Storage system and malicious program detection method

Abstract

To provide a storage system capable of detecting a malicious program without executing compression processing of data.SOLUTION: A storage system 1 includes a processor 110 that processes data input to and output from a storage device 150. The processor 110 runs thereon a duplication detection program P3 which deduplicates duplicated data, stores the deduplicated data in the storage device 150, calculates a duplication rate being a ratio of duplicated data in a predetermined unit of storage, and detects a change between a duplication rate before an update of the data and a duplication rate after the update of the data in the predetermined unit of storage. The processor 110 runs thereon a ransomware detection program P4 which detects that the data has been updated by ransomware when a decrease amount of the duplication rate exceeds a duplication rate threshold value relating to the change in duplication rate detected by the duplication detection program P3.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a storage system and a method for detecting malicious programs. [Background technology]

[0002] In recent years, there has been a sharp increase in service-destroying cyber attacks using malicious programs, most notably ransomware. Ransomware is a type of malware that encrypts files and demands a ransom in exchange for restoring them. Malware is malicious software or code.

[0003] Ransomware not only shuts down operational IT systems, but also destroys data and backups of IT systems, causing severe damage not only to the IT systems but also to the businesses provided through those systems. In order to protect data from such damage, there is a demand for storage that can detect ransomware early and restore data to the state before the attack.

[0004] Patent document 1 states that "in response to determining that the request indicates malicious action, performing corrective action with respect to the requested operation." [Prior art documents] [Patent documents]

[0005] [Patent Document 1] US Patent Application Publication No. 2021 / 0216627 Summary of the Invention [Problem to be solved by the invention]

[0006] In a storage system using Patent Document 1, when compressible data is overwritten with data that is difficult to compress, or when there are a large number of write requests within a certain period of time, it is determined that there is a possibility of ransomware. However, in order to detect ransomware, compression processing must be performed, which causes a problem of significant degradation in the performance of the storage system.

[0007] The present invention has been made in consideration of the above circumstances, and has an object to detect malicious programs without performing data compression processing. [Means for solving the problem]

[0008] The storage system of the present invention includes a processor that processes data input and output to a storage device, the processor de-duplications duplicated data and stores it in the storage device, calculates a duplication rate which is the proportion of duplicate data in a specified storage unit, and is further equipped with a duplication detection unit that runs on the processor and detects, in the specified storage unit, a change between the duplication rate before the data is updated and the duplication rate after the data is updated, and a malicious program detection unit that runs on the processor and sets a threshold value for the detected change in duplication rate as a duplication rate threshold, and detects that the data has been updated by a malicious program if the decrease in the duplication rate exceeds the duplication rate threshold. Effect of the Invention

[0009] According to the present invention, it is possible to detect that data has been updated by a malicious program when the amount of decrease in the duplication rate exceeds the duplication rate threshold value, even without performing data compression processing. Problems, configurations and effects other than those described above will become apparent from the following description of the embodiments. [Brief description of the drawings]

[0010] [Figure 1] 1 is a block diagram showing an example of the overall configuration of a storage system according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram for explaining an overlap rate according to the first embodiment of the present invention. [Diagram 3] 1 is a block diagram showing an example of the overall configuration of a computer system according to a first embodiment of the present invention. [Figure 4] 1 is a configuration diagram showing an example of a duplicate state management table according to a first embodiment of the present invention. FIG. [Diagram 5] 1 is a configuration diagram showing an example of a duplicate chunk determination table according to a first embodiment of the present invention. FIG. [Figure 6] 3 is a configuration diagram showing an example of an operation log list according to the first embodiment of the present invention. FIG. [Figure 7] 5 is a flowchart showing an example of a user I / O process according to the first embodiment of the present invention. [Figure 8] 5 is a flowchart showing an example of a file update process according to the first embodiment of the present invention. [Figure 9] 11 is a flowchart showing an example of a duplication detection process according to the first embodiment of the present invention. [Figure 10] 1 is a flowchart showing an example of a ransomware detection process according to the first embodiment of the present invention. [Figure 11] FIG. 11 is a block diagram showing an example of the overall configuration of a computer system according to a second embodiment of the present invention. [Figure 12] FIG. 11 is a configuration diagram showing an example of a file type duplication rate management table according to the second embodiment of the present invention. [Figure 13] 13 is a flowchart showing an example of a duplication detection process according to the second embodiment of the present invention. [Figure 14] 13 is a flowchart illustrating an example of a ransomware detection process according to the second embodiment of the present invention. [Figure 15] FIG. 11 is a block diagram showing an example of the overall configuration of a computer system according to a third embodiment of the present invention. [Figure 16] FIG. 13 is a configuration diagram showing an example of a duplicate state management table according to the third embodiment of the present invention. [Figure 17] FIG. 13 is a configuration diagram showing an example of an operation log list according to the third embodiment of the present invention. [Figure 18]13 is a flowchart illustrating an example of block I / O processing according to the third embodiment of the present invention. [Figure 19] 13 is a flowchart illustrating an example of a block update process according to the third embodiment of the present invention. [Figure 20] 13 is a flowchart showing an example of a duplication detection process according to the third embodiment of the present invention. [Figure 21] 13 is a flowchart illustrating an example of a ransomware detection process according to the third embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings. In this specification and the drawings, components having substantially the same functions or configurations are designated by the same reference numerals, and redundant description will be omitted.

[0012] [First embodiment] FIG. 1 is a block diagram showing an example of the overall configuration of a storage system 1 according to the first embodiment. FIG. 1 shows an overview of a process in which a file storage 10 according to the first embodiment detects ransomware. Ransomware is a type of malicious program that encrypts files stored in the file storage 10 to prevent users from reading the files. For this reason, the encryption of files by ransomware is also called a "ransomware attack." Other examples of malicious programs include programs that destroy files and update files unintended by users.

[0013] The storage system 1 includes a file storage 10 and a client 11. The storage system 1 has a function of detecting ransomware and monitoring a decrease in the duplication rate on a file-by-file basis. The storage system 1 determines the presence or absence of ransomware based on a decrease in the duplication rate of a single file. However, the storage system 1 can also determine the presence or absence of ransomware on a file collection basis (for example, a directory or file type).

[0014] The client 11 updates data stored in the file storage 10. The client 11 is an example of a client device used by a user. Either a normal program or ransomware may run on the client 11. In the following description, the client 11 refers to both a PC infected with ransomware and a PC not infected with ransomware.

[0015] The file storage 10 includes a network file system program P1, a local file system program P2, a duplicate detection program P3, a ransomware detection program P4, a data protection processing program P5 (see FIG. 3), and an operation log list T30.

[0016] Here, we will provide an overview of the types of operations managed by the file storage 10 and how to detect ransomware.

[0017] (1) Rename & Write operation (2) Operation log writing When the network file system program P1 receives a file I / O (Input / Output) request, which is an operation on a file, from the client 11, it writes a log of the I / O operation performed by the local file system program P2 (called an operation log) into the operation log list T30. File I / O requests include a Rename operation, which changes the name of a file (an example of data), and a Write operation, which writes data to a file and updates the data. The local file system program P2 is a program that exists below the network file system program P1, and writes the operation log into the operation log list T30 in response to an instruction from the network file system program P1. However, the network file system program P1 may also write the operation log into the operation log list T30.

[0018] The ransomware performs a rename operation on all files stored in the file storage 10. The ransomware also encrypts all or part of the data in the files. For example, a file originally named "fileA.txt" is renamed to "fileA.txt.aaa". Similarly, a file originally named "fileB.txt" is renamed to "fileB.txt.aaa". When renaming, an extension specific to the ransomware may be added. Also, since the encryption is performed by the ransomware, the network file system program P1 can only recognize the encryption as a Write process. Therefore, the encryption process of the ransomware is recorded as a Write in the operation log list T30.

