and accuracy of ransomware attack detection are improved.

[0046] The technical solution of this application is described in detail below from multiple angles such as application scenarios, method flow, virtual devices, hardware devices, etc.

[0047] The following is an illustration of the application scenarios involved in the embodiments of the present application.

[0048] The ransomware attack detection method provided in the embodiment of the present application can be applied to a storage product with a storage system, that is, to provide a storage product with anti-ransomware features. Or it can also be applied to an external security all-in-one product, that is, to provide a service product with anti-ransomware features. Among them, the storage system supports storing data in a block storage manner. Optionally, the storage system is a SAN storage system. SAN is a dedicated high-speed network for accessing block storage, consisting of interconnected hosts, switches and storage devices. SAN storage is a widely used storage product today, which can provide block storage services for key application data such as enterprises, finance and data centers.

[0049] For example, Figure 1 and Figure 2 They are schematic diagrams of an application architecture provided by an embodiment of the present application. Figure 1 or Figure 2 As shown in FIG. 1 , the application architecture includes a storage business module and a ransomware attack detection system. The ransomware attack detection system includes a data acquisition module and a ransomware detection module. The storage business module is deployed in the storage system. Figure 1 In the application architecture shown in Figure 1, the ransomware attack detection system is deployed in the storage system. Figure 2 In the application architecture shown, the ransomware attack detection system is deployed in an external device independent of the storage system.

[0050] The storage service module is used to store data and respond to a series of operations on the data stored in the storage system, such as IO operations. The storage services provided by the storage service module include but are not limited to block storage. Figure 1 or Figure 2 As shown, the storage service provided by the storage service module also includes file storage.

[0051] The ransomware attack detection system is used to execute the ransomware attack detection method provided in the embodiment of the present application. The data acquisition module is used to collect IO operations for the storage system and collect the data content stored in the storage system. The ransomware detection module is used to determine whether the storage system is under a ransomware attack based on the IO operations for the storage system and the data content stored in the storage system. For specific functional implementation, refer to the following steps 401 to 403.

[0052] Alternatively, see Figure 1 or Figure 2 The ransomware attack detection system further includes an alarm module. The alarm module is used to output an alarm prompt after the storage system is attacked by ransomware. For specific function implementation, refer to the following step 404. Figure 2In the application architecture shown, the alarm module can output an alarm prompt to the storage system, and the storage system will eventually issue an alarm to remind the operation and maintenance personnel that it is under a ransomware attack; or, the ransomware attack detection system directly issues an alarm through the alarm module to remind the operation and maintenance personnel that the protected storage system is under a ransomware attack.

[0053] Optionally, in Figure 1 In the application architecture shown, the ransomware attack detection system can be deployed in the storage system in a container deployment manner. Alternatively, the ransomware attack detection system can also be deployed in the storage system in a traditional deployment manner, such as deploying an application in the storage system in the form of a plug-in or script, and the storage system runs the application through the operating system to implement ransomware attack detection.

[0054] Optionally, in Figure 2 In the application architecture shown, the ransom attack detection system can be connected to the storage system through a peripheral component interconnect express (PCIE) interface, so that the ransom attack detection system can obtain IO operations for the storage system and the data content stored in the storage system through the PCIE interface, so as to realize ransom attack detection on the storage system. Among them, the IO operations for the storage system include but are not limited to read operations, write operations or delete operations. The read operation is used to read data from the storage system. The write operation is used to write data to the storage system. The delete operation is used to delete data in the storage system.

[0055] In an embodiment of the present application, the storage system supports storing data in a block storage manner. For example, the storage system may be a SAN storage system. One or more LUNs may be created in the storage system, and each LUN is provided with a LUN identifier to uniquely identify the LUN. The LUN is used to provide accessible logical storage resources to the host. Each LUN includes one or more logical blocks. The logical block has an access address, called a logical block address (LBA), which is an address used when the host accesses the LUN.

[0056] Optionally, the storage system includes a controller and a storage medium, the storage medium is used to store data in a block storage manner, and the controller is used to access data in the storage medium to implement the ransomware attack detection method provided in the embodiment of the present application. Figure 1 In the application architecture shown, the ransomware attack detection system is specifically deployed in the controller of the storage system.

[0057] Optionally, the storage system in the embodiment of the present application may be a centralized storage system, or may be a distributed storage system.

[0058] For example, Figure 3 This is a schematic diagram of an application scenario provided by an embodiment of the present application. Figure 3 As shown in FIG. 1 , the application scenario includes a host and a storage system. The host is a device used by a user to interact with the storage system. For example, the host can store data in the storage system in the form of blocks and perform IO operations on the stored data blocks. Optionally, the host can be a physical device, or a virtual machine or container deployed on a physical device. The storage system can be Figure 1 The storage system shown or Figure 2 The storage system shown, Figure 3 Storage system is the Figure 1 The storage system shown is used as an example for description.

[0059] The following is an illustration of the method flow involved in the embodiments of the present application.

[0060] For example, Figure 4 1 is a flow chart of a method for detecting a ransomware attack provided in an embodiment of the present application. The method is applied to a computer device, which may be any device with computing capabilities. The computer device may be, for example, Figure 1 Storage system as shown, or Figure 2 external devices as shown, or as Figure 3 The storage system shown. Figure 4 As shown, the method includes but is not limited to the following steps 401 to 403. Optionally, the method further includes the following step 404.

[0061] Step 401: Determine whether there is an abnormal LUN in the storage system according to IO operations on the storage system within a target period.

[0062] The IO operation for the storage system includes one or more of a read operation, a write operation or a delete operation.

