Module and method for detecting malicious activities in a storage device

Abstract

This document describes a module and method for detecting malicious activities in a storage device whereby the module is provided within a controller of the storage device. The module is configured to monitor, using a trained neural network, appropriate logical block addresses (LBAs) of the file system of the storage device that contain sensitive data or information for malicious activities.

Description

[Technical Field]

[0001] This invention relates to a module and method for detecting malicious activity in a storage device, wherein the module is disposed within a controller of the storage device. The module is configured to use a trained neural network to monitor suitable logical block addresses (LBAs) of the file system of the storage device containing sensitive data or information containing malicious activity. [Previous Technology]

[0002] Storage devices typically include solid-state drives (SSDs), hard disk drives (HDDs), optical drives, or magnetic drives. Regardless of the type of storage device, these devices are typically linearly addressed by their logical block addresses (LBAs). For HDDs, optical drives, or magnetic drives, the LBA specifies the location of a particular block of data stored within the storage device. As an example, LBA 0 refers to the first sector on the first track that can be accessed by the first read / write head in the magnetic drive; therefore, when LBA 0 is accessed by the host device, the contents contained at LBA 0 are provided to the host device.

[0003] However, unlike the disk drives described above, SSDs contain electronically erasable and reprogrammable non-volatile memory that does not have tracks or heads as mentioned in logical block addressing systems. Therefore, SSDs must utilize a Flash Translation Layer (FTL) provided within the SSD's flash memory controller to map the host device's file system logical block addresses to the physical addresses of the flash memory (logical-to-physical mapping). In other words, the host device will still use the existing LBA addressing method to address the SSD for read / write / overwrite operations. Commands from the host device will be intercepted by the FTL, and the FTL will maintain the mapping between the flash memory's LBAs and physical block addresses (PBAs). The PBAs will then be used by the SSD's controller to execute the received commands.

[0004] Recently, SSDs have become more widely used as storage devices due to their numerous advantages over traditional mechanical hard drives. For example, SSDs are much faster than HDDs and can deliver up to 100 times the performance of HDDs, meaning faster boot times and faster file transfers. SSDs also consume significantly less power than HDDs, resulting in improved power and thermal efficiency. Therefore, SSDs are now widely used in industrial, medical, and military applications.

[0005] Typically, most SSDs are used with host devices and can be used to store the host device's operating system, i.e., as the host's system drive. The operating system-related code is stored within the SSD and accessed when the host device boots. When the SSD is used as the host's system drive, it has a Master Boot Record (MBR) stored at Logical Block Address (LBA) 0, and the host device's operating system code stored elsewhere on the storage device. When the host device first accesses the storage device, an instruction is sent to LBA 0 to instruct the SSD to send the contents of LBA 0 to the host device. This allows the host device to read the MBR from LBA 0, which typically contains computer-readable code. This computer-readable code, when executed by the host device, provides the host device with the ability to read other parts of the operating system code from the storage device and boot the host device.

[0006] Alternatively, an SSD may also be used as an auxiliary storage medium, such as a USB flash drive, memory card, or external storage device, to expand the storage capacity accessible by the host device. When the SSD is first accessed by the host device, the contents of LBA 0 of the storage device will indicate to the host device that the SSD will be used as an auxiliary storage medium.

[0007] In order to access information contained in sensitive applications, malicious third parties have used various means and methods to infect the MBR of such storage devices. Common methods involve malicious third parties gaining system-level access to the storage device before de-enhancing the MBR or other boot sectors of the storage device and before allowing a compromised operating system to be installed thereon.

[0008] In order to protect the operating system from tampering and prevent access to important private information in the event of storage device misplacement, those skilled in this art have proposed that the operating system code (including the MBR) be encrypted by software installed in the storage device and subject to an authentication process, so that the MBR and operating system code can only be accessed by authorized users. Because the controller will not be able to read the MBR before authenticating the user of the storage device, the storage device can store an "alternate" Master Boot Record (MBR), which allows authentication information to be collected and verified by an authentication program running in the storage device.