[0019] (3) Detect ransomware based on the number of files with reduced duplication rates The processor 110 runs a duplicate detection program P3 (an example of a duplicate detection unit) on the processor 110, which eliminates duplicate data and stores it in a storage device, calculates a duplication rate, which is the ratio of duplicate data in a predetermined storage unit, and detects a change in the duplication rate between the duplication rate before the data is updated and the duplication rate after the data is updated, in the predetermined storage unit. For example, the duplicate detection program P3 performs a process of detecting duplicates of updated file data when the storage unit is a file unit or a directory unit. File duplication is an index that focuses on, for example, when focusing on a certain file, the contents of the file before the update and the file after the update are the same except for the updated parts. In the duplicate detection process, when the same data is detected in units of blocks into which the file data is divided during a certain period of time, the data is consolidated as duplicate parts. After that, the duplicate parts with respect to the original file data are calculated as the duplication rate. For example, the degree to which the contents of the data written in the file before the update and the contents of the data written in the file after the update overlap is expressed as the duplication rate.

[0020] FIG. 2 is a diagram for explaining the overlap rate. An example of a file before an update is shown in the upper part of Figure 2. In normal user processing, file data is not completely rewritten, so if a file originally had a high duplication rate, it is predicted that a file updated by normal user processing will also have a high duplication rate. In other words, it is thought that the duplication rate will be almost the same before and after a file is updated. On the other hand, ransomware encrypts data, so the contents of a file are completely different before and after encryption. This causes the duplication rate to drop to nearly 0%.

[0021] Therefore, the duplication detection program P3 compares the duplication rate before and after the file is updated, and checks whether the duplication rate has decreased by more than a threshold. If the normal fluctuation due to updates is about 20%, for example, the duplication rate decrease threshold can be set to 30%. The duplication rate decrease threshold can be set taking into account the user's usage method, file type, and chronological changes, and does not need to be uniquely determined.

[0022] The updated file shown in the lower left of Figure 2 has an overlap rate of 90% compared to the pre-update file, and the 10% change in overlap rate is less than the 30% overlap rate decrease threshold. For this reason, it is believed that the updated file was updated by normal user processing. On the other hand, the updated file shown in the lower right of Figure 2 has an overlap rate of 5%, and the change in overlap rate is 95%, which exceeds the 30% overlap rate decrease threshold. For this reason, it is believed that the contents of the updated file have been changed by encryption using ransomware.

[0023] The amount of decrease in duplication rate that indicates a file has been attacked by ransomware varies. For example, if the file duplication rate decreases from 60% to 20%, the decrease in the duplication rate is 40%, which is greater than the duplication rate decrease threshold of 30%, so the ransomware detection program P4 can detect that a file has been attacked by ransomware. In addition, if the file duplication rate drops from 20% to 1%, the drop in the duplication rate is less than the drop threshold of 30%, but the ransomware detection program P4 considers this to be an abnormal state and can detect that the files have been attacked by ransomware.

[0024] Let us return to Figure 1 to continue the explanation. The duplicate detection program P3 detects that the duplication rate of "fileA.txt.aaa" has dropped from 40.0%, which is the duplication rate in normal user processing, to 0.1% in the process of (3) above. Similarly, the duplicate detection program P3 detects that the duplication rate of "fileB.txt.aaa" has dropped from 50.0%, which is the duplication rate in normal user processing, to 0.1%. The duplicate detection program P3 outputs information about the file whose duplication rate has dropped to the ransomware detection program P4.

[0025] (4) Ransomware detection based on rename and write operations The processor 110 runs a ransomware detection program P4 (an example of a malicious program detection unit) on the processor 110, which sets a threshold value related to the change in the duplication rate detected by the duplication detection program P3 as the duplication rate threshold, and detects that data has been updated by ransomware when the amount of decrease in the duplication rate exceeds the duplication rate threshold. For example, the ransomware detection program P4 detects ransomware based on information periodically read from the operation log list T30 and information on files whose duplication rates have decreased output from the duplication detection program P3. For this reason, the ransomware detection program P4 detects whether or not a ransomware attack is occurring based on the number of files whose duplication rates have decreased to or above the duplication rate threshold within a certain period of time, and the data size of the updated data.

[0026] Furthermore, ransomware may encrypt only a portion of file data in order to shorten the encryption process time for all files. In this case, there are few write requests, so the storage system may not be able to detect ransomware. For this reason, the ransomware detection program P4 can also detect whether a ransomware attack has occurred based on the number of files renamed within a certain period of time and the data size of updated data. Note that the ability of the ransomware detection program P4 to detect that data has been updated or attacked by ransomware is synonymous with detecting ransomware.

[0027] 3 is a block diagram showing an example of the overall configuration of a computer system according to the first embodiment. 3 shows an example of the hardware configuration of the storage system 1 shown in FIG.

[0028] The file storage 10 is connected to clients 11 and a management terminal 13 via a network 12. The network 12 is, for example, a LAN (Local Area Network) or a WAN (Wide Area Network). The management terminal 13 acquires the execution results of each program stored in the memory 120 and manages the status of the file storage 10.

[0029] The file storage 10 is an example of a file storage that manages data as files (contents). The file storage 10 includes a processor 110, a memory 120, a cache 130, a network I / F 140, and a storage device 150. These are connected to each other via a communication path such as a bus 160.

[0030] The file storage 10 may be a distributed file storage consisting of multiple file storages, rather than a single file storage. Also, an external block storage may be used for the storage device 150, and multiple file storages may be connected.

[0031] The processor 110 controls the operation of the file storage by executing programs stored in the memory 120 and processing data input to and output from the storage device 150. The memory 120 is, for example, a RAM (Random Access Memory), and temporarily stores programs and data used to control the operation of the processor 110.

[0032] The memory 120 stores a network file system program P1, a local file system program P2, a duplication detection program P3, a ransomware detection program P4, and a data protection processing program P5. These programs stored in the memory 120 may be stored in the storage device 150. The above-mentioned duplication rate before the update is recorded in the storage device 150. The duplication rate before the update may be held on the memory 120.

[0033] The network file system program P1, when executed by the processor 110, receives various requests such as Read / Write from the client 11 and processes the protocols included in the requests. For example, the network file system program P1 processes protocols such as Native-Client, FUSE (Filesystem in User Space), NFS (Network File System), and SMB (Server Message Block).

[0034] The local file system program P2, when executed by the processor 110, provides a file system and content storage such as object storage to the network file system program P1.

[0035] The duplicate detection program P3 is executed by the processor 110 to perform an in-line or post-process duplicate detection process on user content stored in the storage device 150. The duplicate detection program P3 may perform not only duplicate detection but also duplicate elimination. Deduplication is a process in which only one file remains among multiple files with the same content (for example, a file that has only been copied and pasted). The unit for which the duplicate detection program P3 detects duplicates may be a fixed-length unit or a variable-length unit in addition to a file unit. Deduplication is performed on an area where data has been updated. For this reason, even if the file name of a file that has already been deduplicaed is changed, deduplication is not performed.

[0036] The ransomware detection program P4 is executed by the processor 110 to perform the ransomware detection process described above.

[0037] The processor 110 runs on the processor 110 a data protection processing program P5 (an example of a protection processing unit) that performs protection processing on data updated by ransomware detected by the ransomware detection program P4. The data protection processing performed by the data protection processing program P5 includes, for example, processing to restrict input / output in normal user processing on an attacked file. The data protection processing program P5 may also perform protection processing on a file that has not been updated by ransomware. For example, the data protection processing program P5 is assumed to perform processing to restrict the client 11's access to other data to prevent the damage caused by ransomware from spreading. The data protection processing can stop the damage caused by ransomware. The data protection processing program P5 may have a function of eradicating ransomware.