[0063] In an embodiment of the present application, first, a computer device may collect IO information of a storage system, and the IO information includes IO operations for the storage system, the execution time of the IO operations, the LBA of the IO operations, and the length of the IO operations. Among them, the LBA of the IO operation may be the starting LBA of the IO operation. The LBA of the IO operation is used to indicate which LUN in the storage system the IO operation is directed to. The length of the IO operation is used to indicate the number of logical blocks targeted by the IO operation. For example, the logical block size may be used as the length unit of the IO operation, and the length of the IO operation is L, indicating that the IO operation is directed to L logical blocks, that is, the execution object of the IO operation includes L logical blocks, and L is a positive integer. Then the computer device may slice the collected IO information according to LUN and time to obtain the IO information of a single LUN in the storage system in different time slices. For example, Table 1 shows the IO information collected by the computer device.

[0064] Table 1

[0065] LUN identification time Starting LBA length IO Operations LUN1 T1 LBA1 1 read LUN2 T1 LBA4 1 read LUN1 T2 LBA1 1 Write LUN1 T3 LBA2 1 delete … … … … …

[0066] Referring to Table 1, the IO information collected by the computer device indicates that at time T1, a read operation is performed on a logical block with a starting address of LBA1 in LUN1 of the storage system, and a read operation is performed on a logical block with a starting address of LBA4 in LUN2; at time T2, a write operation is performed on a logical block with a starting address of LBA1 in LUN1 of the storage system; and at time T3, a delete operation is performed on a logical block with a starting address of LBA2 in LUN1 of the storage system.

[0067] For example, Table 2 shows the result obtained after the computer device slices the collected IO information according to LUN and time.

[0068] Table 2

[0069]

[0070] As shown in Table 2, LUN1 includes three logical blocks, and the starting LBAs of the three logical blocks are LBA1, LBA2 and LBA3 respectively. Three IO operations are performed on LUN1 in time slice 1, namely, a read operation on a logical block with a starting address of LBA1 at time T1, a write operation on a logical block with a starting address of LBA1 at time T2, and a delete operation on a logical block with a starting address of LBA2 at time T3. Two IO operations are performed on LUN1 in time slice 2, namely, a write operation on two consecutive logical blocks with a starting address of LBA2 at time T4, and a delete operation on a logical block with a starting address of LBA3 at time T5. LUN2 includes two logical blocks, and the starting LBAs of the two logical blocks are LBA4 and LBA5 respectively. LUN2 has two IO operations executed in time slice 1, namely, a read operation on a logical block with a starting address of LBA4 at time T1 and a write operation on a logical block with a starting address of LBA4 at time T3. LUN2 has one IO operation executed in time slice 2, namely, a delete operation on a logical block with a starting address of LBA5 at time T4.

[0071] Optionally, the computer device can collect the IO information of the storage system in real time, and then perform a ransomware attack judgment on the storage system after each time slice is counted, so as to achieve real-time detection of the storage system. The duration of the time slice can be set according to actual needs, and the embodiment of the present application does not limit this. The target time period in the above step 401 can be any time slice.

[0072] Optionally, the implementation process of the above step 401 includes the following steps 4011 to 4012.

[0073] In step 4011, for each LUN in the storage system, an IO feature set is obtained based on the IO operations on the LUN during the target period. The IO feature set includes one or more statistical operation counts, and each statistical operation count is obtained based on one or more IO operations performed on the LUN during the target period.

[0074] Optionally, the counting granularity used for statistical operation counting is the logical block size in the LUN. For example, the size of a logical block in the LUN is 8 kilobytes (KB), and an IO operation performed on the LUN is used to read 16KB of data content, then the IO operation is recorded as 2 read operations (the length of the IO operation is 2), and accordingly, the operation sequence of the IO operation is "read-read". Since the length of the IO operation for the storage system is not fixed, the reliability and accuracy of the statistical operation count for determining the result of the ransomware attack can be improved by uniformly splitting the IO operations according to a certain granularity (such as the logical block size). Of course, other granularities can also be used to split the IO operations in the embodiments of the present application, such as 2KB or 4KB, etc., without limitation.

[0075] Optionally, the one or more statistical operation counts include a read operation count, a write operation count, a delete operation count, a read-overwrite write operation count, a delete-write operation count, a write-delete operation count, a read-delete-write operation count, or a read-write-delete operation count. The statistical operation counts here are set according to the attack behavior of the ransomware virus. If the ransomware virus has other attack operation sequences, the counts of other attack operation sequences can also be used as statistical operation counts for determining the ransomware attack. The embodiment of the present application does not limit the type of statistical operation counts.

[0076] The write operation count is obtained based on the write operations performed on the LUN during the target period. That is, the write operation count is the total number of times data is written to the LUN during the target period.

[0077] The read operation count is obtained based on the read operations performed on the LUN during the target period. That is, the read operation count is the total number of times data is read from the LUN during the target period.

[0078] The deletion operation count is obtained based on the deletion operations performed on the LUN during the target period. That is, the deletion operation count is the total number of times data is deleted from the LUN during the target period.

[0079] The read-overwrite-write operation count is obtained based on the statistics of the read operations and write operations successively executed on the same logical block in the LUN during the target period. It is worth noting that a read-overwrite-write operation count is for the same logical block. If there are read operations and write operations successively executed on the same logical block during the target period, it is recorded as one read-overwrite-write operation count. It is not limited here whether the read operation and the write operation are continuous operations. For example, the operation sequence for one logical block is: read-write, or read-delete-write, which is recorded as one read-overwrite-write operation count. Optionally, the computer device can count the IO operations of different starting LBAs separately and then sum them. For example, the LUN includes 3 logical blocks, and the starting LBAs of the 3 logical blocks are x, y, and z respectively. If the operation sequence of the IO operation with the starting LBA of x in the target period is "read-write-write-write", then the read-overwrite operation count is recorded as 1; if the operation sequence of the IO operation with the starting LBA of y in the target period is "read-write-write-write-read-write-write", then the read-overwrite operation count is recorded as 2; if the operation sequence of the IO operation with the starting LBA of z in the target period is "write-write-write-write-write", then the read-overwrite operation count is recorded as 0. Accordingly, the read-overwrite operation count of the LUN in the target period is 3.

