Host Agent-Assisted Malicious Access Detection in Storage Arrays
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems lack effective mechanisms to detect malicious access activity targeting specific host applications, as they operate unaware of data structures and rely solely on block-based storage, making it difficult to differentiate between normal and malicious input-output operations.
Innovation Solution
A storage array receives host application awareness information and observes input-output operations to feed these insights into a host application-specific model, predicting and detecting malicious access activity by training on historic data using machine learning algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If block-based storage operations are used, then storage system simplicity is maintained, but ability to detect malicious access activity deteriorates
Solution Approach 1:
The patent introduces host agents as intermediary components that run on host servers and collect application-aware information about storage operations. These agents serve as mediators between the block-based storage system and the detection model, providing contextual information about application intent and operation legitimacy without requiring changes to the core storage system architecture.
Solution Approach 2:
The patent replaces traditional rule-based or signature-based detection mechanisms with a machine learning detection model. This model analyzes patterns in storage operations using application-aware information and IO characteristics to identify malicious access, substituting mechanical detection rules with intelligent pattern recognition that adapts to different attack scenarios.
2Measurement precision
If application-aware information is collected and analyzed, then malicious access detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the detection system into distinct modular components: host agents that collect application-aware information, a detection model that processes this information along with IO characteristics, and a storage array that executes operations. This segmentation allows each component to perform its specific function independently, managing complexity through modular design while maintaining high detection accuracy.
3Reliability
If host application awareness information is integrated, then false positives are reduced, but information processing requirements increase
Solution Approach 1:
The patent implements preliminary action by having host agents continuously collect and provide application-aware information about storage operations before the detection model needs to make decisions. This pre-collected contextual information about application intent and operation patterns allows the detection model to quickly evaluate operations with reduced processing requirements and higher accuracy, avoiding false positives.
Data Source
AI summary
Host agents running on host servers provide current and historic host application awareness information to a storage array. The storage array uses the historic host application awareness information to train a host application-specific model of IO characteristics. The current host application awareness information and observed IO characteristics are used as inputs to the model to detect malicious activity. The current and historic host application awareness information includes host application roles such as normal operation, creation of a remote backup, cloning of the storage object, snapping of the storage object, restoring the storage object from a snapshot, scanning a database in the storage object, and scanning the storage object.