[0038] The cache 130 is, for example, a RAM, and temporarily stores data written by the client 11 and data read from the storage device 150. The network I / F 140 is an interface such as a wired LAN card or a wireless LAN card, and communicates with other devices (for example, the client 11) via the network 12.

[0039] The storage device 150 is, for example, a hard disk or a flash memory, and stores various contents including contents used by the user of the client 11. The contents may include objects other than files. Furthermore, when a deduplication function is implemented, it is necessary to store duplicate data (also called duplicate chunks). For this reason, the files may include not only user files, but also files that store duplicate chunks.

[0040] The storage device 150 stores a duplication state management table T10, a duplication chunk judgment table T20, and an operation log list T30. A block storage may be connected as the storage device 150. The block storage may provide a block format storage function such as an FC-SAN (Fibre Channel Storage Area Network) to the file storage 10. Detailed configuration examples of the duplication state management table T10, the duplication chunk judgment table T20, and the operation log list T30 will be described with reference to FIGS. 4 to 6.

[0041] FIG. 4 is a configuration diagram showing an example of the overlap state management table T10 according to the first embodiment.

[0042] The duplication state management table T10 is a table that manages the duplication state of data for each storage unit (for example, each file). The duplication state management table T10 is provided for each file system of the file storage 10. The duplication state management table T10 includes an entry for each file. The duplication state management table T10 manages the duplication rate for each file and the duplication state for each partial area within the file. An entry of the duplication state management table T10 includes a file ID C11, a duplication rate C12, and a group of fields (C13 to C16) for each chunk within the file corresponding to the entry. Each piece of information stored in the field of each entry is also called management information.

[0043] The file ID C11 stores the ID of the file corresponding to the entry (file ID). The duplication rate of the file of the file ID C11 is stored in the duplication rate C12. The duplication rate may be calculated by the formula: number of chunks in which duplication was detected / total number of chunks, or by the formula: total size of the area in which duplication was detected / file size.

[0044] When the file before the update is updated by the client 11, it is overwritten and becomes the updated file. However, since the duplication rate before the update is recorded in the duplication rate C12, when the duplication detection program P3 detects the duplication rate of the updated file, the ransomware detection program P4 can detect ransomware from the change in the duplication rate.

[0045] The field group for each chunk includes fields for an offset in the file C13, a duplicate determination processing completion flag C14, a duplicate status C15, and a fingerprint C16.

[0046] The starting position in the content of the chunk corresponding to the field group is stored at offset C13 in the file. A chunk is data divided into a specified length. Chunks are fixed-length 4k byte units, but they can also be variable-length units. If the chunk is variable-length, it is divided into variable-length chunks by using a rolling hash process or the like on the data.

[0047] The overlap determination processing completed flag C14 stores an overlap determination processing completed flag indicating whether or not the chunk corresponding to the field group has been subjected to overlap determination processing. The overlap determination processing completed flag is set to False when data in the chunk is updated, and is set to True after overlap determination processing.

[0048] The overlap status C15 stores the status of the chunk corresponding to the field group. The status of the chunk can be "non-overlapping," which indicates that the chunk for which the overlap status is confirmed does not overlap with other chunks stored in the file storage 10, or "overlapping," which indicates that the chunk overlaps with other chunks. The overlap detection program P3 calculates the change in the overlap rate for data stored as "non-overlapping" in the overlap status management table T10. Note that, although the chunk is considered to be "non-overlapping" until the overlap detection program P3 starts to determine whether the chunk is overlapped, another status may be stored in the overlap status C15.

[0049] The fingerprint C16 stores the fingerprint of the chunk corresponding to the field group. The fingerprint is a value obtained by applying a hash function to the chunk data, and is used to confirm the identity (duplication) of the chunk. For example, MD5 (message digest algorithm 5) or SHA-1 (Secure Hash Algorithm 1) may be used as a method for calculating the fingerprint. The fingerprint is set during duplication determination processing by the duplication detection program P3.

[0050] FIG. 5 is a configuration diagram showing an example of a duplicate chunk determination table T20 according to the first embodiment.

[0051] The duplicate chunk determination table T20 is a table that stores information used to determine whether chunks in the file storage 10 are duplicated. The duplicate chunk determination table T20 stores fingerprints and chunk counts that are generated according to the offsets of data managed in the duplicate state management table T10. For example, the duplicate chunk determination table T20 stores the fingerprints of all data in the file storage 10 and the number of chunks that have the same fingerprint. An entry in the duplicate chunk determination table T20 includes fields for a fingerprint C21 and a chunk count C22.

[0052] The fingerprint C21 stores the fingerprint of a chunk of a file. The number of chunks having the same fingerprint C21 is stored in the chunk number C22. When there are three chunks of the same data, the overlap rate of each chunk is 100%.

[0053] As described below, the duplicate detection program P3 calculates the fingerprints of chunks whose duplicate status has not been determined based on the duplicate status management table T10. If the chunk whose duplicate status is to be determined matches a fingerprint stored in the duplicate chunk determination table T20, the duplicate detection program P3 adds the number of chunks whose calculated fingerprint matches. On the other hand, if the fingerprint does not match a fingerprint stored in the duplicate chunk determination table T20, the duplicate detection program P3 adds the calculated fingerprint to the duplicate chunk determination table T20. The duplicate detection program P3 then calculates the duplication rate based on the number of chunks.

[0054] FIG. 6 is a diagram showing an example of an operation log list T30 according to the first embodiment.

[0055] The operation log list T30 stores an entry (operation log) for each operation performed by the client 11 on data (files). The operation log list T30 records not only the Create, Write, and Rename operations performed on a file, but also when a duplicate determination is performed on the file. The operation log list T30 includes fields for an operation type C31, a file handler C32, a type C33, an offset C34, a length C35, a flag C36, and a timestamp C37. The latest operation log (entry) is added to the bottom of the operation log list T30.

[0056] The operation type C31 stores the operation type corresponding to the entry. Examples of the operation types include Create, Write, Rename, and duplication determination. When the duplication detection program P3 performs duplication determination, a decrease in the duplication rate is found. Both a write process to a file performed by a normal user through the client 11 and a write process to a file performed by ransomware through the client 11 are recorded as Write in the operation type C31. Note that the operation type C31 may be limited so that only Write, Rename, and duplication determination are stored.

[0057] The file handler of the file that corresponds to the entry is stored in the file handler C32. The reason why the file handlers for Rename and Write have different values ​​even though they are the same operation type is because the ransomware is performing operations on multiple files at the same time.

[0058] The type C33 stores a value indicating the type of the operation target corresponding to the entry, that is, whether it is a file or a directory.

[0059] OffsetC34 stores the start position of the part of the file that is the target of the operation corresponding to the entry. The size of the portion targeted by the operation corresponding to the entry is stored in LengthC35. OffsetC34 and LengthC35 are not stored in the overlap determination operation.

[0060] Flag C36 contains information (e.g., True) that the decrease in the duplication rate has exceeded the duplication rate threshold in the duplication determination operation by the duplication detection program P3 as the operation type for the data. True is stored when the decrease in the duplication rate is equal to or greater than the threshold, and False is stored when it is less than the threshold. No value is stored for other operations. The ransomware detection program P4 refers to the operation log list T30 and detects that the data has been updated by ransomware based on the operation log. For example, if there are many Trues stored in Flag C36 in the duplication determination of the operation type C31, the ransomware detection program P4 can detect that there has been a ransomware attack, i.e., ransomware, because there are many files with a decreased duplication rate.

[0061] Timestamp C37 stores timestamps T0, T1, ... indicating the time of operation corresponding to the entry. The timestamps indicate the number of rename operations and the number of write operations performed within a certain period (for example, between 0:00 and 0:10).