[0080] The delete-write operation count is obtained based on the delete operations and write operations that are executed on the LUN in the target period.

[0081] The write-delete operation count is obtained based on the statistics of the write operations and the delete operations successively executed on the LUN within the target time period.

[0082] The read-delete-write operation count is obtained based on the read operations, delete operations, and write operations performed on the LUN in the target period.

[0083] The read-write-delete operation count is obtained based on the read operations, write operations, and delete operations performed on the LUN in the target period.

[0084] The above-mentioned delete-write operation count, write-delete operation count, read-delete-write operation count, and read-write-delete operation count do not require the same starting LBA. Only the operation sequence is considered. If the operation sequence of the IO operation for the LUN in the target period is "read-read-delete-write-write-delete-delete-read", then the delete-write operation count is 1, the write-delete operation count is 2, the read-delete-write operation count is 1, and the read-write-delete operation count is 2. The calculation methods of these four statistical operation counts are similar. Here, the calculation of the read-delete-write operation count and the read-write-delete operation count are taken as examples. Among them, R represents a read operation, D represents a delete operation, and W represents a write operation.

[0085] The method for calculating the read-delete-write operation count for the LUN during the target period is as follows: first use the dictionary {R:0; D:0; W:0} to count, 0 represents the current count is 0, and the D count is required to be no greater than R, and the W count is no greater than D. According to the operation sequence "read-read-delete-write-write-delete-delete-read", it can be seen that first it is read twice, and the dictionary count becomes {R:2; D:0; W:0}. Then it is deleted once, and the dictionary count becomes {R:2; D:1; W:0}; then it is written twice, and since the W count is not greater than D, the dictionary count becomes {R:2; D:1; W:1}; then it is deleted twice again, and since the D count is not greater than R, the dictionary count becomes {R:2; D:2; W:1}; finally it is read once, and the dictionary count becomes {R:3; D:2; W:1}. The read-delete-write operation count for the LUN during the target period takes the minimum value of the R, D, and W counts, that is, the value of W, which is 1.

[0086] The method for calculating the read-write-delete operation count for the LUN during the target period is as follows: first use the dictionary {R:0; W:0; D:0} to count, 0 represents the current count is 0, and the W count is required to be no greater than R, and the D count is no greater than W. According to the operation sequence "read-read-delete-write-write-delete-delete-read", it can be seen that first it is read twice, and the dictionary count becomes {R:2; W:0; D:0}. Then it is deleted once, and since the D count is no greater than W, the dictionary count is still {R:2; W:0; D:0}; then it is written twice, and the dictionary count becomes {R:2; W:2; D:0}; then it is deleted twice again, and since the D count is no greater than W, the dictionary count becomes {R:2; W:2; D:2}; finally it is read once, and the dictionary count becomes {R:3; W:2; D:2}. The read-write-delete operation count for the LUN during the target period takes the minimum value of the R, W, and D counts, that is, the value of D, which is 2.

[0087] Optionally, the computer device can also perform IO write address statistics, such as recording the LUN identifier of the LUN targeted by the write operation, the starting LBA of the write operation, and the length of the write operation. Since the ransomware will eventually write the encrypted data to the storage system, the computer device can record the starting LBA of the IO with the operation type of write while extracting the IO features, so as to later extract the data content of the logical block on which the write operation has been performed.

[0088] In step 4012, it is determined whether the LUN is an abnormal LUN based on the IO feature set.

[0089] Optionally, an implementation of the above step 4012 includes: inputting an IO feature set into an IO detection model to obtain a first judgment result output by the IO detection model. The first judgment result indicates normal or abnormal. The IO detection model is trained based on multiple sample IO feature sets, and each sample IO feature set is respectively marked with a normal label or an abnormal label. When the first judgment result indicates abnormality, the LUN is determined to be an abnormal LUN. The IO detection model is a binary classification model. The IO detection model can be a machine learning model.

[0090] For example, Figure 5 FIG. 1 is a schematic diagram of determining whether a LUN is abnormal based on an IO detection model provided by an embodiment of the present application. Figure 5 As shown, by inputting the IO feature sets of multiple LUNs in multiple time slices into the IO detection model, the determination results of multiple LUNs in multiple time slices output by the IO detection model are obtained. For example, the multiple LUNs include LUN1 and LUN2, and the multiple time slices include time slice 1 to time slice m, where m is a positive integer. According to Figure 5 From the output results of the IO detection model, we can see that LUN1 is a normal LUN. LUN2 is abnormal in time slice 2 and normal in other time slices.

[0091] Optionally, after determining whether a LUN is an abnormal LUN based on the IO feature set, the computer device may also label the used IO feature set based on the first determination result to obtain a new sample IO feature set, and the new sample IO feature set is used to update the IO detection model. In the embodiment of the present application, the IO detection model is updated regularly by storing the training samples of the IO detection model in the local file system and continuously updating the training samples of the model during the ransomware attack detection process, so as to make the IO detection model better adapt to the user business, thereby improving the accuracy of ransomware attack detection.

