Module and method for detecting malicious activities in a storage device

Abstract

This document describes a module and method for detecting malicious activities in a storage device whereby the module is provided within a controller of the storage device. The module is configured to monitor, using a trained neural network, appropriate logical block addresses(LBAs) of the file system of the storage device that contain sensitive data or information for malicious activities. FIGURE 1

Description

Brief Description of the DrawingsThe above and other problems are solved by features and advantages of a system andmethod in accordance with the present invention described in the detailed description andshown in the following drawings.Figure 1 illustrating a block diagram of modules contained within a storage device inaccordance with embodiments of the invention;Figure 2 illustrating a block diagram of modules contained within a controller of astorage device in accordance with embodiments of the invention;Figure 3 illustrating an exemplary boot sector of a file system in a storage device inaccordance with embodiments of the invention;Figure 4 illustrating a flow chart of a process or a method for detecting malicious activityin a storage device in accordance with embodiments of the invention; andFigure 5 illustrating a flow chart of a process or a method for priming a trained neuralnetwork in accordance with embodiments of the invention.Detailed DescriptionThis invention relates to a module and method for detecting malicious activities in astorage device whereby the module is provided within a controller of the storage device. Themodule is configured to monitor, using a trained neural network, appropriate logical blockaddresses (LBAs) of the file system of the storage device that contain sensitive data orinformation for malicious activities wherein the neural network is trained for different types ofoperating systems or secondary storage operations based on average read / write / overwriteaccess of contents at LBAs related to master boot records, master file tables, boot sectors,BIOS parameter blocks or extended BIOS parameter blocks of file systems associated withthe operating systems or the secondary storage operations.The present invention will now be described in detail with reference to severalembodiments thereof as illustrated in the accompanying drawings. In the following description,numerous specific features are set forth in order to provide a thorough understanding of theembodiments of the present invention. It will be apparent, however, to one skilled in the art,that embodiments may be realised without some or all of the specific features. Suchembodiments should also fall within the scope of the current invention. Further, certain processsteps and / or structures in the following may not been described in detail and the reader will bereferred to a corresponding citation so as to not obscure the present invention unnecessarily.Further, one skilled in the art will recognize that many functional units in this descriptionhave been labelled as modules throughout the specification. The person skilled in the art willalso recognize that a module may be implemented as circuits, logic chips or any sort of discretecomponent. Still further, one skilled in the art will also recognize that a module may beimplemented in software which may then be executed by a variety of processor architectures.In embodiments of the invention, a module may also comprise computer instructions, firmwareor executable code that may instruct a computer processor to carry out a sequence of eventsbased on instructions received. The choice of the implementation of the modules is left as adesign choice to a person skilled in the art and does not limit the scope of this invention in anyway.An exemplary process or method for detecting malicious activity in a storage device inaccordance with embodiments of the invention is set out in the steps below. The steps of theprocess or method as implemented by a module provided within a controller of the storagedevice are as follows:Step 1: retrieve a first logical block address (LBA0) sent to the controller from a hostdevice and retrieve content at the first LBA0, whereby the retrieved content is used toprime a trained neural network retrieved from a data module provided within thecontroller;Step 2: identify, using content at the first LBA0 and the trained neural network, logicalblock addresses (LBAs) of the storage device that are to be monitored;Step 3: mirror instructions sent to the identified LBAs by the host device to the controller,and mirror contents of the mirrored LBAs;Step 4: determine, using the trained neural network, if malicious activity is occurring atthe storage device based on the mirrored instructions and contents, wherein the neuralnetwork is trained for different types of operating systems or secondary storageoperations based on average read / write / overwrite access of contents at LBAs relatedto master boot records, master file tables, boot sectors, BIOS parameter blocks orextended BIOS parameter blocks of file systems associated with the operating systemsor the secondary storage operations.In accordance with embodiments of the invention, the steps set out above may becarried out or executed by modules contained within controller 105 of storage device 100, asillustrated in Figure 1, whereby storage device 100 additionally comprises cache 107, flashmemories 110a-h and interface 120. Storage device 100 may comprise various types of solidstate devices / drives, cache 107 may comprise a dynamic Random-Access-Memory (DRAM)and is used for caching both user data and internal SSD meta data. Flash memories 110a-hmay comprise any type of electronic non-volatile computer memory storage medium that canbe electronically erased and reprogrammed such as NAND or NOR flash memories. Interface120 acts as the physical interface between a host system and storage device 100 wherebyexisting storage standards and interfaces such as, but not limited to, small computer systeminterface (SCSI) protocol, serial