[0062] <Example of file storage processing> Next, an example of the processing operation of the file storage 10 according to this embodiment will be described in detail with reference to Figures 7 to 10. The processing shown in Figures 7 to 10 is an example of a malicious program detection method used in a storage system 1 having a processor 110 that processes data input to and output from a storage device 150. The processing in each figure is executed by each program running on the processor 110.

[0063] FIG. 7 is a flowchart showing an example of a user I / O process according to the first embodiment.

[0064] User I / O processing S100 is started by processor 110 executing network file system program P1 and local file system program P2 in file storage 10. A user I / O request is described in the flowchart as a request for a file / directory operation on file storage 10. As described above, file / directory operations include a Rename operation and a Write operation performed by client 11 on a file, as well as an operation for client 11 to create a new directory.

[0065] When the network file system program P1 receives a user I / O request from the client 11 (S101), it performs protocol processing and requests the local file system program P2 to perform a user I / O operation. As described above, the client 11 may be either a normal program or ransomware.

[0066] Next, the local file system program P2 executes the file / directory operation requested by the network file system program P1 (S102). Details of the file / directory operation will be explained in the file update processing of FIG.

[0067] Next, the local file system program P2 adds the contents of the executed file / directory operation to the operation log list T30 (S103), and ends the user I / O processing (S199).

[0068] FIG. 8 is a flowchart showing an example of a file update process according to the first embodiment.

[0069] The file update process S200 is one type of file / directory operation executed in step S102. The file update process S200 is performed in the file storage 10 by the processor 110 executing the local file system program P2.

[0070] The local file system program P2 checks the overlap state management table T10 and determines whether the chunk corresponding to the updated area has been subjected to overlap determination processing (S201). In this process, if the overlap determination processing completed flag C14 in the overlap state management table T10 is True, it is determined that the chunk corresponding to the updated area has been subjected to overlap determination processing. If the overlap state management table T10 includes a chunk for which overlap determination processing has been completed (YES in S201), the process proceeds to step S202, and if the overlap state management table T10 does not include a chunk for which overlap determination processing has been completed (NO in S201), the process proceeds to step S203.

[0071] If it is determined in step S201 that the chunk corresponding to the update area has been subjected to duplication determination processing, the local file system program P2 obtains the fingerprint C16 of the chunk for which duplication determination processing has been performed from the duplication state management table T10, and subtracts 1 from the number of chunks C22 in the duplicate chunk determination table T20 (S202). Note that if the number of chunks C22 in the duplicate chunk determination table T20 is 0, the local file system program P2 may delete the entry.

[0072] If it is determined in step S201 that the chunk has not been subjected to the overlap determination process, or after step S202, the local file system program P2 writes the update contents based on the requested file update to a target area (not shown) of the file storage 10, and reflects the update contents in the target area (S203). The target area is the area for which the client 11 has requested the data update.

[0073] Next, the local file system program P2 updates the update state management information by changing the overlap determination processing completion flag C14 in the overlap state management table T10 of the chunk corresponding to the update area to False (S204), and ends the file update processing (S299). However, if the determination is NO in step S201, the overlap determination processing completion flag C14 may also be updated from False to False.

[0074] When the duplication determination processing completion flag C14 is changed to False in step S204, in the subsequent processing, the duplication detection program P3 performs duplication detection for the data identified by the in-file offset C13 of the corresponding entry. Also, at the end of the file update processing, the duplication rate C12 in the duplication status management table T10 has not been updated.

[0075] FIG. 9 is a flowchart showing an example of the overlap detection process according to the first embodiment.

[0076] The duplicate detection process S300 is performed by the processor 110 executing the duplicate detection program P3 in the file storage 10. The duplicate detection program P3 checks the operation log list T30 and performs a duplicate determination for a file whose data has been updated. The duplicate detection process S300 shows a duplicate detection process for a certain file. The duplicate detection program P3 is executed periodically.

[0077] First, the duplication detection program P3 acquires management information of the duplication status C15 of the target file from the duplication status management table T10 (S301). In addition, the duplication detection program P3 acquires management information of the duplication rate C12 of the target file from the duplication status management table T10 in conjunction with the start of this process, and writes it to a specified area of ​​the storage device 150.

[0078] Next, the duplicate detection program P3 checks the information of the next chunk, starting from the top of the duplicate status management table T10 (S302). In this process, the duplicate detection program P3 increases the offset in the file starting from 0 in the offset C13, and checks the corresponding chunk.

[0079] Next, the duplicate detection program P3 checks the duplicate detection processing completion flag C14 of the chunk, and checks whether the duplicate detection has not been performed (S303). If the duplicate detection has not been performed (False) (YES in S303), the duplicate detection program P3 transitions to the next step S304. If the duplicate detection has been performed (True) (NO in S303), the duplicate detection program P3 transitions to step S308.

[0080] If the duplication determination has not been performed (False) (YES in S303), the duplication detection program P3 calculates a fingerprint of the target chunk (S304). The fingerprint is a value obtained by applying a hash function to the chunk data, and is used to confirm the identity (duplication) of the chunks. The duplication detection program P3 may use, for example, MD5 or SHA-1 as a method for calculating the fingerprint.

[0081] Next, the duplicate detection program P3 checks the duplicate chunk judgment table T20 to see if there is an entry for a fingerprint C21 that matches the fingerprint calculated in step S304 (S305). If there is an entry for a matching fingerprint (YES in S305), the duplicate detection program P3 transitions to step S306. If there is no entry for a matching fingerprint (NO in S305), the duplicate detection program P3 transitions to step S307.

[0082] If an entry with a matching fingerprint exists (YES in S305), the duplicate detection program P3 adds 1 to the number of chunks in that entry in the duplicate chunk judgment table T20 (S306). If an entry with a matching fingerprint does not exist (NO in S305), the duplicate detection program P3 adds the fingerprint calculated in step S304 and an entry with the number of chunks set to 1 to the duplicate chunk judgment table T20 (S307).

[0083] After step S306, after S307, or if step S303 is judged as NO, the duplicate detection program P3 updates the duplicate state management table T10 (S308). For example, the duplicate detection program P3 changes the duplicate determination processing completion flag C14 in the duplicate state management table T10 of the target chunk to "executed" (True), and changes the fingerprint C16 to the fingerprint calculated in step S304. In addition, if an identical fingerprint is found in S305, the duplicate state C15 is changed to "duplicate," and if not, the duplicate state C15 is changed to "non-duplicate."

[0084] Next, the duplicate detection program P3 checks whether the target chunk is the last chunk (S309). If the target chunk is the last chunk (YES in S309), the duplicate detection program P3 transitions to step S310. If the target chunk is not the last chunk (NO in S309), the duplicate detection program P3 transitions to step S302.

[0085] If the target chunk is the last chunk (YES in S309), the duplicate detection program P3 checks the duplicate status C15 in the duplicate status management table T10 of the target file and calculates the duplication rate on a file-by-file basis (S310). The duplicate detection program P3 may calculate the duplication rate by dividing the number of chunks in which duplicates were detected by the total number of chunks, or by dividing the total size of the areas in which duplicates were detected by the file size.

[0086] Next, the duplication detection program P3 compares the previous duplication rate stored in the storage device 150 with the duplication rate calculated in step S310, and checks whether the duplication rate has fallen to or above the duplication rate threshold (S311). If the duplication rate has fallen to or above the duplication rate threshold (YES in S311), the duplication detection program P3 transitions to S312. If the duplication rate has not fallen to or above the duplication rate threshold (NO in S311), the duplication detection program P3 transitions to step S313.

[0087] If the duplication rate has decreased to or above the duplication rate threshold (YES in S311), the duplication detection program P3 adds a record of a decrease in duplication rate to the operation log list T30 (S312). The duplication detection program P3 adds an entry in which the operation type C31 in the operation log list T30 is determined to be a duplication determination and the Flag C36 is set to True.

