Decoy Dataset Placement for Early Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber-attack detection techniques in datacenters fail to detect ransomware attacks until data is compromised, allowing infections to spread from a single host server to storage arrays, affecting multiple host application instances.
Innovation Solution
Deploy decoy datasets on storage objects, detect cyber-attacks through suspicious IO commands accessing decoy data, and automatically protect real data by initiating actions such as generating snapshots and locking down affected storage objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing cyber-attack detection techniques are used, then the system can operate with standard security measures, but attacks are not detected until data is compromised
Solution Approach 1:
The system performs preliminary actions by deploying decoy datasets on storage objects before actual attacks occur. These decoy datasets are positioned at known locations and monitored for access, enabling the system to detect attacks at their earliest stages rather than waiting for data compromise. The decoy datasets serve as预先布置的 detection traps that activate the detection mechanism upon any unauthorized access attempt.
2Reliability
If decoy datasets are deployed on storage objects, then the likelihood of detecting cyber-attacks before real data is compromised increases, but the system complexity increases
Solution Approach 1:
The system uses copying by creating decoy datasets that replicate the structure and location characteristics of real data without containing sensitive information. These copies are deployed on storage objects to mimic legitimate data access patterns, allowing the detection system to monitor for suspicious activity against the decoys while the actual real data remains protected. The copies serve as safe surrogates for detection purposes.
3Reliability
If automated protection actions are performed in response to detection, then real data is protected more quickly, but the automation extent increases
Solution Approach 1:
The system implements feedback by continuously monitoring access patterns to decoy datasets and automatically responding to detected anomalies. When suspicious access patterns are identified - such as attempts to read or write to decoy dataset locations - the system triggers automated protection actions including isolating affected storage objects, alerting security personnel, or initiating data protection protocols. This closed-loop feedback mechanism enables rapid response without manual intervention.
Data Source
AI summary
A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.