advanced technology attachment (SATA) protocol, serialattached SCSI (SAS), Non-Volatile Memory express (NVMe), Peripheral ComponentInterconnect express (PCIe) or any similar interface may be used as the link forcommunicatively connecting storage device 100 to a host device such as a computer.Controller 105 is a complex embedded system with standalone processing and workswith firmware and modules contained within controller 105 to manage all aspects of storagedevice 100, including protecting and controlling content stored in flash memories 110a-h. Thiscontroller is most commonly implemented as a SoC (System-On-Chip) design which consistsof multiple hardware-accelerated functional blocks / modules that are coupled to one or moreembedded processor cores.The functional blocks contained within controller 105 are illustrated in Figure 2. Inparticular, Figure 2 shows that controller 105 may comprise micro-controller 205, buffer 210,flash interface modules (FIMs) 215a-c, and threat detection module 250. Micro-controller 205comprises a processor located inside controller 105 and is tasked to receive and manipulateincoming data. Herein the term “processor” is used to refer generically to any device orcomponent that can process such instructions and may include: a microprocessor,microcontroller, programmable logic device or other computational device. That is, microcontroller205 may be provided by any suitable logic circuitry for receiving inputs, processingthem in accordance with instructions stored in memory and generating outputs. In thisembodiment, micro-controller 205 may be a single core processor with memory addressablespace. Buffer 210 may be treated as a data module as it may comprise SRAM (static RAM)for executing controller 105’s firmware or storing data / information that is to be accessed bymodule 250. Threat detection module 250 is used to mirror inputs / outputs at controller 105;train and load an appropriate trained neural network to detect malicious activities that may takeplace within the storage device and related tasks in accordance with embodiments of theinvention. FIMs 215a-c act as the physical and logical interconnects between controller 105and the flash memories 110a-h allowing the controller to communicate with multiple flashmemories simultaneously. One skilled in the art will recognize that the various memorycomponents described above comprise non-transitory computer-readable media and shall betaken to comprise all computer-readable media except for a transitory, propagating signal.Typically, the instructions are stored as program code in the memory components but can alsobe hardwired. Although not shown, controller 105 also comprises a flash translation layer (FTL)for translating LBAs from a host device to physical block addresses (PBAs) of the flashmemories. The detailed workings of the FTL are omitted for brevity as it is known to thoseskilled in the art.When a host device (not shown) is booted up and under the assumption that storagedevice 100 is to be used as the host device’s system device, its operating system would notbe contained within the host device’s ROM or RAM. It would be stored within storage device100. As such, to facilitate the loading of the operating system, the host device will execute afirmware stored in the host device’s ROM which will send appropriate instructions to LBA ‘0’(LBA0) of storage device 100. Upon receiving these instructions which are addressed to itsLBA ‘0”, storage device 100 will send back data that is stored at a physical block address thatcorresponds to LBA ‘0’. Behind the scenes, the logical block address received by controller105 of storage device 100 will be converted into a suitable physical block address by the FTLprovided within controller 105. However, to the host device, all this is unseen and it isunderstood that when instructions are addressed to LBAs of storage device 100, all thenecessary translations between the LBAs to PBAs will automatically take place in controller105.Typically in a system device, the first LBA in the LBA scheme, i.e. LBA ‘0’, may contain,but is not only limited to, the master boot record (MBR), which comprises computer-readableprogram code that, when executed by the host device, provides the host device with the abilityto read the other parts of the operating system code from the storage device 100 and boot upthe host device. LBA is a common scheme that is used for specifying the location of blocks ofdata stored within storage device 100 and provides a simple linear addressing method for thehost device to access content stored within storage device 100 without the host device havingto be aware of the storage device’s physical sector positions or PBAs. As such, when variouspartitions, file systems or any other special areas of the storage device are accessed by thehost device, the LBAs associated with these areas will be sent by the host device to controller105 of storage device 100 so that controller 105 may use this information to retrieve therelevant data / information for the host device.As controller 105 receives the LBAs and their related instructions from the host deviceand returns the contents of the LBAs to the host device based on the received instructions,threat detection module 250 is configured to mirror all this and this may be done by making arecord of all inputs and outputs taking place at controller 105. In other words, threat detectionmodule 250 may achieve this by recording the instructions received by controller 105 and theLBAs that the instructions are directed to. Data and / or information provided at these LBAs maythen be recorded by module 250 as well before the data and / or information is sent back to therequesting host device.An exemplary boot sector of a file system as provided at logical block address ‘0’ (LBA0)is shown in Figure 3. As illustrated, it is shown that boot sector 300 comprises multiple fieldshaving multiple lengths and their individual offsets. Each field would have its own typical valuewhich would be associated with a particular meaning or command. These