[0009] After successfully authenticating the user of the storage device, the storage device remaps LBA 0 to the original MBR, enabling the storage device to receive the actual MBR and boot normally. A disadvantage of this method is that if the user's authentication credentials are compromised, this means that the MBR and operating system code will also be compromised.

[0010] Furthermore, solutions proposed by those skilled in this technology require that the operating system, partitioning system, or boot region of the monitored storage device be known and pre-loaded into these solutions before the storage device can be adequately protected. In other words, existing solutions cannot automatically identify the operating system, partitioning system, or boot region of the monitored storage device, and this information must be provided to the existing monitoring solution by the user. For the storage device controller, all information contained within the storage device includes user data, and this data is preset and cannot be distinguished. This becomes particularly problematic when the user modifies or incorrectly selects the operating system, partitioning system, or boot region of the monitored storage device, and therefore, the storage device may be unintentionally damaged.

[0011] For the reasons mentioned above, those skilled in this technology have been working to develop modules and methods that can detect malicious activities in storage devices, even if the user does not provide the operating system, partitioning system or boot area of ​​the storage device to the device controller. [Summary of the Invention]

[0012] The above and other problems are solved by the system and method provided by the embodiments of the present invention, and further developments are made in the field.

[0013] A first advantage of embodiments of the module and method according to the present invention is that the module is able to identify the type of operating system installed in the memory device.

[0014] A second advantage of embodiments of the module and method according to the present invention is that the module can automatically and efficiently detect malicious activities occurring in a specific location within the storage device.

[0015] A third advantage of embodiments of the module and method according to the present invention is that the logical block address of the storage device is monitored at the firmware level and the operating system does not need to be started before malicious activity can be detected and prevented.

[0016] A fourth advantage of embodiments of the module and method according to the present invention is that the contents contained in the storage device (a system device configured to act as a host device) will still be protected from malicious third-party influence, even if the storage device is removed from the host device and reconfigured as an auxiliary storage device when the module is configured to detect malicious activity in both configurations.

[0017] A fifth advantage of the embodiments of the module and method according to the present invention is that when the module is implemented as part of the firmware of the storage device controller, the module is not disabled at the operating system level.

[0018] The above advantages are provided by embodiments of the method according to the present invention, which operate in the following manner.

[0019] According to a first aspect of the present invention, a module for detecting malicious activity in a storage device is disclosed, wherein the module is disposed within a controller of the storage device, and the module is configured to: retrieve a first logical block address (LBA0) sent from a host device to the controller and retrieve the content at the first LBA0, wherein the retrieved content is used to activate a trained neural network retrieved from a data module disposed within the controller; use the content at the first LBA0 and the trained neural network to identify a logical block address (LBA) of the storage device to be monitored; by means of The host device sends instructions to the identified LBA to the controller and mirrors the contents of the mirrored LBA. The trained neural network is then used to determine whether malicious activity is occurring at the storage device based on the mirrored instructions and contents. The neural network is trained for different types of operating systems or auxiliary storage operations based on the average read / write / overwrite accesses of the contents of the LBA associated with the file system, master boot record, master file table, boot sector, BIOS parameter block, or extended BIOS parameter block of the file system.

[0020] Regarding the first aspect of the present invention, the activation of the associated trained neural network includes the module being configured to: select a set of magic numbers from the content at the first LBA0, wherein the selected set of magic numbers, together with a magic number lookup table, is used to determine the type of operating system or the type of auxiliary storage operation associated with the file system of the storage controller, wherein the magic number lookup table is obtained from the data module; and activate the trained neural network to detect malicious activities associated with the determined type of operating system or auxiliary storage operation from the data module.

[0021] Regarding the first aspect of the present invention, the module for identifying the LBA to be monitored in the storage device is configured to: identify the LBA containing critical data based on the determined type of the operating system or auxiliary storage operation associated with the activated trained neural network, wherein the critical data includes at least the master file table, master boot record, boot sector, BIOS parameter block or extended BIOS parameter block of the file system associated with the storage device.

[0022] Regarding the first aspect of the present invention, the module is further configured to: optimize the trained neural network based on malicious activity determined to have occurred at the storage device by means of mirrored instructions and content.