[0092] Alternatively, in addition to using the IO detection model, in the embodiments of the present application, it is also possible to directly determine whether a LUN is an abnormal LUN based on an IO feature set. For example, count thresholds corresponding to multiple statistical operation counts are set respectively, and if the number of counts exceeding the corresponding count thresholds in the multiple statistical operation counts meets certain conditions, the LUN is determined to be an abnormal LUN. For example, taking the statistical operation counts including the above 8 types of operation counts as an example, if no less than 4 types of operation counts exceed the corresponding count thresholds, the LUN is determined to be an abnormal LUN.

[0093] Step 402: If the storage system has an abnormal LUN, obtain one or more abnormal logical blocks in the abnormal LUN.

[0094] The abnormal logical block is a logical block in the abnormal LUN on which a write operation has been performed within the target time period.

[0095] In the embodiment of the present application, by performing abnormal screening on the IO operations of the storage system, accurate positioning of abnormal LUNs and abnormal logical blocks is achieved, and the data content of the abnormal logical blocks can be obtained.

[0096] Step 403: Determine whether the abnormal LUN is attacked by ransomware within a target period of time based on the data content of the one or more abnormal logical blocks.

[0097] If an abnormal LUN is attacked by ransom during the target period, it means that the storage system is attacked by ransom during the target period. If no abnormal LUN is attacked by ransom during the target period, it means that the storage system is not attacked by ransom during the target period.

[0098] Optionally, the implementation process of the above step 403 includes the following steps 4031 to 4033.

[0099] In step 4031, for an abnormal logic block, a data feature set is obtained according to the data content of the abnormal logic block, and the data feature set includes the autocorrelation coefficient between the current data content of the abnormal logic block and the original data content and / or the entropy value of the current data content of the abnormal logic block.

[0100] Here, the original data content refers to the data content of the abnormal logic block at the beginning of the target period, and the current data content refers to the data content of the abnormal logic block at the end of the target period.

[0101] The autocorrelation coefficient represents the correlation of data in time series. In other words, the autocorrelation coefficient between the current data content of the abnormal logic block and the original data content is used to reflect the data similarity. The larger the autocorrelation coefficient, the more similar the data is, indicating that the current data content is less changed than the original data content, and the possibility of the data being newly encrypted or blackmailed is lower.

[0102] Optionally, the autocorrelation coefficient between the current data content and the original data content of the abnormal logic block is calculated as follows: first, the original data content and the current data content of the abnormal logic block are converted into decimal values ​​​​of 0-255 byte by byte, and the decimal sequence of the original data content is {x1,…,x n}, the decimal sequence of the current data content is {y1,…,y n}. Then, the autocorrelation coefficient calculation formula is used to calculate the autocorrelation coefficient R between the original data content and the current data content of the abnormal logic block. The autocorrelation coefficient calculation formula is as follows:

[0103]

[0104] in, It is the overall average of the decimal sequence of the original data content and the decimal sequence of the current data content.

[0105] The entropy value is used to reflect the uncertainty of data. The greater the uncertainty of the data, the higher the entropy value. The uncertainty of encrypted data is higher than that of non-encrypted data, so the entropy value of encrypted data is higher than that of non-encrypted data. In other words, the higher the entropy value of the data content, the higher the possibility that the data is encrypted. Optionally, the entropy value includes a Markov entropy value and / or a Shannon entropy value.

[0106] Optionally, a method for calculating the Markov entropy value is as follows: first, the current data content of the abnormal logic block is converted into a binary value, and the binary sequence of the current data content is assumed to be S = (s1, ...s n ), where s i ∈A{0,1}. The probability state transfer matrix of the first-order Markov is [P 0,0 , P 0,1 , P 1,0 , P 1,1 ]. 0,0 It indicates the probability that the current state is 0 and the next state is 0. The calculation formula is as follows:

[0107]

[0108] Among them, #{00in S} represents the frequency of 00 in S, such as in the binary sequence 001000, #{00in S}=3, #{01in S}=1, #{10in S}=1.

[0109] Similarly, P 0,1 , P 1,0 and P 1,1 The calculation formulas are as follows:

[0110]

[0111]

[0112]

[0113] The calculation formula of the first-order Markov entropy value is: ∑P i,j log2 P i,j , where i∈[0,1],j∈[0,1].

[0114] The calculation method of Shannon entropy is similar to that of Markov entropy. The calculation formula of Shannon entropy is: -∑P ilog2 P i Its input is to convert each byte (8 bits) of binary data into a decimal value i in the range of 0-255, P i is the statistical probability of each byte i appearing. The calculation method of the Shannon entropy value is not described in detail in the embodiment of the present application.

[0115] In step 4032, based on the data feature set, it is determined whether the data of the abnormal logic block is encrypted.

[0116] Optionally, an implementation of step 4032 includes: inputting a data feature set into a content detection model to obtain a second determination result output by the content detection model. The second determination result indicates whether the data is encrypted. The content detection model is trained based on a plurality of sample data feature sets, and each sample data feature set is respectively labeled with a label indicating whether the data is encrypted. When the second determination result indicates that the data is encrypted, it is determined that the data of the abnormal logic block is encrypted. The content detection model is a machine learning model, for example, the content detection model may be a deep neural network model.

[0117] For example, Figure 6 Schematic diagram of a method for determining whether data in a logic block is encrypted based on a content detection model provided by an embodiment of the present application. Figure 6 As shown, by inputting the data feature set of multiple abnormal logical blocks in the abnormal LUN into the content detection model, the judgment results of the multiple abnormal logical blocks output by the content detection model are obtained. For example, the abnormal LUN includes 9 logical blocks, of which there are 4 abnormal logical blocks, namely logical block 2, logical block 4, logical block 5 and logical block 6. Figure 6 From the output results of the content detection model, it can be seen that the data of logic block 2, logic block 4 and logic block 6 are encrypted, and the data of logic block 5 is not encrypted.