values maycomprise, but are not limited to, hex numbers or magic numbers that have been generatedbased on each particular meaning / command for each type of operating system / filesystem / storage system and as such, each meaning or command would be associated with aunique value. For example, a value of “EB” may be associated with “Bytes per sector”, a valueof “52” may be associated with “Sectors per Cluster”, a value of “67” may be associated with“OEM ID”, a value of “J9” may be associated with “BPB”, a value of “34” may be associatedwith “extended BPB” and etc.In this exemplary embodiment of the invention, of particular interest would be keyinformation contained at data 305 of LBA0 as shown in Figure 3, e.g. may comprise the BIOSparameter block (BPB) and the extended BPB, and one skilled in the art will recognize that thisis just an example and that other contents at LBA0 may be used as well. Based on theinformation contained in data 305, the following information about the file system of the storagedevice may be determined: number of bytes per sector, number of sectors per cluster, the typeof media descriptor, the total number of sectors, the location of the master file table (MFT) orits equivalent structure, the location of the copy of the master file table, the number of clustersper MFT record, the number of clusters per index buffer, the type of file system, the operatingsystem and the volume’s serial number. This information may then be used to determine theoperating system of the storage device’s file system, the storage device’s file system and / orthe operation of the storage device’s file system. One skilled in the art will recognize that otherinformation may be included within data 305 and within the content of LBA0 without departingfrom the invention.In accordance embodiments of the invention, a magic number lookup table may bepreloaded into cache 107 or buffer 210. As known to one skilled in the art, magic numbers referto constant numerical values that were generated for specific information or data. As such,these magic numbers may be used to identify a particular file format or protocol or may referto distinctive unique values that are unlikely to be mistaken for other meanings. In thisembodiment of the invention, each of the magic numbers in the preloaded magic numberlookup table refers to a particular type of operating system and / or a type of file system such asa secondary storage file system. It should be noted that this lookup table may be updatedperiodically as required, or whenever a new operating system, secondary storage file system,or other types of file systems are introduced. The information in the magic number lookuptable may then be matched with the contents found at LBA0 and based on the resulting match,module 250 may then determine the type of operating system / file system / storage system thatis associated with the storage device.By doing so, threat detection module 250 may then utilize this information to prime atrained neural network contained within module 250 to detect malicious activities for a specifictype of operating system or secondary storage operation as each file system would have itsown unique list of LBAs that contain critical content, information or data. In embodiments of theinvention, critical content or records comprises, but is not limited to, data that affects the userof the storage device, data that affects the normal operation of the storage device and / or anysuch similar data. In other words, this information may be used by module 250 to identify LBAsin the file system of storage device 100 that are to be closely monitored by the trained neuralnetwork whereby these LBAs may be unique to the type of file system installed within thestorage device. Additionally, a trained neural network that has been optimized for the identifiedtype of operating system or file system may also be selected and loaded. Once the parametersdescribed above have been initialized, the primed trained neural network may then be used bymodule 250 to monitor storage device 100 for malicious activities.In embodiment's of the invention, a neural network model is provided within buffer 210or cache 107 and this neural network may comprise, but is not limited to, an artificial neuralnetwork such as a recurrent neural network (RNN), a recursive neural network or aconvolutional neural network (CNN). This neural network model would have been pre-trainedbefore it is used to detect malicious activities taking place in a file system of a storage device.In particular, the neural network model would have been trained based on averageread / write / overwrite access of contents at specific LBAs or PBAs relating to master bootrecords, master file tables, boot sectors, BIOS parameter blocks and / or extended BIOSparameter blocks of file systems associated with each type of operating system or thesecondary storage file systems (which are installed in storage devices used as secondarystorage operations).In other words, the neural network model would have been trained based on variousinput vectors such as the average read / write / overwrite access of contents of LBAs that arecommonly accessed during the operation of various types of operating systems and theircorresponding file systems or during the operation of the storage device as a secondarystorage system. As such, any activities that deviate from these conventional actions maycause the neural network to label the triggering activities as malicious activities. Labelledmalicious activities together with LBAs accessed by these malicious activities may also beused to train the neural network whereby combinations of the data above may be provided tothe neural network during its training phase to optimize the training of the neural network.In further embodiments of the invention, the trained neural network may be furtheroptimized using malicious activities detected during the normal operation of the storage device.Such an on-the-fly optimization step would greatly improve the efficiency and effectiveness ofthe neural network.In embodiments of