[0023] Regarding the first aspect of the present invention, the module is further configured to: lock the storage device in response to a determination based on a mirrored instruction and content that malicious activity has occurred at the storage device.

[0024] Regarding the first aspect of the present invention, the trained neural network includes one of an artificial neural network, a recursive neural network (RNN), or a convolutional neural network (CNN).

[0025] According to a second aspect of the present invention, a method for detecting malicious activity in a storage device is disclosed. The method includes the following steps: retrieving a first logical block address (LBA0) sent to the controller from a host device using a module disposed in a controller of the storage device; retrieving content at the first LBA0 using the module, wherein the retrieved content is used to activate a trained neural network retrieved from a data module disposed in the controller; and using the module to identify a logical block address (LBA) of the storage device to be monitored using the content at the first LBA0 and the trained neural network. The module uses the host device to mirror commands sent to the identified LBA to the controller and mirrors the contents of the mirrored LBA; and uses a trained neural network to determine whether malicious activity is occurring at the storage device based on the mirrored commands and contents. The neural network is trained on average read / write / overwrite accesses of the contents of the LBA associated with the operating system or auxiliary storage operation, such as the Master Boot Record, Master File Table, Boot Sector, BIOS Parameter Block, or LBA associated with the extended BIOS Parameter Block.

[0026] Regarding the second aspect of the present invention, the activation of the associated trained neural network includes the following steps: using the module to select a set of magic numbers from the contents of the first LBA0, wherein the selected set of magic numbers, together with a magic number lookup table, is used to determine the type of operating system or the type of auxiliary storage operation associated with the file system of the storage controller, wherein the magic number lookup table is obtained from the data module; and using the module to activate the trained neural network to detect malicious activities associated with the determined type of operating system or auxiliary storage operation from the data module.

[0027] Regarding the second aspect of the present invention, identifying the LBA to be monitored in the storage device includes the following steps: using the module to identify the LBA containing key data based on the determined type of the operating system or auxiliary storage operation associated with the activated trained neural network, wherein the key data includes at least the master file table, master boot record, boot sector, BIOS parameter block or extended BIOS parameter block of the file system associated with the storage device.

[0028] Regarding the second aspect of the present invention, the method further includes the following steps: using the module to optimize the trained neural network based on malicious activity determined to have occurred at the storage device by the mirrored instructions and content.

[0029] Regarding the second aspect of the present invention, the method further includes the following steps: using the module to lock the storage device in response to a determination based on the mirrored command and content that malicious activity has occurred at the storage device.

[0030] Regarding the second aspect of the present invention, the trained neural network includes one of an artificial neural network, a recursive neural network (RNN), or a convolutional neural network (CNN).

Implementation Method

[0032] This invention relates to a module and method for detecting malicious activity in a storage device, wherein the module is disposed within the controller of the storage device. The module is configured to use a trained neural network to monitor suitable logical block addresses (LBAs) of sensitive data or information containing malicious activity in the file system of the storage device. The neural network is trained based on average read / write / overwrite accesses of the contents of LBAs associated with the operating system or auxiliary storage operations, such as the Master Boot Record, Master File Table, Boot Sector, BIOS Parameter Block, or LBAs associated with the extended BIOS Parameter Block, for different types of operating systems or auxiliary storage operations.

[0033] The invention will now be described in detail with reference to several embodiments thereof as illustrated in the accompanying drawings. In the following description, numerous specific features are set forth to provide a thorough understanding of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments may be implemented without some or all of these specific features. Such embodiments should also fall within the scope of the invention. Furthermore, certain procedural steps and / or structures may not be described in detail below, and corresponding references will be used to avoid unnecessarily obscuring the invention.

[0034] Furthermore, those skilled in the art will recognize that many functional units described herein have been labeled as modules throughout this specification. Those skilled in the art will also recognize that modules can be implemented as circuits, logic chips, or any type of discrete component. Furthermore, those skilled in the art will recognize that modules can be implemented in software, which can then be executed by various processor architectures. In embodiments of the invention, modules may also include computer instructions, firmware, or executable code that can instruct a computer processor to perform a series of events based on received instructions. The choice of module implementation is left as a design choice for those skilled in the art and does not in any way limit the scope of the invention.

