Grouped ransomware detection in data storage systems
By clustering data volumes into multi-dimensional vectors and using AI models, the method efficiently detects ransomware with reduced computational overhead, addressing the challenge of rising data volumes in storage systems.
WO2026131200A1PCT designated stage Publication Date: 2026-06-25INTERNATIONAL BUSINESS MACHINE CORPORATION +1
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- INTERNATIONAL BUSINESS MACHINE CORPORATION
- Filing Date
- 2025-12-05
- Publication Date
- 2026-06-25
AI Technical Summary
Technical Problem
Conventional systems struggle to efficiently detect ransomware attacks in data storage systems due to increasing computational overhead as the amount of data stored rises, making it difficult to identify ransomware activity amidst legitimate operations.
Method used
The method represents data volumes as multi-dimensional vectors, clusters similar volumes together, and uses AI-based models to track and detect ransomware in these clusters, reducing computational overhead by evaluating subsets of data in parallel and real-time.
Benefits of technology
This approach allows for accurate and efficient ransomware detection with reduced computational load, maintaining an updated understanding of stored data and identifying threats at the same speed as data input/output processing.
✦ Generated by Eureka AI based on patent content.
Smart Images
Figure EP2025085667_25062026_PF_FP_ABST
Abstract
A method, in one approach, includes: representing a set of volumes in a storage system as vectors of characteristics in a multi-dimensional vector space. The vectors are used to identify subsets of the volumes having similar characteristics. Moreover, the subsets of volumes are clustered into respective common groups of volumes. The common groups of volumes are further identified in the multi-dimensional vector space. The method also includes tracking, in the multi-dimensional vector space, the similar characteristics of the respective common groups of volumes. Furthermore, ransomware detection is performed on the common groups of volumes.
Need to check novelty before this filing date? Find Prior Art