the invention, the average read / write / overwrite access of contentsof the LBAs of the various operating systems and file systems may be obtained by recordingthe inputs / outputs at the controller of a storage device having the various operating systemsand file systems over a period of time. The average read / write / overwrite access may also beobtained from third parties resources and may be used train the neural network.Additionally, as the LBAs accessed for each of the various operating systems, filesystems and secondary storage systems differ from one system to the next, a record of theLBAs that contain critical data for each of these systems may be created whereby the criticaldata may comprise, but is not limited to, a master file table or its equivalent file structure, amaster boot record, a boot sector, critical areas defined by an user, a secure area, a BIOSparameter block or an extended BIOS parameter block of a file system. This record may thenbe linked with the trained neural network model and be stored in cache 107 or buffer 210 oralternatively, may be used as part of the training data provided to train the neural network asdescribed above. Hence, once a storage device’s function has been identified, i.e. to operateas a system device or secondary storage device, the LBAs of the storage device that containcritical data may then be identified from this record.In summary, the neural network will be trained to protect certain areas of the file systemand the training will be done based on the type of file system that is implemented on the storagedevice and LBAs that contain critical data. The information to identify the type of file systemmay be obtained from contents at the first LBA, i.e. LBA0. However, one skilled in the art willrecognize that while the relevant content may initially be found at LBA0, for certain types of filesystems, it may be so voluminous or due to the manner in which the information is structured,it may be distributed across multiple LBAs, e.g. from LBA “0”- LBA “48”. In embodiments ofthe invention, each neural network may be optimized for each type of file system as the criticalLBAs vary from one file system to the next. As such, the type of trained neural network that isto be used may depend on the file system of the storage device and the performance of trainedneural network may be more efficient and effective if a suitably trained neural network were tobe selected to be used with the suitable file system and this action may be taken as the primingof the trained neural network.Figure 4 illustrates process 400 for detecting malicious activities in a storage devicethat is communicatively connected to a host device in accordance with embodiments of theinvention whereby process 400 may be implemented in threat detection module 250 asprovided within a controller of a storage device. Process 400 begins at step 405 whereby afirst logical block address (LBA) sent to the controller from the host device is copied by process400. Process 400 then proceeds to retrieve content at the first LBA, whereby the retrievedcontent is used to prime a trained neural network retrieved from a data module provided withinthe controller. When this happens, a specific neural network that has been optimized for theidentified file system / operation system / storage system is loaded and primed.Based on the retrieved content and / or the primed trained neural network, a record ofthe LBAs that contain critical data for an associated file system is then loaded at step 410. Thisrecord is then used to identify LBAs of the storage device that are to be monitored by process400. At step 415, process 400 then mirrors instructions sent to the LBAs under monitor andalso mirrors contents from these LBAs that are subsequently sent to the host device. Process400 then determines at step 420, based on the mirrored instructions and contents if maliciousactivities are taking place at the storage device.If the process 400 determines at step 420 that malicious activities are taking placewithin the storage device, process 400 will then proceed to step 425 whereby a suitable alarmor warning will be raised or alternatively the storage device may be locked down. Process 400then ends. Conversely, if no malicious activities are detected by process 400 at step 420,process 400 will then end. Process 400 will then repeat itself each time the storage device isbooted up or started up so that it would be able to detect any malicious activities that may takeplace.Figure 5 illustrates process 500 that may be implemented in module 250 for priming atrained neural network retrieved from a data module during the boot up or start-up of theassociated host device. Process 500 begins at step 505 by selecting a set of values or magicnumbers from the content found at the first LBA (as copied by process 400 in step 405) or atother LBAs if the content extends beyond the first LBA. These set of values or magic numbersare then compared with a magic number lookup table that was preloaded into a cache or bufferof the storage device. By matching the set of values / magic numbers with that contained in themagic number lookup table, process 500 is then able to determine the type of operating systemand its file system or be able to determine the type of system configuration (e.g. secondarystorage file system) associated with the file system of the storage device. LBAs that are criticalto the identified file system are also identified at this step so that the trained neural network willbe made aware that it has to monitor these LBAs. Process 500 then proceeds to prime thetrained neural network based on this information at step 515 thereby accelerating the detectionspeed of the trained neural network as it would have been primed to be used with theappropriate file system.Numerous other changes, substitutions, variations and modifications may beascertained by the skilled in the art and it is intended that the present invention encompass allsuch changes, substitutions, variations and modifications as falling within the scope of theappended claims.