[0035] An exemplary procedure or method for detecting malicious activity in a storage device according to an embodiment of the present invention is described in the following steps. For example, the steps of a procedure or method implemented by a module disposed within a controller of the storage device are as follows: Step 1: Retrieve a first logical block address (LBA0) sent to the controller from a host device and retrieve the content at the first LBA0, wherein the retrieved content is used to activate a trained neural network retrieved from a data module disposed within the controller; Step 2: Use the content at the first LBA0 and the trained neural network to identify the logical block address (LBA) to be monitored in the storage device; Step 3: Mirror the instruction sent to the identified LBA to the controller via the host device and mirror the content of the mirrored LBA; Step 4: Use the trained neural network to determine whether malicious activity is occurring on the storage device based on mirrored instructions and content. The neural network is trained on average read / write / overwrite accesses of the contents of the Master Boot Record, Master File Table, Boot Sector, BIOS Parameter Block, or LBA associated with the file system or secondary storage operation.

[0036] According to an embodiment of the present invention, the steps described above can be performed or executed by a module included in the controller 105 of the storage device 100, as illustrated in FIG1, wherein the storage device 100 further includes cache memory 107, flash memory 110a to h and interface 120. The storage device 100 may include various types of solid-state devices / disk drives, and the cache memory 107 may include dynamic random access memory (DRAM) and be used to cache both user data and internal SSD background data. The flash memory 110a to h may include any type of electronic non-volatile computer memory storage medium that can be electronically erased and reprogrammed, such as NAND or NOR flash memory. Interface 120 serves as a physical interface between the host system and storage device 100, wherein existing storage standards and interfaces, such as, but not limited to, PCIe, Serial Advanced Attachment (SATA), Serial Attached SCSI (SAS), Non-Volatile Memory High Speed ​​(NVMe), PCIe, or any similar interface, may be used as a link for communicatively connecting storage device 100 to a host device such as a computer.

[0037] The controller 105 is a complex embedded system with independent processing and, together with the firmware and modules contained within the controller 105, is used to manage all states of the storage device 100, including protecting and controlling the contents stored in the flash memories 110a to h. This controller is most often implemented as a system-on-a-chip (SoC) design, which consists of multiple hardware acceleration function blocks / modules coupled to one or more embedded processor cores.

[0038] Figure 2 illustrates the functional blocks included within the controller 105. Specifically, Figure 2 shows that the controller 105 may include a microcontroller 205, a buffer 210, flash interface modules (FIM) 215a to c, and a threat detection module 250. The microcontroller 205 includes a processor located within the controller 105 and is assigned to receive and manipulate incoming data. Hereinafter, the term "processor" is generally used to refer to any device or component capable of processing such instructions and may include: a microprocessor, a microcontroller, a programmable logic device, or other computing device. That is, the microcontroller 205 may be provided by any suitable logic circuitry system for receiving input, processing input according to instructions stored in memory, and generating output. In this embodiment, the microcontroller 205 may be a single-core processor with memory addressable space. The buffer 210 may be considered a data module because it may include static RAM (SRAM) for executing the firmware of the controller 105 or storing data / information to be accessed by the module 250. According to an embodiment of the present invention, threat detection module 250 is used to mirror input / output at controller 105; train and load suitable trained neural networks to detect malicious activities and related tasks that may occur within the storage device. FIMs 215a to c act as physical and logical interconnects between controller 105 and flash memories 110a to h, thereby allowing the controller to communicate with multiple flash memories simultaneously. Those skilled in the art will recognize that the various memory components described above comprise non-transitory computer-readable media and should be considered to comprise all computer-readable media except for transient propagation signals. Typically, instructions are stored in memory components as code, but may also be wired. Although not shown in the figures, controller 105 also includes a flash translation layer (FTL) for translating LBAs from the host device to Physical Block Addresses (PBAs) of the flash memory. For simplicity, as is known to those skilled in the art, the detailed operation of the FTL is omitted.