[0118] Optionally, after determining whether the data of the abnormal logic block is encrypted according to the data feature set, the computer device can also label the used data feature set according to the second determination result to obtain a new sample data feature set, and the new sample data feature set is used to update the content detection model. In the embodiment of the present application, by storing the training samples of the content detection model in the local file system and continuously updating the training samples of the model during the ransomware attack detection process to regularly update the content detection model, the content detection model can be better adapted to the user business, thereby improving the accuracy of ransomware attack detection.

[0119] Alternatively, in addition to using the content detection model in the embodiment of the present application, it is also possible to directly determine whether the data of the logic block is encrypted based on the data feature set. For example, an autocorrelation coefficient threshold and an entropy value threshold are set, and if the autocorrelation coefficient between the current data content of the logic block and the original data content is less than the autocorrelation coefficient threshold, and / or the entropy value of the current data content of the logic block is greater than the entropy value threshold, it is determined that the data of the logic block is encrypted.

[0120] In step 4033, when the number of abnormal logical blocks whose data is encrypted in the one or more abnormal logical blocks reaches a threshold, it is determined that the abnormal LUN is under a ransomware attack within the target time period.

[0121] In the embodiment of the present application, by performing abnormal screening on the IO operations on the storage system, accurate positioning of abnormal LUNs and abnormal logical blocks is achieved, and by further performing abnormal detection on the data content of the abnormal logical blocks, accurate judgment on whether the storage system is under a ransomware attack is achieved. By combining IO operation screening and data content detection, the reliability and accuracy of ransomware attack detection are improved.

[0122] Optionally, the computer device may further perform the following step 404 .

[0123] Step 404: After determining that the storage system is attacked by ransomware, output an alarm prompt.

[0124] The warning prompt is used to indicate that the storage system is under a ransomware attack. Optionally, the warning prompt also includes the LUN identifier of the LUN under the ransomware attack and the LBA of the logical block whose data in the LUN is encrypted, so as to quickly locate the ransomware attack location.

[0125] Optionally, the computer device outputs the alarm prompt, which may be that the computer device displays the alarm prompt, or the computer device sends the alarm prompt to other display devices for display by the other display devices.

[0126] In an embodiment of the present application, after determining that the storage system is under a ransomware attack, the computer device can output an alarm prompt so that the operation and maintenance personnel or users can quickly locate the attacked object and respond to the ransomware attack by protecting the data securely.

[0127] In the ransomware attack detection method provided in the embodiment of the present application, firstly, based on the IO operation on the storage system in the target time period, it is determined whether there is an abnormal LUN in the storage system that may be attacked by ransomware. If there is an abnormal LUN in the storage system, the abnormal logic block on which the write operation has been performed in the target time period is located, and further, based on the data content of the abnormal logic block, it is determined whether the abnormal LUN is attacked by ransomware. The embodiment of the present application achieves accurate positioning of abnormal LUNs and abnormal logic blocks by performing abnormal screening on the IO operation on the storage system, and further achieves accurate judgment on whether the storage system is attacked by ransomware by performing abnormal detection on the data content of the abnormal logic block. By combining IO operation screening and data content detection, the reliability and accuracy of ransomware attack detection are improved.

[0128] The sequence of steps of the ransomware attack detection method provided in the embodiment of the present application can be adjusted appropriately, and the steps can be increased or decreased accordingly according to the situation. Any technical personnel familiar with the technical field can easily think of a change within the technical scope disclosed in this application, and all of them should be included in the protection scope of this application.

[0129] The present application embodiment takes the above-mentioned ransomware attack detection method executed by a controller in a storage system as an example for explanation. For example, Figure 7 Schematic diagram of a storage system provided by an embodiment of the present application. Figure 7As shown, the storage system includes a storage medium and a controller. The storage medium can be a physical storage space composed of a hard disk or a disk. The storage medium is used to store data in a block storage manner, and the storage medium provides IO services to the host through a logical storage space (LUN or logical volume). The controller includes a data acquisition module, a ransomware detection module, and an online learning module. Among them, the data acquisition module is used to collect IO information (IO acquisition) and the data content of the logical block (block data acquisition). After collecting the IO information, the data acquisition module splits and counts the IO operation, and then extracts IO features and IO write address statistics. The specific implementation process can refer to the above step 4011. The ransomware detection module is deployed with an IO detection model and a content detection model. The IO detection model is used to locate the abnormal LUN according to the IO features provided by the data acquisition module, and further locate the abnormal logical block in the abnormal LUN according to the IO write address statistics provided by the data acquisition module. After the ransomware detection module completes the abnormal logical block location, the data acquisition module extracts data features according to the data content of the collected abnormal logical block. The content detection model is used to determine whether the data of the abnormal logical block is encrypted according to the data features provided by the data acquisition module. The ransomware detection module can further output an alarm. The online learning module is used to provide an IO detection model and a content detection model. The online learning module is used to process data sets, load original models, train models, and update models. The data acquisition module can construct data sets based on the extracted IO features and data features, respectively, and store the constructed data sets in the local file system for the online learning module to call. The data set constructed based on the IO features is used to train and update the IO detection model, and the data set constructed based on the data features is used to train and update the content detection model.

[0130] The following is an example of a virtual device in an embodiment of the present application.

[0131] For example, Figure 8 Schematic diagram of a ransomware attack detection device provided in an embodiment of the present application. Figure 8 As shown, the ransom attack detection device 800 includes but is not limited to a first determination module 801, an acquisition module 802, and a second determination module 803. Optionally, the ransom attack detection device 800 also includes a marking module 804. The ransom attack detection device 800 can be specifically used to perform the following steps: Figure 4 For example, the first determination module 801 is used to execute the above step 401, the acquisition module 802 is used to execute the above step 402, and the second determination module 803 is used to execute the above step 403.