Claims

Claims:

1. A module for detecting malicious activity in a storage device, whereby the module isprovided within a controller of the storage device, the module being configured to:retrieve a first logical block address (LBA0) sent to the controller from a host deviceand retrieve content at the first LBA0, whereby the retrieved content is used to prime a trainedneural network retrieved from a data module provided within the controller;identify, using content at the first LBA0 and the trained neural network, logical blockaddresses (LBAs) of the storage device that are to be monitored;mirror instructions sent to the identified LBAs by the host device to the controller, andmirror contents of the mirrored LBAs;determine, using the trained neural network, if malicious activity is occurring at thestorage device based on the mirrored instructions and contents, wherein the neural network istrained for different types of operating systems or secondary storage operations based onaverage read / write / overwrite access of contents at LBAs related to master boot records, criticalrecords, master file tables, boot sectors, BIOS parameter blocks or extended BIOS parameterblocks of file systems associated with the operating systems or the secondary storageoperations.

2. The module according to claim 1 wherein the priming of the associated trained neuralnetwork comprises the module being configured to:select a set of magic numbers from the content at the first LBA0, whereby the selectedset of magic numbers are used with a magic number lookup table to determine a type ofoperating system or a type of secondary storage operation associated with a file system of thecontroller, whereby the magic number lookup table is obtained from the data module; andprime the trained neural network to detect malicious activities related to the determinedtype of operating system or secondary storage operation from the data module.

3. The module according to claim 2 wherein the priming the trained neural networkcomprises the module being configured to select a trained neural network that has beenoptimized for the determined type of operating system or the determined type of secondarystorage operation associated with the file system of the controller.

4. The module according to claim 1 wherein the identifying LBAs of the storage devicethat are to be monitored comprises the module being configured to:identify, based on a determined type of operating system or secondary storageoperation associated with the primed trained neural network, LBAs that contain critical datawhereby the critical data comprises at least a master file table, a master boot record, a bootsector, a BIOS parameter block or an extended BIOS parameter block of a file systemassociated with the storage device.

5. The module according to claim 1 wherein the module is further configured to:optimize the trained neural network using the malicious activity determined to haveoccurred at the storage device based on the mirrored instructions and contents.