[0039] When the host device (not shown) is started and the storage device 100 is assumed to be used as a system device for the host device, its operating system will not be contained in the ROM or RAM of the host device. It will be stored in the storage device 100. Therefore, in order to facilitate the loading of the operating system, the host device will execute the firmware stored in the ROM of the host device, which will send appropriate instructions to the LBA "0" (LBA0) of the storage device 100. After receiving the instruction addressed to its LBA "0", the storage device 100 will send back the data stored at the physical block address corresponding to LBA "0". After the scene is cleared, the logical block address received by the controller 105 of the storage device 100 will be converted into the appropriate physical block address by the FTL provided in the controller 105. However, none of this is found for the host device, and it should be understood that when an instruction is addressed to the LBA of storage device 100, all necessary translations between the LBA and PBA will occur automatically in controller 105.

[0040] Typically, in a system device, the first LBA in the LBA scheme, namely LBA "0", may contain, but is not limited to, the Master Boot Record (MBR), which contains computer-readable code that, when executed by the host device, provides the host device with the ability to read other parts of the operating system program code from the storage device 100 and start the host device. The LBA is a common scheme used to specify the location of data blocks stored within the storage device 100 and to provide the host device with a simple linear addressing method to access the content stored within the storage device 100 without the host device needing to know the physical sector locations or PBAs of the storage device. Therefore, when the host device accesses various partitions, file systems, or any other special areas of the storage device, the LBAs associated with these areas are sent by the host device to the controller 105 of the storage device 100, so that the controller 105 can use this information to retrieve relevant data / information from the host device.

[0041] When the controller 105 receives an LBA and its associated instructions from the host device and transmits the contents of the LBA back to the host device based on the received instructions, the threat detection module 250 is configured to mirror all such contents, and this can be done by recording all inputs and outputs at the controller 105. In other words, the threat detection module 250 can achieve this by recording the instructions received by the controller 105 and the LBAs to which the instructions are directed. The data and / or information provided at these LBAs can then also be recorded by the module 250, and then that data and / or information is sent back to the requesting host device.

[0042] Figure 3 illustrates an exemplary start sector of a file system provided at logical block address "0" (LBA0). As illustrated, the illustrated start sector 300 contains multiple fields with multiple lengths and their individual offsets. Each field will have its own base value that will be associated with a specific meaning or command. These values ​​may include, but are not limited to, hexadecimal or magic numbers that have been generated for each type of operating system / file system / storage system based on each specific meaning / command, and thus, each meaning or command will be associated with a unique value. For example, the value of "EB" may be associated with "bytes per sector", the value of "52" may be associated with "sectors per cluster", the value of "67" may be associated with "OEM ID", the value of "J9" may be associated with "BPB", the value of "34" may be associated with "extended BPB", and so on.

[0043] In this exemplary embodiment of the present invention, the key information contained in data 305 of LBA0 as shown in FIG3 will be of particular interest. For example, it may contain a BIOS parameter block (BPB) and an extended BPB. Those skilled in the art will recognize that this is merely an example and other content at LBA0 may also be used. Based on the information contained in data 305, the following information about the file system of the storage device can be determined: the number of bytes per sector, the number of sectors per cluster, the type of media descriptor, the total number of sectors, the location of the Master File Table (MFT) or its equivalent structure, the location of a copy of the Master File Table, the number of clusters of each MFT record, the number of clusters of each index buffer, the type of file system, the operating system, and the volume number. This information can then be used to determine the operating system of the file system of the storage device, the file system of the storage device, and / or the operation of the file system of the storage device. Those skilled in the art will recognize that, without departing from the present invention, other information may be included in data 305 and the contents of LBA0.