[0088] If the duplication rate has not decreased to or above the duplication rate threshold (NO in S311), the duplication detection program P3 adds a record of no duplication rate decrease to the operation log list T30 (S313). The duplication detection program P3 adds an entry in which the operation type C31 in the operation log list T30 is determined to be a duplication determination and the Flag C36 is set to False.

[0089] After step S312 or S313, the duplication detection program P3 performs a duplication rate update process to change the duplication rate C12 in the duplication status management table T10 of the target file to the duplication rate calculated in step S310 (S314), and terminates the duplication detection process (S399).

[0090] FIG. 10 is a flowchart illustrating an example of a ransomware detection process according to the first embodiment.

[0091] The ransomware detection process S400 is performed by the processor 110 executing the ransomware detection program P4 in the file storage 10. The ransomware detection process is executed periodically to determine whether the file storage 10 is being attacked by ransomware.

[0092] First, the ransomware detection program P4 acquires operation logs for a certain period (for example, a period of 30 minutes or 1 hour) from the operation log list T30 (S401).

[0093] Next, the ransomware detection program P4 calculates the total number of renamed files from the operation log (S402). Since it is important whether or not a rename operation has been performed on a certain file, multiple rename operations on the same file do not need to be counted.

[0094] Next, the ransomware detection program P4 calculates the total update (overwriting existing data) data size based on the operation log (S403). Note that since ransomware does not update the same area multiple times, multiple updates to the same area do not need to be counted.

[0095] Next, the ransomware detection program P4 calculates the total number of files whose duplication rate has decreased (total duplication rate decrease number) from the operation log (S404).

[0096] Next, the ransomware detection program P4 checks whether the total number of rename files exceeds the file number threshold (S405). Here, the ransomware detection program P4 sets a threshold for the number of rename operations as a rename operation number threshold, and when the number of rename operations within a certain period stored in the operation log list T30 exceeds the rename operation number threshold, it can detect that data has been updated by ransomware. Therefore, if the total number of rename files exceeds the file number threshold (YES in S405), the ransomware detection program P4 transitions to step S408. If the total number of rename files does not exceed the file number threshold (NO in S405), the ransomware detection program P4 transitions to step S406.

[0097] Next, the ransomware detection program P4 checks whether the total updated data size exceeds the data size threshold (S406). Here, the ransomware detection program P4 sets the threshold for the data size of data updated by a write operation as the data size threshold, and detects that the data has been updated by ransomware when the data size of data updated by a write operation within a certain period stored in the operation log list T30 exceeds the data size threshold. Therefore, if the total updated data size exceeds the data size threshold (YES in S406), the ransomware detection program P4 transitions to step S408. If the total updated data size does not exceed the data size threshold (NO in S406), the ransomware detection program P4 transitions to step S407.

[0098] Next, the ransomware detection program P4 checks whether the total duplication rate reduction number exceeds the reduction number threshold (S407). Here, the ransomware detection program P4 sets the threshold for the number of times the reduction amount of the duplication rate exceeds the duplication rate threshold as the reduction number threshold, and detects that the data has been updated by ransomware when the number of times the reduction amount of the duplication rate exceeds the duplication rate threshold within a certain period stored in the operation log list T30 exceeds the reduction number threshold. Therefore, if the total duplication rate reduction number exceeds the reduction number threshold (YES in S407), the ransomware detection program P4 transitions to step S408. If the total duplication rate reduction number does not exceed the reduction number threshold (NO in S407), the ransomware detection program P4 transitions to step S499.

[0099] In addition, the ransomware detection program P4 determines that a ransomware attack has occurred if any of the values ​​exceeds the threshold in the confirmation process of steps S405 to S407. The method of determination is not limited to the case described here, and may be when all values ​​exceed the threshold, when multiple values ​​exceed the threshold, or when the weighted average of each value exceeds the threshold.

[0100] If the total number of renamed files exceeds the file number threshold (YES in S405), if the total updated data size exceeds the data size threshold (YES in S406), or if the total number of duplicate rate reductions exceeds the reduction number threshold (YES in S407), then the ransomware detection program P4 requests data protection processing from the data protection processing program P5 that performs data protection processing. In addition, the ransomware detection program P4 notifies the management terminal 13 that manages the file storage 10 that there is a possibility that the file storage 10 is under attack by ransomware, that is, that ransomware has been detected (S408). The storage administrator operating the management terminal 13 can immediately know that the file storage 10 is under attack by ransomware and can take action.

[0101] In addition, a ransomware attack is detected when any one of the judgment processes (S405, S406, S407) shown in Fig. 10 is met. However, the ransomware detection program P4 may detect that data has been updated by ransomware based on a combination of at least two of the number of rename operations within a certain period of time, the data size of data updated by write operations within a certain period of time, and the number of times that the amount of decrease in duplication rate within a certain period of time exceeds a duplication rate threshold. In addition, the ransomware detection program P4 may weight the result of the judgment process, and detect a ransomware attack when the weighted result of the judgment process exceeds a predetermined threshold.

[0102] In addition, the ransomware detection process may be started when the number of Write operations and Rename operations written in the operation log list T30 becomes greater than usual.

[0103] In the storage system 1 according to the first embodiment described above, the duplication detection program P3 detects the duplication rate of files before and after an update, and the ransomware detection program P4 checks the decrease in the duplication rate detected on a file-by-file basis, thereby detecting a ransomware attack on the file storage 10. Therefore, even if the ransomware encrypts only a part of the file data as in the past and the number of write requests is small, the ransomware detection program P4 detects the ransomware attack in a short time. After that, the data protection processing program P5 can take measures such as stopping the file storage 10 and disconnecting the file storage 10 from the network 12. Furthermore, the data protection processing program P5 can restore data damaged by ransomware to the state before the attack, so that the damage to the file storage 10 can be minimized.

[0104] Detecting the duplication rate of file data has a smaller processing overhead than conventional data compression processing, and therefore can suppress performance degradation of the storage system 1. Furthermore, ransomware changes the encrypted file name to "the original file name + a specific extension." Therefore, even if part of a file is encrypted by ransomware, the ransomware detection program P4 can detect the presence of a ransomware attack if the file has been renamed many times within a certain period of time.

[0105] Furthermore, in the storage system 1, the processing required for ransomware detection is lighter than conventional processing, which makes it possible to suppress performance degradation in the storage system 1 and improve the accuracy of ransomware detection.

[0106] [Second embodiment] Next, a storage system according to a second embodiment of the present invention will be described with reference to Fig. 11 to Fig. 14. Normally, still image data, moving image data, and compressed data all have low duplication rates, but even if a decrease in duplication rate is detected in block units for these data written to a file storage, it is difficult to determine whether the decrease in duplication rate is due to a ransomware attack. Therefore, the storage system according to the second embodiment focuses on the file type, monitors the decrease in duplication rate when the storage unit is the file type unit, and detects ransomware.

[0107] Fig. 11 is a block diagram showing an example of the overall configuration of a computer system according to the second embodiment. The difference from the computer system shown in Fig. 3 is that the storage device 150 also stores a file type duplication rate management table T40.

[0108] FIG. 12 is a diagram showing an example of a file type duplication rate management table T40 according to the second embodiment.

[0109] The file type duplication rate management table T40 is a table that stores the duplication rates before and after duplication determination for each file type. An entry of the file type duplication rate management table T40 includes fields for a file type C41 and a duplication rate C42.

[0110] The file type C41 stores information about the file type. The file type is the type of file determined based on the file extension, the file header, or data at a specific position. File types include the extension mp4 indicating moving image data, the extension txt indicating text data, and the extension dat indicating a data file. Other extensions such as the extension zip indicating compressed data and the extension jpeg indicating still image data may also be stored in the file type C41.