6. The module according to claims 1 or 5 wherein the module is further configured to:lockdown the storage device in response to a determination that malicious activity isdetermined to have occurred at the storage device based on the mirrored instructions and7. The module according to any one of claims 1 to 6 wherein the trained neural networkcomprises an artificial neural network.

8. The module according to claim 7 wherein the artificial neural network comprises aRecurrent Neural Network (RNN) or a Convolutional Neural Network (CNN).

9. A method for detecting malicious activity in a storage device comprising the steps of:retrieving, using a module provided within a controller of the storage device, a firstlogical block address (LBA0) sent to the controller from a host device;retrieving, using the module, content at the first LBA0, whereby the retrieved content isused to prime a trained neural network retrieved from a data module provided within theidentifying using content at the first LBA0 and the trained neural network, using themodule, logical block addresses (LBAs) of the storage device that are to be monitored;mirroring, using the module, instructions sent to the identified LBAs by the host deviceto the controller, and mirror contents of the mirrored LBAs; anddetermining, using the trained neural network, if malicious activity is occurring at the10. The method according to claim 9 wherein the priming of the associated trained neuralnetwork comprises the steps of:selecting, using the module, a set of magic numbers from the content at the first LBA0,whereby the selected set of magic numbers are used with a magic number lookup table todetermine a type of operating system or a type of secondary storage operation associated witha file system of the controller, whereby the magic number lookup table is obtained from thepriming, using the module, the trained neural network to detect malicious activitiesrelated to the determined type of operating system or secondary storage operation from the11. The method according to claim 10 wherein the priming the trained neural networkcomprises the step of selecting a trained neural network that has been optimized for thedetermined type of operating system or the determined type of secondary storage operation12. The method according to claim 9 wherein the identifying LBAs of the storage devicethat are to be monitored comprises the steps of:identifying, using the module, based on a determined type of operating system orsecondary storage operation associated with the primed trained neural network, LBAs thatcontain critical data whereby the critical data comprises at least a master file table, a masterboot record, a boot sector, a BIOS parameter block or an extended BIOS parameter block ofa file system associated with the storage device.