[0044] According to an embodiment of the present invention, a magic number lookup table may be preloaded into cache memory 107 or buffer 210. As known to those skilled in the art, a magic number refers to a constant value generated for a particular piece of information or data. Thus, a magic number can be used to identify a particular file format or protocol or can refer to a unique value that is unlikely to be misinterpreted as having other meanings. In this embodiment of the present invention, each of the magic numbers in the preloaded magic number lookup table refers to a particular type of operating system and / or a type of file system, such as a secondary storage file system. It should be noted that this lookup table may be updated periodically as needed, or whenever a new operating system, secondary storage file system, or other type of file system is introduced. The information in the magic number lookup table may then be matched with the content found at LBA0, and based on the obtained match, module 250 may then determine the type of operating system / file system / storage system associated with the storage device.

[0045] Accordingly, the threat detection module 250 can then use this information to activate a trained neural network contained within the module 250 to detect malicious activity for a specific type of operating system or auxiliary storage operation. This is because each file system will have its own unique list of LBAs containing critical content, information, or data. In embodiments of the present invention, critical content or records include, but are not limited to, data affecting the user of the storage device, data affecting the normal operation of the storage device, and / or any such similar data. In other words, this information can be used by the module 250 to identify LBAs in the file system of the storage device 100 that need to be closely monitored by the trained neural network, wherein these LBAs may be unique for the type of file system installed in the storage device. Additionally, a trained neural network optimized for the identified type of operating system or file system can also be selected and loaded. Once the parameters described above have been initialized, the activated trained neural network can then be used by the module 250 to monitor the storage device 100 to detect malicious activity.

[0046] In embodiments of the present invention, a neural network model is provided within buffer 210 or cache memory 107, and this neural network may include, but is not limited to, artificial neural networks, such as recursive neural networks (RNNs), recurrent neural networks, or convolutional neural networks (CNNs). This neural network model has been pre-trained before it is used to detect malicious activity occurring in the file system of the storage device.

[0047] Specifically, the neural network model will be trained based on the average read / write / overwrite accesses of the contents of the Master Boot Record, Master File Table, Boot Sector, BIOS Parameter Block and / or specific LBA or PBA associated with the file system associated with each type of operating system or secondary storage file system (which is installed in a storage device used for secondary storage operations).

[0048] In other words, the neural network model will be trained based on various input vectors such as the average read / write / overwrite accesses of LBA contents that are typically accessed during operation of various types of operating systems and their corresponding file systems, or during operation of storage devices as auxiliary storage systems. Therefore, any activity deviating from familiar actions can cause the neural network to trigger the marking of the activity as malicious. The marked malicious activities, along with the LBAs accessed by these malicious activities, can also be used to train the neural network, wherein a combination of the above data can be provided to the neural network during the training phase to optimize the training of the neural network.

[0049] In other embodiments of the invention, the trained neural network can be further optimized to utilize malicious activity detected during normal operation of the storage device. This optimization step in operation will greatly improve the efficiency and effectiveness of the neural network.

[0050] In embodiments of the present invention, the average read / write / overwrite access to the contents of the LBA of various operating systems and file systems can be obtained by recording inputs / outputs at the controller of the storage device having various operating systems and file systems over a period of time. The average read / write / overwrite access can also be obtained from third-party resources and can be used to train neural networks.

[0051] Furthermore, since the LBAs accessed for each of the various operating systems, file systems, and secondary storage systems differ between systems, a record can be generated for each of these systems containing critical data. This critical data may include, but is not limited to, the file system's master file table or its equivalent file structure, master boot record, boot sector, user-defined critical areas, security areas, BIOS parameter blocks, or extended BIOS parameter blocks. This record can then be linked to the trained neural network model and stored in cache memory 107 or buffer 210, or alternatively, it can be used as part of the training data provided to train the neural network as described above. Therefore, once the function of the storage device has been identified—that is, whether it is used as a system device or a secondary storage device—the LBA containing critical data for the storage device can then be identified from this record.

[0052] In summary, the neural network will be trained to protect certain areas of the file system and will be trained based on the type of file system implemented on the storage device and the LBA containing critical data. Information used to identify the type of file system can be obtained from the content at the first LBA, i.e., LBA0. However, those skilled in the art will recognize that although relevant content can initially be found at LBA0, for some types of file systems, it can be so large or, due to the structured nature of the information, it can span multiple LBAs, for example, distributed from LBA "0" to LBA "48". In embodiments of the invention, each neural network can be optimized for each type of file system, as the critical LBAs vary between file systems. Thus, the type of trained neural network to be used can depend on the file system of the storage device, and the performance of the trained neural network can be more efficient and effective when a properly trained neural network is selected for use with a suitable file system, and this action can be considered as activating the trained neural network.