[0111] The duplication rate C42 stores the duplication rate for each file type. The duplication rate may be calculated by the number of chunks in which duplication of the same file type was detected / total number of chunks of the same file type, the total size of the area in which duplication of the same file type was detected / file size of the same file type, the number of chunks in which duplication of the same file type has been detected so far / number of chunks of the same file type determined to be duplicates so far, or the like. Compared to the text data (txt) and data file (dat) shown in the file type C41, the duplication rate of video data (mp4) is very low. Although not shown, still image data (jpeg) and the like also have a low duplication rate.

[0112] The duplication rate management table may be configured to monitor the duplication rate on a directory basis instead of on a file type basis. In this case, the directory is configured in the duplication rate management table instead of the file type C41.

[0113] The storage system according to the second embodiment includes a duplication state management table T10 shown in Fig. 4 and a duplication chunk determination table T20 shown in Fig. 5, similar to the tables according to the first embodiment. However, unlike the first embodiment, the operation log list T30 shown in Fig. 6 does not need to store a log of the duplication determination operation.

[0114] Moreover, the storage system according to the second embodiment performs the user I / O process S100 shown in FIG. 7 and the file update process S200 shown in FIG. 8, similarly to the processes according to the first embodiment.

[0115] FIG. 13 is a flowchart showing an example of the overlap detection process according to the second embodiment.

[0116] The duplicate detection process S500 is performed by the processor 110 executing the duplicate detection program P3 in the file storage 10. The duplicate detection program P3 checks the operation log list T30 and performs a duplicate determination for files whose data has been updated.

[0117] The processing of steps S501 to S510 is similar to the processing of steps S301 to S310 in Fig. 9, so detailed explanation will be omitted. As explained in step S301, the duplication detection program P3 acquires the duplication rate of the target file type duplication rate C42 from the file type duplication rate management table T40 in conjunction with the start of this processing, and writes it to a specified area of ​​the storage device 150.

[0118] After calculating the duplication rate of the target file in step S510, the duplication detection program P3 updates the duplication rate C42 in the file type duplication rate management table T40 (S511) and ends the duplication detection process (S599). The duplication detection process S500 calculates the duplication rate not for one file but for multiple files of one file type, and therefore does not include the processing for each operation on the operation log list T30 (S311 to S313 shown in FIG. 9).

[0119] FIG. 14 is a flowchart illustrating an example of a ransomware detection process according to the second embodiment.

[0120] The ransomware detection process S600 is performed in the file storage 10 by the processor 110 executing the ransomware detection program P4.

[0121] The processing of steps S601 to S603 is similar to the processing of steps S401 to S403 in Fig. 10, and therefore detailed description will be omitted. In step S601, the decrease in duplication rate is calculated for each file type. For this reason, in step S601, the ransomware detection program P4 acquires operation logs for a certain period from the operation log list T30, and acquires the file type duplication rate for the certain period from the file type duplication rate management table T40. As described above, in the operation log, the duplication rate updated by the previous ransomware detection processing S600 is stored in the duplication rate C12.

[0122] After calculating the total updated data size in step S603, the ransomware detection program P4 calculates the latest duplication rate for each file type (S604). For example, the ransomware detection program P4 can calculate the duplication rate for each file type based on the duplication rate C12 of each file of the same file type and the file size. For this reason, the duplication status management table T10 shown in Fig. 4 has an item for file size. The duplication rate for each file type may be calculated when the duplication detection program P3 executes the duplication detection process.

[0123] Next, the ransomware detection program P4 compares the previous duplication rate C42 for each file type with the duplication rate for each file type calculated in step S604, and calculates the decrease in the duplication rate for each file type (S605).

[0124] The processes in the next steps S606 and S607 are similar to the processes in steps S405 and S406 in FIG. 10, respectively, and therefore will not be described in detail.

[0125] If step S607 is judged as NO, the ransomware detection program P4 checks whether the duplication rate decrease of a certain file type exceeds the duplication rate threshold (S608). If the duplication rate decrease exceeds the duplication rate threshold, the ransomware detection program P4 transitions to step S609. If the duplication rate decrease does not exceed the duplication rate threshold, the ransomware detection program P4 transitions to step S610. Note that the target file types may be limited to those whose total size is equal to or larger than a certain size.

[0126] The process in the next step S609 is similar to the process in step S408 in FIG. 10, and therefore a detailed description thereof will be omitted.

[0127] After step S609, or if the decrease in the duplication rate does not exceed the duplication rate threshold (NO in S608), the ransomware detection program P4 updates the duplication rate C42 in the file type duplication rate management table T40 to the duplication rate for each file type calculated in step S604 (S610), and terminates the ransomware detection process (S699).

[0128] In the file storage system 1A according to the second embodiment described above, even if the duplication rate differs for each file type, the ransomware detection program P4 detects ransomware when the decrease in the duplication rate for a file type exceeds the duplication rate threshold. Therefore, the data protection processing program P5 performs data protection processing quickly, and the impact of ransomware attacks on files can be suppressed.

[0129] [Third embodiment] Next, a storage system according to a third embodiment of the present invention will be described with reference to Figs. 15 to 21. In the storage system according to the third embodiment, ransomware is detected in a block storage, and a decrease in the duplication rate when the storage unit is a volume is monitored. A block storage is a storage that divides data into blocks, not in file units, and stores the blocks. Also, in the storage system according to the third embodiment, the duplication rate is monitored in volume units, which are collections of blocks provided by the block storage. However, the storage system may monitor the decrease in the duplication rate in units of any size that groups blocks together, rather than in volumes.

[0130] FIG. 15 is a block diagram showing an example of the overall configuration of a computer system according to the third embodiment.

[0131] The client 21 updates data stored in the block storage 20. The client 21 is an example of a client device used by a user. Either a normal program or ransomware may run on the client 21. In the following description, the client 21 refers to both a PC infected with ransomware and a PC not infected with ransomware.

[0132] The block storage 20 is connected to a client 21 and a management terminal 23 via a network 22. The network 22 is, for example, a LAN, a WAN, or a SAN (Storage Area Network).

[0133] The block storage 20 is an example of a block storage that manages data as blocks. The block storage 20 may be configured from multiple block storages rather than a single block storage. The block storage 20 includes a processor 210, a memory 220, a cache 230, a network I / F 240, and a storage device 250. These are connected to each other by a communication path such as a bus 260.

[0134] The processor 210 controls the operation of the file storage by executing programs stored in the memory 220. The memory 220 is, for example, a RAM, and temporarily stores programs and data used for controlling the operation of the processor 210.

[0135] A block storage control program P11, a duplicate detection program P12, a ransomware detection program P13, and a data protection processing program P14 are stored in the memory 220. These programs stored in the memory 220 may also be stored in the storage device 250.

[0136] The block storage control program P11 is executed by the processor 210, and provides a logical volume, which is a logical storage area based on the storage device 250, to the client 21.

[0137] The duplicate detection program P12, the ransomware detection program P13, and the data protection processing program P14 have the same functions as the duplicate detection program P3, the ransomware detection program P4, and the data protection processing program P5 shown in Figure 3, so detailed explanations will be omitted.

[0138] The cache 230 is, for example, a RAM, and temporarily stores data written by the client 21 and data read from the storage device 250. The network I / F 240 is an interface such as a wired LAN card or a wireless LAN card, and communicates with other devices (for example, the client 21) via the network 22.

[0139] The storage device 250 is, for example, a hard disk or a flash memory, and stores various contents including contents used by the user of the client 21. The contents may include objects in addition to files. Moreover, the files may include not only user files but also files that store duplicate chunks.