[0132] The first determination module 801 is used to determine whether there is an abnormal LUN in the storage system according to IO operations on the storage system within a target period, where the IO operations include one or more of read operations, write operations or delete operations.

[0133] The acquisition module 802 is used to acquire one or more abnormal logical blocks in the abnormal LUN if there is an abnormal LUN in the storage system, where the abnormal logical block is a logical block in the abnormal LUN that has been written to within a target period of time.

[0134] The second determination module 803 is further used to determine whether the abnormal LUN is attacked by ransomware within the target period according to the data content of one or more abnormal logical blocks.

[0135] Optionally, the first determination module 801 is used to: for each LUN in the storage system, obtain an IO feature set according to the IO operations for the LUN in the target period, the IO feature set including one or more statistical operation counts, each statistical operation count being obtained according to the statistics of one or more IO operations performed on the LUN in the target period, and determine whether the LUN is an abnormal LUN according to the IO feature set.

[0136] Optionally, the one or more statistical operation counts include read operation count, write operation count, delete operation count, read-overwrite write operation count, delete-write operation count, write-delete operation count, read-delete-write operation count, or read-write-delete operation count. Among them, the write operation count is obtained according to the write operation count performed on the LUN in the target period; the read operation count is obtained according to the read operation count performed on the LUN in the target period; the delete operation count is obtained according to the delete operation count performed on the LUN in the target period; the read-overwrite write operation count is obtained according to the read operation and write operation count performed on the same logical block in the LUN in the target period; the delete-write operation count is obtained according to the delete operation and write operation count performed on the LUN in the target period; the write-delete operation count is obtained according to the write operation and delete operation count performed on the LUN in the target period; the read-delete-write operation count is obtained according to the read operation, delete operation and write operation count performed on the LUN in the target period; the read-write-delete operation count is obtained according to the read operation, write operation and delete operation count performed on the LUN in the target period.

[0137] Optionally, a counting granularity adopted by the statistical operation count is a logical block size in the LUN.

[0138] Optionally, the first determination module 801 is used to: input an IO feature set to the IO detection model, obtain a first determination result output by the IO detection model, and the first determination result indicates normal or abnormal, wherein the IO detection model is trained based on multiple sample IO feature sets, and each sample IO feature set is respectively marked with a normal label or an abnormal label. When the first determination result indicates abnormality, the LUN is determined to be an abnormal LUN.

[0139] Optionally, the labeling module 804 is used to label the IO feature set according to the first determination result to obtain a new sample IO feature set, and the new sample IO feature set is used to update the IO detection model.

[0140] Optionally, the second determination module 803 is used to: for an abnormal logic block, obtain a data feature set according to the data content of the abnormal logic block, the data feature set including the autocorrelation coefficient between the current data content of the abnormal logic block and the original data content and / or the entropy value of the current data content of the abnormal logic block. According to the data feature set, determine whether the data of the abnormal logic block is encrypted. When the number of abnormal logic blocks with encrypted data in one or more abnormal logic blocks reaches a threshold, it is determined that the abnormal LUN is under a ransomware attack within the target period.

[0141] Optionally, the entropy value includes a Markov entropy value and / or a Shannon entropy value.

[0142] Optionally, the second determination module 803 is used to: input a data feature set into the content detection model to obtain a second determination result output by the content detection model, the second determination result indicating whether the data is encrypted, wherein the content detection model is trained based on multiple sample data feature sets, and each sample data feature set is respectively annotated with a label indicating whether the data is encrypted. When the second determination result indicates that the data is encrypted, it is determined that the data of the abnormal logic block is encrypted.

[0143] Optionally, the labeling module 804 is used to label the data feature set according to the second determination result to obtain a new sample data feature set, and the new sample data feature set is used to update the content detection model.

[0144] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0145] The following is an illustration of the basic hardware structure involved in the embodiments of the present application.

[0146] For example, Fig. 9 Schematic diagram of the hardware structure of a computer device provided in an embodiment of the present application. Fig. 9As shown, the computer device 900 includes a processor 901 and a memory 902 , and the memory 901 and the memory 902 are connected via a bus 903 . Fig. 9 The processor 901 and the memory 902 are described as being independent of each other. Optionally, the processor 901 and the memory 902 are integrated together. The computer device 900 may be, for example, a storage system. The computer device 900 is integrated in the storage system, or the computer device 900 is in communication connection with the storage system.

[0147] The memory 902 is used to store computer programs, including operating systems and program codes. The memory 902 is a storage medium of various types, such as read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), flash memory, optical storage, register, optical disk storage, optical disk storage, magnetic disk or other magnetic storage devices.

[0148] The processor 901 is a general-purpose processor or a special-purpose processor. The processor 901 may be a single-core processor or a multi-core processor. The processor 901 includes at least one circuit to execute the above-mentioned ransomware attack detection method provided in the embodiment of the present application.

[0149] Optionally, the computer device 900 further includes a network interface 904, which is connected to the processor 901 and the memory 902 via the bus 903. The network interface 904 enables the computer device 900 to communicate with other devices.

[0150] Optionally, the computer device 900 further includes an input / output (I / O) interface 905, which is connected to the processor 901 and the memory 902 via the bus 903. The processor 901 can receive input commands or data, etc. via the I / O interface 905. The I / O interface 905 is used for the computer device 900 to connect input devices, such as keyboards, mice, etc. Optionally, in some possible scenarios, the above-mentioned network interface 904 and the I / O interface 905 are collectively referred to as communication interfaces.

[0151] Optionally, the computer device 900 further includes a display 906, which is connected to the processor 901 and the memory 902 via the bus 903. The display 906 can be used to display intermediate results and / or final results generated by the processor 901 executing the above method, such as displaying warning prompts, etc. In a possible implementation, the display 906 is a touch display screen to provide a human-computer interaction interface.