[0053] Figure 4 illustrates a program 400 according to an embodiment of the present invention for detecting malicious activity in a storage device communicatively connected to a host device, wherein the program 400 may be implemented in a threat detection module 250 provided within a controller of the storage device. The program 400 begins at step 405, wherein the program 400 copies a first logical block address (LBA) sent from the host device to the controller. The program 400 then continues to retrieve the contents of the first LBA, wherein the retrieved contents are used to activate a trained neural network retrieved from a data module disposed within the controller. When this occurs, a specific neural network optimized for the identified file system / operating system / storage system is loaded and activated.

[0054] Based on the captured content and / or the activated trained neural network, a record containing LBAs (Local Area Blocks) for use with the associated file system is then loaded at step 410. This record is then used to identify the LBAs of the storage device to be monitored by program 400. At step 415, program 400 then mirrors the instructions sent to the LBAs and the content subsequently sent from these LBAs to the host device under monitoring. Program 400 then determines at step 420 whether malicious activity is occurring on the storage device based on the mirrored instructions and content.

[0055] If procedure 400 determines at step 420 that malicious activity is occurring within the storage device, the procedure 400 will then proceed to step 425, where a suitable alarm or warning will be generated or alternatively a lockable storage device. The program 400 then ends. Relatively, if no malicious activity is detected by procedure 400 at step 420, procedure 400 will then end. Whenever the storage device is started, the procedure 400 will then repeat itself such that it will be able to detect any malicious activity that can occur.

[0056] FIG. Procedure 500 begins at step 505 by selecting a set of values ​​or magic numbers from content found at the first LBA (if copied by procedure 400 in step 405) or other LBAs (if the content expands beyond the first LBA). The values ​​or magic numbers of these groups are then compared with the magic number lookup table in the cache memory or buffer preloaded into the storage device. By matching the set of values / magic numbers with the values / magic numbers contained in the magic number lookup table, the procedure 500 is then able to determine the type of the operating system and its file system or the type of the system configuration associated with the file system of the storage device (e.g., auxiliary storage file system). LBAs critical for the identified file system are also identified at this step such that the trained neural network will realize that it must monitor these LBAs. The procedure 500 then proceeds to activate the trained neural network based on this information at step 515, thereby accelerating the detection speed of the trained neural network, which is due to the fact that the trained neural network has been activated for use with a suitable file system.

[0057] Numerous other alterations, substitutions, variations and modifications may be ascertained by those familiar with the technology, and it is intended that the present invention covers all such alterations, substitutions, variations and modifications within the scope of the appended patent applied for. [Brief explanation of the diagram]

[0031] The above and other problems are solved by means of the features and advantages of the systems and methods according to the invention described in embodiments and exhibited in the following diagrams. [Fig [Figure 5] illustrates a flowchart of a procedure or method for activating a trained neural network according to an embodiment of the present invention.

Claims

1. A module for detecting malicious activity in a storage device, wherein the module is disposed within a controller of the storage device, the module being configured to: retrieve a first logical block address (LBA0) sent to the controller from a host device and retrieve content at the first LBA0, wherein the retrieved content is used to activate a trained neural network retrieved from a data module disposed within the controller; use the content at the first LBA0 and the trained neural network to identify a logical block address (LBA) to be monitored in the storage device; and mirror a command sent to the identified LBA to the controller via the host device and mirror the content of the mirrored LBA. The trained neural network is used to determine whether malicious activity is occurring on the storage device based on mirrored instructions and content. The neural network is trained on average read / write / overwrite accesses of the contents of the Master Boot Record, Critical Record, Master File Table, Boot Sector, BIOS Parameter Block, or LBA associated with the file system or extended BIOS Parameter Block associated with the operating system or auxiliary storage operation, and is used for different types of operating systems or auxiliary storage operations.