13. The method according to claim 9 wherein the method further comprises the step of:optimizing, using the module, the trained neural network using the malicious activity14. The method according to claims 9 or 13 wherein the method further comprises the steplocking down, using the module, the storage device in response to a determination thatmalicious activity is determined to have occurred at the storage device based on the mirrored15. The method according to any one of claims 9 to 14 wherein the trained neural network16. The method according to claim 15 wherein the artificial neural network comprises a , Description:Field of the InventionThis invention relates to a module and method for detecting malicious activities in astorage device whereby the module is provided within a controller of the storage device. Themodule is configured to monitor, using a trained neural network, appropriate logical blockaddresses (LBAs) of the file system of the storage device that contain sensitive data orinformation for malicious activities.Summary of Prior ArtStorage devices typically comprise of solid state devices (SSDs), hard disk drives(HDDs), optical drives or a magnetic disc drives. Regardless of the type of storage device,these devices are typically addressed linearly by their logical block addresses (LBAs). ForHDDs, optical drives or magnetic disk drives, LBAs specify the location of specific blocks ofdata stored within the drive. As an example, LBA 0 would refer to the first sector on the firsttrack accessible by the first head in the disc drive as such, when LBA 0 is accessed by a hostdevice, the content contained at LBA 0 would be provided to the host device.However, unlike the disk drives described above, SSDs comprise non-volatilememories that are electrically erasable and re-programmable and as such, would not havetracks or heads as referred to in the logical block addressing system. Hence, SSDs have tomake use of a flash translation layer (FTL) as provided within the SSD’s flash memorycontroller to map a host device’s file system logical block addresses to the physical addressesof the flash memory (logical-to-physical mapping). In other words, the host device will still utilizeexisting LBA addressing methodologies to address the SSD for read / write / overwriteoperations. These commands from the host device will be intercepted by the FTL and the FTLwill maintain a map of the relationship between LBAs to physical block addresses (PBAs) ofthe flash memory. The PBAs will then be utilized by the SSD’s controller to carry out thereceived commands.Recently, SSDs have become more widely used as storage devices as SSDs offernumerous advantages over traditional mechanical hard disk drives. For example, SSDs aremuch faster than HDDs, and are able to deliver up to 100 times the performance of HDDs andthis translates to faster boot times and faster file transfers. SSDs also consume much lesserpower than HDDs resulting in improved power and heat efficiencies. As a result, SSDs arenow widely used in industrial, medical or military applications.Typically, most SSDs will be used with a host device and may be used to store the hostdevice’s operating system, i.e. used as the host’s system drive, whereby code associated withthe operating system is stored within the SSD and will be accessed when the host device bootsup. When the SSD is used as the host’s system drive, the SSD will have a master boot record(MBR) stored at a logical block address (LBA) 0 and the host device’s operating system codestored elsewhere in the storage device. When a host device accesses the storage device forthe first time, instructions will be sent to LBA 0 to instruct the SSD to send the contents at LBA0 to the host device. This enables the host device to read the MBR from LBA 0 whereby theMBR will typically contain computer-readable program code that, when executed by the hostdevice, provides the host device with the ability to read the other parts of the operating systemcode from the storage device and boot up the host device.Alternatively, an SSD may also be used as a secondary storage medium such as USBflash drives, memory cards or external storage devices to expand the storage capacityaccessible by the host device. When such an SSD is accessed for the first time by a hostdevice, the content at LBA 0 of the storage device would indicate to the host device that it is tobe used as a secondary storage medium.In order to access information contained within sensitive applications, malicious thirdparties have resorted to various means and ways to infect the MBR of such storage devices.A common method involves the malicious third party gaining system level access to the storagedevice before de-rooting the MBR or other boot sectors of the storage device and causing acompromised operating system to be installed within.To protect the operating system from being tampered with and to prevent access toimportant private information if the storage device is misplaced, it has been proposed by thoseskilled in the art that the operating system code (including the MBR) be encrypted by softwareinstalled within the storage device and be subjected to authentication procedures, so that theMBR and operating system code are accessible only to authorized users. As the controller willnot be able to read the MBR prior to authenticating a user of the storage device, the storagedevice can store an “alternate” master boot record (MBR) that causes authenticationinformation to be collected and validated by an authentication program running in the storageAfter successfully authenticating a user of the storage device, the storage deviceremaps LBA 0 to the original MBR, so that the storage device can receive the actual MBR andboot up as normal. The downside to this approach is that if the user’s authentication credentialsare compromised, this means that the MBR and the operating system code will also bejeopardized.Additionally, solutions proposed by those skilled in the art require the operating system,partition system or boot area of the monitored storage device to be known and pre-loaded intothese solutions before the storage device may be adequately protected by these solutions. Inother words, existing solutions are unable to automatically identify the operating system,partition system or boot area of the monitored storage device and such information has to beprovided by the user to the existing monitoring solution. To the controller of the storage device,all information contained within the storage device comprises the user’s data and it is by defaultunable to differentiate this data. This becomes particularly problematic when the operatingsystem, partition system or boot area of the monitored storage device is modified or incorrectlyselected by the user and as a result, the storage device may become inadvertentlycompromised.For the above reasons, those skilled in the art are constantly striving to come up with amodule and method that is capable of detecting malicious