[0152] The bus 903 is any type of communication bus for interconnecting the internal devices of the computer device 900. For example, a system bus. The embodiment of the present application takes the interconnection of the above-mentioned devices inside the computer device 900 through the bus 903 as an example. Optionally, the above-mentioned devices inside the computer device 900 are connected to each other in a communication manner other than the bus 903, for example, the above-mentioned devices inside the computer device 900 are interconnected through a logical interface inside the computer device 900.

[0153] The above devices may be arranged on independent chips, or at least partially or completely on the same chip. Whether to arrange each device independently on different chips or to integrate them on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above devices.

[0154] Fig. 9 The computer device 900 shown is merely exemplary. During implementation, the computer device 900 may further include other components, which are not listed one by one herein. Fig. 9 The computer device 900 shown may execute the method provided by the above embodiment (for example, Figure 4 The corresponding ransomware attack detection method) can be used to detect ransomware attacks on the storage system.

[0155] The present application also provides a storage system. For example, Fig.10 Schematic diagram of a storage system provided by an embodiment of the present application. Fig.10 As shown, the storage system 1000 includes: a controller 1001 and a storage medium 1002. The storage medium 1002 is used to store data in a block storage manner. The controller 1001 is used to access data in the storage medium and execute the method provided in the above embodiment (for example, Figure 4 The method for detecting a ransomware attack may be implemented by performing all or part of the steps of the corresponding ransomware attack detection method to detect a ransomware attack. Wherein, accessing data includes reading data, writing data or deleting data.

[0156] Optionally, the storage system is a SAN storage system.

[0157] The embodiment of the present application further provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed by a processor, the following is implemented: Figure 4 Ransomware attack detection method shown.

[0158] The present application also provides a computer program product, including a computer program. When the computer program is executed by a processor, Figure 4 Ransomware attack detection method shown.

[0159] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0160] In the embodiments of the present application, the terms “first”, “second” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0161] The term "and / or" in this application is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0162] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0163] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting a ransomware attack, characterized in that: The method comprises: Determine whether there is an abnormal logical unit number LUN in the storage system according to input and output IO operations on the storage system within the target period, where the IO operations include one or more of a read operation, a write operation, or a delete operation; If the storage system has an abnormal LUN, obtaining one or more abnormal logical blocks in the abnormal LUN, wherein the abnormal logical blocks are logical blocks in the abnormal LUN that have been overwritten within the target time period; It is determined whether the abnormal LUN is attacked by ransomware within the target time period according to the data content of the one or more abnormal logical blocks.

2. The method according to claim 1, characterized in that: The determining whether the storage system has an abnormal LUN according to the IO operation on the storage system within the target period includes: For each LUN in the storage system, an IO feature set is obtained according to the IO operation for the LUN in the target period, the IO feature set includes one or more statistical operation counts, each of which is obtained according to the statistics of one or more IO operations performed on the LUN in the target period; According to the IO feature set, it is determined whether the LUN is an abnormal LUN.

3. The method according to claim 2, characterized in that The one or more statistical operation counts include a read operation count, a write operation count, a delete operation count, a read-overwrite write operation count, a delete-write operation count, a write-delete operation count, a read-delete-write operation count, or a read-write-delete operation count; wherein, The write operation count is obtained according to the write operation statistics performed on the LUN within the target time period; The read operation count is obtained according to the statistics of the read operations performed on the LUN within the target period; The deletion operation count is obtained according to the statistics of the deletion operations performed on the LUN within the target period; The read-overwrite operation count is obtained based on the statistics of the read operations and the write operations successively executed on the same logical block in the LUN within the target period; The delete-write operation count is obtained based on the statistics of the delete operations and write operations successively performed on the LUN within the target time period; The write-delete operation count is obtained based on the statistics of the write operations and the delete operations successively performed on the LUN within the target time period; The read-delete-write operation count is obtained based on the statistics of the read operation, the delete operation and the write operation successively executed on the LUN within the target time period; The read-write-delete operation count is obtained based on statistics of the read operation, the write operation and the delete operation successively executed on the LUN within the target time period.

4. The method according to claim 2 or 3, characterized in that: The counting granularity adopted by the statistical operation count is the logical block size in the LUN.

5. The method according to any one of claims 2 to 4, characterized in that: The determining, according to the IO feature set, whether the LUN is an abnormal LUN includes: Inputting the IO feature set into the IO detection model to obtain a first determination result output by the IO detection model, wherein the first determination result indicates normal or abnormal, wherein the IO detection model is trained based on a plurality of sample IO feature sets, and each of the sample IO feature sets is respectively annotated with a normal label or an abnormal label; When the first determination result indicates an abnormality, the LUN is determined to be an abnormal LUN.

6. The method according to claim 5, characterized in that The method further comprises: The IO feature set is labeled according to the first determination result to obtain a new sample IO feature set, and the new sample IO feature set is used to update the IO detection model.

7. The method according to any one of claims 1 to 6, characterized in that: The determining, according to the data content of the one or more abnormal logical blocks, whether the abnormal LUN is subjected to a ransomware attack within the target period includes: For one of the abnormal logic blocks, a data feature set is obtained according to the data content of the abnormal logic block, wherein the data feature set includes an autocorrelation coefficient between the current data content of the abnormal logic block and the original data content and / or an entropy value of the current data content of the abnormal logic block; Determining whether data of the abnormal logic block is encrypted according to the data feature set; When the number of abnormal logical blocks whose data is encrypted in the one or more abnormal logical blocks reaches a threshold, it is determined that the abnormal LUN is subjected to a ransomware attack within the target time period.