[0140] The storage device 250 stores a duplication state management table T50, a duplication chunk judgment table T20, and an operation log list T60. Detailed configuration examples of the duplication state management table T50 and the operation log list T60 will be described with reference to Fig. 15 and Fig. 17. A configuration example of the duplication chunk judgment table T20 has already been described with reference to Fig. 5.

[0141] FIG. 16 is a configuration diagram showing an example of a duplication state management table T50 according to the third embodiment.

[0142] The duplication state management table T50 includes an entry for each volume. The block storage 20 is configured as a part of the block storage system 1B, and provides block volumes to the client 21. An entry of the duplication state management table T50 includes a Volume ID C51, a duplication rate C52, and a group of fields (C53 to C56) for each chunk in the volume corresponding to the entry.

[0143] The Volume ID C51 stores the ID of the volume corresponding to the entry. The duplication rate C52 stores the duplication rate of the volume of the Volume ID C51. The duplication rate of the volume may be calculated by the number of chunks in which duplication was detected / the total number of chunks, or may be calculated by the total size of the area in which duplication was detected / the volume size.

[0144] The group of fields for each chunk includes fields for an offset within volume C53, a duplication determination processing completion flag C54, a duplication status C55, and a fingerprint C56. The start position within the volume of the chunk corresponding to the field group is stored in the offset within the volume C53.

[0145] The overlap determination processing completed flag C54 stores an overlap determination processing completed flag indicating whether or not the chunk corresponding to the field group has been subjected to overlap determination processing. The overlap determination processing completed flag is set to False when the data in the chunk is updated, and is set to True after the overlap determination processing.

[0146] The overlap status C55 stores the status of the chunk corresponding to the field group. The chunk status can be non-overlapping, which indicates that the chunk does not overlap with other chunks, or overlapping, which indicates that the chunk overlaps with other chunks.

[0147] The fingerprint C56 stores the fingerprint of the chunk corresponding to the field group. The fingerprint is a value obtained by applying a hash function to the chunk data, and is used to check the identity (duplication) of the chunk. For example, MD5 or SHA-1 may be used as a method for calculating the fingerprint. The fingerprint is set during the duplication determination process.

[0148] FIG. 17 is a diagram showing an example of an operation log list T60 according to the third embodiment.

[0149] The operation log list T60 stores an entry (log) for each operation. The operation log list T60 includes fields for operation type C61, LBA C62, Size C63, Flag C64, and Timestamp C65.

[0150] The operation type C61 stores the block operation type corresponding to the entry. The operation type includes, for example, Write (update), Read (read), and the like.

[0151] The LBA (Logical Block Addressing) C62 stores the start position of the block targeted by the block operation corresponding to the entry. The size of the block operation corresponding to the entry is stored in Size C63.

[0152] FlagC64 stores whether the duplication rate of the volume before and after the data update has decreased by more than the threshold value in the duplication determination operation. If the decrease in the duplication rate is more than the threshold value, True is stored. If it is less than the threshold value, False is stored. For other operations, it is not stored. TimestampC65 stores the timestamp when the operation corresponding to the entry was performed.

[0153] <Example of block storage processing operation> Next, an example of the processing operation of the block storage 20 according to this embodiment will be described in detail with reference to FIGS.

[0154] FIG. 18 is a flowchart showing an example of block I / O processing according to the third embodiment.

[0155] The block I / O process 700 is performed by the processor 210 executing the block storage control program P11 in the block storage 20. A block I / O request will be described in the flowchart as a request for a block I / O operation to the block storage 20.

[0156] When the block storage control program P11 receives a user I / O request from the client 21 (S701), it performs protocol processing.

[0157] Next, the block storage control program P11 carries out the requested block I / O operation (S702).

[0158] Next, the block storage control program P11 adds the details of the performed block I / O operation to the operation log list T60 (S703), and ends the block I / O processing (S799).

[0159] FIG. 19 is a flowchart illustrating an example of a block update process according to the third embodiment.

[0160] The block update process S800 is a type of block I / O operation executed in step S702. The block update process S800 is performed in the block storage 20 by the processor 210 executing the block storage control program P11.

[0161] The block storage control program P11 checks the overlap state management table T50 and checks whether the chunks corresponding to the update area include chunks for which overlap determination has been performed (the overlap determination processing completed flag C54 is completed) (S801). If any chunks for which overlap determination processing has been performed are included (YES in S801), the program transitions to step S802. If any chunks for which overlap determination processing has been performed are not included (NO in S801), the program transitions to step S803.

[0162] If it is determined in step S801 that a chunk for which duplication determination processing has been performed is included, the block storage control program P11 obtains the fingerprint C56 of the chunk for which duplication determination processing has been performed from the duplicate chunk determination table T20, and subtracts 1 from the number of chunks C22 in the duplicate chunk determination table T20 (S802). If the number of chunks is 0, the block storage control program P11 may delete the entry.

[0163] If it is determined in step S801 that no chunks that have been subjected to duplication determination processing are included, or after step S802, the block storage control program P11 writes the update contents to the target area based on the requested block update, and reflects the update contents in the target area (S803). The target area is the area where data is actually written, and is the storage destination of the blocks to be updated.

[0164] Next, the block storage control program P11 changes the overlap determination processing completion flag C54 in the overlap state management table T50 of the chunk corresponding to the update area to False (S804), and ends the block update processing (S899). However, if the determination is NO in step S801, the overlap determination processing completion flag C54 may be updated from False to False.

[0165] FIG. 20 is a flowchart showing an example of the overlap detection process according to the third embodiment.

[0166] The duplicate detection process S900 is performed by the processor 210 executing the duplicate detection program P12 in the block storage 20. The duplicate detection program P12 checks the duplicate state management table T50 and performs duplicate detection for blocks whose data has been updated (chunks whose duplicate detection processing completed flag C54 has not been set). The duplicate detection process S900 shows duplicate detection processing on a block-by-block basis in a certain volume. The duplicate detection program P12 is executed periodically.

[0167] First, the duplication detection program P12 reads the information of the target volume from the duplication status management table T50 (S901).

[0168] The processing in steps S902 to S909 is similar to that in steps S302 to S309 in FIG. 9, and therefore a detailed description thereof will be omitted.

[0169] If it is determined in step S909 that the block is the last block of the duplication management unit (YES in S909), the duplication detection program P12 checks the duplication status C55 in the duplication status management table T50 of the target volume, and calculates the duplication rate for each volume (S910). The duplication rate may be calculated by dividing the number of chunks in which duplication was detected by the total number of chunks, or by dividing the total size of the area in which duplication was detected by the volume size.

[0170] Next, the duplication detection program P12 compares the duplication rate of the previous volume with the duplication rate calculated in step S910, and checks whether the duplication rate has decreased to or above the duplication rate threshold (S911). If the duplication rate has decreased to or above the duplication rate threshold (YES in S911), the duplication detection program P12 transitions to step S912. If the duplication rate has not decreased to or above the duplication rate threshold (NO in S911), the duplication detection program P12 transitions to step S913.

[0171] If the duplication rate has fallen to or below the duplication rate threshold value (YES in S911), the duplication detection program P12 adds an entry in which FlagC64 is set to True in the duplication determination operation to the operation log list T60 (S912).

[0172] If the duplication rate has not decreased to or below the duplication rate threshold (NO in S911), the duplication detection program P12 adds an entry in which FlagC64 is set to False in the duplication determination operation to the operation log list T60 (S913).

[0173] After step S912 or S913, the duplication detection program P12 changes the duplication rate C62 in the duplication status management table T50 of the target file to the duplication rate calculated in S910 (S914), and ends the duplication detection process (S999).

[0174] 21 is a flowchart showing an example of a ransomware detection process according to the third embodiment. In the update process in units of volumes, since there is no rename operation, there is no process (S402) for calculating the total number of rename files as shown in FIG.