2. The module of Request 1, wherein activation of the associated trained neural network includes the module being configured to: select a set of magic numbers from the content at the first LBA0, wherein the selected set of magic numbers, together with a magic number lookup table, is used to determine the type of operating system or the type of auxiliary storage operation associated with the file system of the controller, wherein the magic number lookup table is obtained from the data module; and activate the trained neural network to detect malicious activities associated with the determined type of operating system or the determined type of auxiliary storage operation from the data module.

3. The module of claim 2, wherein activating the trained neural network includes the module being configured to select a trained neural network that has been optimized for use with the file system of the controller for the determined type of operating system or the determined type of auxiliary storage operation.

4. The module of request item 1, wherein identifying the LBA to be monitored of the storage device includes the module being configured to: identify an LBA containing critical data based on a determined type of operating system or auxiliary storage operation associated with the activated trained neural network, wherein the critical data includes at least the master file table, master boot record, boot sector, BIOS parameter block or extended BIOS parameter block of the file system associated with the storage device.

5. The module of claim 1, wherein the module is further configured to: optimize the trained neural network using malicious activity determined to have occurred at the storage device based on the mirrored instructions and content.

6. The module of request item 1 or 5, wherein the module is further configured to: lock the storage device in response to a determination based on the mirrored instructions and content that malicious activity has occurred on the storage device.

7. The module of claim 1, wherein the trained neural network includes an artificial neural network.

8. The module of claim 7, wherein the artificial neural network comprises a recursive neural network (RNN) or a convolutional neural network (CNN).

9. A method for detecting malicious activity in a storage device, comprising the steps of: retrieving a first logical block address (LBA0) from a host device and transmitted to the controller using a module disposed in a controller of the storage device; retrieving content at the first LBA0 using the module, wherein the retrieved content is used to activate a trained neural network retrieved from a data module disposed in the controller; and using the content at the first LBA0 and the trained neural network to identify a logical block address (LBA) to be monitored in the storage device using the module. The module uses the host device to mirror commands sent to the identified LBA to the controller and mirror the contents of the mirrored LBA; and uses a trained neural network to determine whether malicious activity is occurring on the storage device based on the mirrored commands and contents, wherein the neural network is trained on average read / write / overwrite accesses of the contents of the LBA associated with the file system or auxiliary storage operation, such as the master boot record, critical record, master file table, boot sector, BIOS parameter block, or extended BIOS parameter block, for different types of operating systems or auxiliary storage operations.

10. The method of claim 9, wherein activation of the associated trained neural network comprises the following steps: selecting a set of magic numbers from the contents of the first LBA0 using the module, wherein the selected set of magic numbers, together with a magic number lookup table, is used to determine the type of operating system or the type of auxiliary storage operation associated with the file system of the controller, wherein the magic number lookup table is obtained from the data module; and activating the trained neural network using the module to detect malicious activities associated with the determined type of operating system or the determined type of auxiliary storage operation from the data module.

11. The method of claim 10, wherein activating the trained neural network comprises the steps of: selecting a trained neural network that has been optimized for use with the determined type of operating system or the determined type of auxiliary storage operation associated with the file system of the controller.

12. The method of claim 9, wherein identifying the LBA to be monitored of the storage device comprises the following steps: using the module to identify the LBA containing critical data based on a determination type of one of the operating system or auxiliary storage operations associated with the activated trained neural network, wherein the critical data includes at least the master file table, master boot record, boot sector, BIOS parameter block or extended BIOS parameter block of the file system associated with the storage device.

13. The method of claim 9, wherein the method further comprises the step of: optimizing the trained neural network using the module based on malicious activity determined to have occurred at the storage device by the mirrored instructions and content.

14. The method of claim 9 or 13, wherein the method further comprises the following steps: using the module in response to a determination based on the mirrored instructions and content that malicious activity has occurred on the storage device, thereby locking the storage device.

15. The method of claim 9, wherein the trained neural network comprises an artificial neural network.

16. The method of claim 15, wherein the artificial neural network comprises a recursive neural network (RNN) or a convolutional neural network (CNN).

Images