8. The method according to claim 7, characterized in that The entropy value includes a Markov entropy value and / or a Shannon entropy value.

9. The method according to claim 7 or 8, characterized in that: The step of determining, according to the data feature set, whether data of the abnormal logic block is encrypted comprises: Inputting the data feature set into a content detection model to obtain a second determination result output by the content detection model, the second determination result indicating whether the data is encrypted, wherein the content detection model is trained based on a plurality of sample data feature sets, each of the sample data feature sets being respectively annotated with a label indicating whether the data is encrypted; When the second determination result indicates that the data is encrypted, it is determined that the data of the abnormal logic block is encrypted.

10. The method according to claim 9, characterized in that The method further comprises: The data feature set is labeled according to the second determination result to obtain a new sample data feature set, and the new sample data feature set is used to update the content detection model.

11. A ransomware attack detection device, characterized in that: The device comprises: A first determination module is used to determine whether there is an abnormal logical unit number LUN in the storage system according to an input and output IO operation of the storage system within a target period, wherein the IO operation includes one or more of a read operation, a write operation or a delete operation; an acquisition module, configured to acquire one or more abnormal logical blocks in the abnormal LUN if the storage system has an abnormal LUN, wherein the abnormal logical block is a logical block in the abnormal LUN that has been overwritten within the target time period; The second determination module is further used to determine whether the abnormal LUN is attacked by ransomware within the target time period according to the data content of the one or more abnormal logical blocks.

12. The device according to claim 11, characterized in that The first determining module is used to: For each LUN in the storage system, an IO feature set is obtained according to the IO operation for the LUN in the target period, the IO feature set includes one or more statistical operation counts, each of which is obtained according to the statistics of one or more IO operations performed on the LUN in the target period; According to the IO feature set, it is determined whether the LUN is an abnormal LUN.

13. The device according to claim 12, characterized in that The one or more statistical operation counts include a read operation count, a write operation count, a delete operation count, a read-overwrite write operation count, a delete-write operation count, a write-delete operation count, a read-delete-write operation count, or a read-write-delete operation count; wherein, The write operation count is obtained according to the write operation statistics performed on the LUN within the target time period; The read operation count is obtained according to the statistics of the read operations performed on the LUN within the target period; The deletion operation count is obtained according to the statistics of the deletion operations performed on the LUN within the target period; The read-overwrite operation count is obtained based on the statistics of the read operations and the write operations successively performed on the same logical block in the LUN within the target period; The delete-write operation count is obtained based on the statistics of the delete operations and write operations successively performed on the LUN within the target time period; The write-delete operation count is obtained based on the statistics of the write operations and the delete operations successively performed on the LUN within the target time period; The read-delete-write operation count is obtained based on the statistics of the read operation, the delete operation and the write operation successively executed on the LUN within the target time period; The read-write-delete operation count is obtained based on statistics of the read operation, the write operation and the delete operation successively executed on the LUN within the target time period.

14. The device according to claim 12 or 13, characterized in that The counting granularity adopted by the statistical operation count is the logical block size in the LUN.

15. The device according to any one of claims 12 to 14, characterized in that The first determining module is used to: Inputting the IO feature set into the IO detection model to obtain a first determination result output by the IO detection model, wherein the first determination result indicates normal or abnormal, wherein the IO detection model is trained based on a plurality of sample IO feature sets, and each of the sample IO feature sets is respectively annotated with a normal label or an abnormal label; When the first determination result indicates an abnormality, the LUN is determined to be an abnormal LUN.

16. The device according to claim 15, characterized in that The device also includes: A labeling module is used to label the IO feature set according to the first determination result to obtain a new sample IO feature set, and the new sample IO feature set is used to update the IO detection model.

17. The device according to any one of claims 11 to 16, characterized in that The second determining module is used to: For one of the abnormal logic blocks, a data feature set is obtained according to the data content of the abnormal logic block, wherein the data feature set includes an autocorrelation coefficient between the current data content of the abnormal logic block and the original data content and / or an entropy value of the current data content of the abnormal logic block; Determining whether data of the abnormal logic block is encrypted according to the data feature set; When the number of abnormal logical blocks whose data is encrypted in the one or more abnormal logical blocks reaches a threshold, it is determined that the abnormal LUN is subjected to a ransomware attack within the target time period.

18. The device according to claim 17, characterized in that The entropy value includes a Markov entropy value and / or a Shannon entropy value.

19. The device according to claim 17 or 18, characterized in that The second determining module is used to: Inputting the data feature set into a content detection model to obtain a second determination result output by the content detection model, the second determination result indicating whether the data is encrypted, wherein the content detection model is trained based on a plurality of sample data feature sets, each of the sample data feature sets being respectively annotated with a label indicating whether the data is encrypted; When the second determination result indicates that the data is encrypted, it is determined that the data of the abnormal logic block is encrypted.

20. The device according to claim 19, characterized in that The device also includes: The labeling module is used to label the data feature set according to the second determination result to obtain a new sample data feature set, and the new sample data feature set is used to update the content detection model.

21. A computer device, characterized in that: include: Processor and memory; The memory is used to store a computer program, wherein the computer program includes program instructions; The processor is used to call the computer program to implement the method according to any one of claims 1 to 10.

22. A storage system, characterized in that: include: A controller and a storage medium, wherein the storage medium is used to store data in a block storage manner, and the controller is used to access data in the storage medium, to implement the method according to any one of claims 1 to 10.

23. The storage system according to claim 22, characterized in that: The storage system is a storage area network SAN storage system.

24. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed by a processor, the method according to any one of claims 1 to 10 is implemented.

25. A computer program product, characterized in that The method comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 10.

Images