[0175] The ransomware detection process S1000 is performed in the block storage 20 by the processor 210 executing the ransomware detection program P13.

[0176] First, the ransomware detection program P13 obtains operation logs for a certain period from the operation log list T60 (S1001).

[0177] Next, the ransomware detection program P13 calculates the total update (overwriting existing data) data size from the operation log (S1002). Multiple updates of the same area for a certain block do not need to be counted.

[0178] Next, the ransomware detection program P13 calculates the total number of volumes whose duplication rate has decreased (total duplication rate decrease number) from the operation log (S1003).

[0179] Next, the ransomware detection program P13 checks whether the total updated data size exceeds the data size threshold (S1004). If the total updated data size exceeds the data size threshold (YES in S1004), the ransomware detection program P13 transitions to step S1006. If the total updated data size does not exceed the data size threshold (NO in S1004), the ransomware detection program P13 transitions to step S1005.

[0180] Next, the ransomware detection program P13 checks whether the total overlap rate decrease number exceeds the decrease number threshold (S1005). If the total overlap rate decrease number exceeds the decrease number threshold (YES in S1005), the ransomware detection program P13 transitions to step S1006. If the total overlap rate decrease number does not exceed the decrease number threshold (NO in S1005), the ransomware detection program P13 transitions to step S1099.

[0181] In addition, in steps S1004 to S1005, if any of the values ​​exceeds the threshold, it is determined that there is a ransomware attack. The method of determination is not limited to the case described here, but may be when all values ​​exceed the threshold, or when the weighted average of each value exceeds the threshold, etc.

[0182] If the total updated data size exceeds the data size threshold (YES in S1004), or if the total duplication rate reduction number exceeds the reduction number threshold (YES in S1005), the ransomware detection program P13 requests the data protection processing program P14 to perform data protection processing, and notifies the management terminal 23 that manages the block storage 20 that there is a possibility of being attacked by ransomware (S1006). After that, the ransomware detection processing ends (S1099).

[0183] In the block storage system according to the third embodiment described above, ransomware detection is performed in the block storage 20, and a decrease in the duplication rate per volume is monitored. When a ransomware attack is detected, data protection processing is promptly performed by the data protection processing program P5, so that the impact of the ransomware attack on blocks can be suppressed.

[0184] [Variations] Although the file storage system and block storage system according to each of the above-described embodiments are constructed in a computer system, the file storage and block storage may be constructed in a cloud server. In this case, the client and management terminal may access the file storage or block storage when necessary via a communication line such as the Internet to store data.

[0185] In addition, a program for executing the processes according to each embodiment may be distributed, and a PC or the like may be able to execute the program independently after receiving the program. In this case, even if a PC or the like is offline, it is possible to detect ransomware.

[0186] It should be noted that the present invention is not limited to the above-described embodiments, and various other applications and modifications are possible without departing from the gist of the present invention as set forth in the claims. For example, the above-mentioned embodiments have been described in detail and specifically with respect to the configuration of the device and system in order to clearly explain the present invention, and are not necessarily limited to those including all of the configurations described. In addition, it is possible to replace a part of the configuration according to the embodiment described here with a configuration according to another embodiment, and it is also possible to add a configuration according to another embodiment to a configuration according to a certain embodiment. In addition, it is also possible to add, delete, or replace a part of the configuration according to each embodiment with another configuration. In addition, the control lines and information lines shown are those that are considered necessary for the explanation, and not all control lines and information lines in the product are necessarily shown. In reality, it can be considered that almost all components are connected to each other. [Explanation of symbols]

[0187] 1...storage system, 10...file storage, 11...client, 12...network, 13...management terminal, 20...block storage, 21...client, 22...network, 23...management terminal, 110...processor, 120...memory, 130...cache, 150...storage device, P1...network file system program, P2...local file system program, P3...duplicate detection program, P4...ransomware detection program, P5...data protection processing program, T10...duplicate status management table, T20...duplicate chunk judgment table, T30...operation log list

Claims

1. 2. A storage system having a processor for processing data input to and output from a storage device, The processor de-dupes duplicated data and stores the duplicated data in the storage device, and calculates a duplication rate that is a ratio of the duplicated data in a predetermined storage unit; a duplication detection unit that runs on the processor and detects a change in the duplication rate between before the update of the data and after the update of the data in a predetermined storage unit; a malicious program detection unit that operates on the processor, sets a threshold value related to the detected change in the duplication rate as a duplication rate threshold, and detects that the data has been updated by a malicious program when a decrease in the duplication rate exceeds the duplication rate threshold. Storage system.

2. a duplication status management table for managing the duplication status of the data for each of the storage units; an operation log list for storing an operation log for each operation performed on the data; the duplication detection unit calculates a change in the duplication rate for the data stored as non-duplication in the duplication state management table; The malicious program detection unit detects, based on the operation log, that the data has been updated by a malicious program. The storage system according to claim 1 .

3. The operation log includes, as an operation type for the data, a rename operation for changing a name of the data, The malicious program detection unit sets a threshold value related to the number of the rename operations as a rename operation number threshold, and detects that the data has been updated by the malicious program when the number of the rename operations within a certain period stored in the operation log list exceeds the rename operation number threshold. The storage system according to claim 2.

4. The operation log includes, as an operation type for the data, a write operation in which the data was updated; The malicious program detection unit sets a threshold value related to the data size of the data updated by the write operation as a data size threshold, and detects that the data has been updated by the malicious program when the data size of the data updated by the write operation within a certain period stored in the operation log list exceeds the data size threshold. The storage system according to claim 3.

5. The operation log includes, as an operation type for the data, information indicating that the duplication detection unit has detected that the amount of decrease in the duplication rate has exceeded the duplication rate threshold, The malicious program detection unit sets a threshold value for the number by which the decrease in the duplication rate exceeds the duplication rate threshold, and detects that the data has been updated by the malicious program when the number by which the decrease in the duplication rate exceeds the duplication rate threshold within a certain period of time stored in the operation log list exceeds the decrease number threshold. The storage system according to claim 4.

6. The malicious program detection unit detects that the data has been updated by the malicious program based on a combination of at least two of the number of rename operations within the certain period of time, the data size of the data updated by the write operation within the certain period of time, and the number of times the amount of decrease in the duplication rate within the certain period of time exceeds the duplication rate threshold value. The storage system according to claim 5.

7. a duplicate chunk determination table for storing a fingerprint generated according to an offset of the data managed in the duplicate state management table and the number of chunks obtained by dividing the data by a predetermined length; The duplication detection unit calculates a fingerprint of a chunk for which the duplication state has not been determined based on the duplication state management table, and if the fingerprint matches the fingerprint stored in the duplicate chunk determination table, adds the number of chunks of the chunk that matches the calculated fingerprint, and if the fingerprint does not match the fingerprint stored in the duplicate chunk determination table, adds the calculated fingerprint to the duplicate chunk determination table and calculates the duplication rate based on the number of chunks. The storage system according to claim 5.

8. The storage unit is any one of a block unit, a file unit, a file type unit, a directory unit, and a volume unit. The storage system according to claim 7.

9. a protection processing unit that runs on the processor and performs a protection process on the data that has been updated by the malicious program detected by the malicious program detection unit; The storage system according to claim 8.

10. 1. A method for detecting malicious programs used in a storage system having a processor that processes data input to and output from a storage device, comprising: a step of the processor de-duping duplicated data and storing the duplicated data in the storage device, and calculating a duplication rate which is a ratio of the duplicated data in a predetermined storage unit; detecting, by the processor, a change in the duplication rate between before the update of the data and after the update of the data in a predetermined storage unit; The processor determines a threshold value for the detected change in the duplication rate as an duplication rate threshold value, and determines that the data has been updated by a malicious program when a decrease in the duplication rate exceeds the duplication rate threshold value. Malware detection methods.

Images