activities in a storage device eventhough the operating system, partition system or boot area of the storage device is not providedto the controller of the device by a user.Summary of the InventionThe above and other problems are solved and an advance in the art is made by systemsand methods provided by embodiments in accordance with the invention.A first advantage of embodiments of modules and methods in accordance with theinvention is that the module is able to identify the type of operating system installed within thememory device.A second advantage of embodiments of modules and methods in accordance with theinvention is that the module is able to detect malicious activities taking place within specificlocations within the storage device automatically and efficiently.A third advantage of embodiments of modules and methods in accordance with theinvention is that the logical block addresses of the storage device will be monitored at thefirmware level and does not require the operating system to be booted up before maliciousactivities may be detected and thwarted.A fourth advantage of embodiments of modules and methods in accordance with theinvention is that content contained within a storage device (that has configured to act as thehost device’s system device) will still be protected from malicious third parties even though thestorage device is removed from the host device and reconfigured as a secondary storagedevice as the module as the module is configured detect malicious activities in bothconfigurations.A fifth advantage of embodiments of modules and methods in accordance with theinvention is that the module may not be disabled at the operating system level as the moduleis implemented as part of the storage device controller’s firmware.The above advantages are provided by embodiments of a method in accordance withthe invention operating in the following manner.According to a first aspect of the invention, a module for detecting malicious activity ina storage device is disclosed, whereby the module is provided within a controller of the storagedevice, the module being configured to: retrieve a first logical block address (LBA0) sent to thecontroller from a host device and retrieve content at the first LBA0, whereby the retrievedcontent is used to prime a trained neural network retrieved from a data module provided withinthe controller; identify, using content at the first LBA0 and the trained neural network, logicalblock addresses (LBAs) of the storage device that are to be monitored; mirror instructions sentto the identified LBAs by the host device to the controller, and mirror contents of the mirroredLBAs; determine, using the trained neural network, if malicious activity is occurring at themaster file tables, boot sectors, BIOS parameter blocks or extended BIOS parameter blocksof file systems associated with the operating systems or the secondary storage operations.With regard to the first aspect of the invention, the priming of the associated trainedneural network comprises the module being configured to: select a set of magic numbers fromthe content at the first LBA0, whereby the selected set of magic numbers are used with a magicnumber lookup table to determine a type of operating system or a type of secondary storageoperation associated with a file system of the storage controller, whereby the magic numberlookup table is obtained from the data module; and prime the trained neural network to detectmalicious activities related to the determined type of operating system or secondary storageWith regard to the first aspect of the invention, the identifying LBAs of the storage devicethat are to be monitored comprises the module being configured to: identify, based on adetermined type of operating system or secondary storage operation associated with theprimed trained neural network, LBAs that contain critical data whereby the critical datacomprises at least a master file table, a master boot record, a boot sector, a BIOS parameterblock or an extended BIOS parameter block of a file system associated with the storage device.With regard to the first aspect of the invention, the module is further configured to:optimize the trained neural network using the malicious activity determined to have occurredWith regard to the first aspect of the invention, the trained neural network comprisesone of an artificial neural network, a Recurrent Neural Network (RNN) or a ConvolutionalAccording to a second aspect of the invention, a method for detecting malicious activityin a storage device is disclosed, the method comprising the steps of: retrieving, using a moduleprovided within a controller of the storage device, a first logical block address (LBA0) sent tothe controller from a host device; retrieving, using the module, content at the first LBA0,whereby the retrieved content is used to prime a trained neural network retrieved from a datamodule provided within the controller; identifying using content at the first LBA0 and the trainedneural network, using the module, logical block addresses (LBAs) of the storage device thatare to be monitored; mirroring, using the module, instructions sent to the identified LBAs by thehost device to the controller, and mirror contents of the mirrored LBAs; and determining, usingthe trained neural network, if malicious activity is occurring at the storage device based on themirrored instructions and contents, wherein the neural network is trained for different types ofoperating systems or secondary storage operations based on average read / write / overwriteaccess of contents at LBAs related to master boot records, master file tables, boot sectors,BIOS parameter blocks or extended BIOS parameter blocks of file systems associated withWith regard to the second aspect of the invention, the priming of the associated trainedneural network comprises the steps of: selecting, using the module, a set of magic numbersfrom the content at the first LBA0, whereby the selected set of magic numbers are used with amagic number lookup table to determine a type of operating system or a type of secondarystorage operation associated with a file system of the storage controller, whereby the magicnumber lookup table is obtained from the data module; and priming, using the module, thetrained neural network to detect malicious activities related to the determined type of operatingWith regard to the second aspect of the invention, the identifying LBAs of the storagedevice that are to be monitored comprises the steps of: identifying, using the module, basedon a determined type of operating system or secondary storage operation associated with theWith regard to the second aspect of the invention, the method further comprises thestep of: optimizing, using the module, the trained neural network using the malicious activitystep of: locking down, using the module, the storage device in response to a determination thatWith regard to the second aspect of the invention, the trained neural network comprises