Storage IO Machine Learning for Real-Time Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional ransomware detection methods focus on host-level analysis, which is inadequate for enterprise storage systems lacking direct access to execution information, leading to delayed postmortem detection and increased risk of damage.
Innovation Solution
A machine learning-based approach that processes input/output (IO) requests to generate features for real-time detection of ransomware attacks on storage systems, using supervised classification models to differentiate between benign and malicious workloads, and mitigate class imbalance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional host-level detection methods are used, then detection capability is limited to host execution information, but storage systems lack direct access to execution information leading to delayed detection
Solution Approach 1:
The patent introduces an intermediary detection mechanism at the storage system level that observes IO request patterns as a mediator between the ransomware execution on host and the actual data encryption. This intermediary approach enables the storage system to detect ransomware attacks based on characteristic IO patterns (such as sequential write patterns) without needing direct access to host execution information, thereby resolving the detection delay while maintaining reliability
Solution Approach 2:
Instead of detecting ransomware at the host level where execution information is available, the patent inverts the detection approach by observing the attack's impact on the storage system through IO requests. This inversion enables detection at the storage level, providing earlier warning before data is permanently encrypted, thus reducing detection delay while maintaining accuracy
2Speed
If storage systems monitor IO requests in real-time, then detection speed improves, but system complexity and processing overhead increase
Solution Approach 1:
The patent extracts only the critical features from IO requests that are indicative of ransomware attacks, such as the sequence of IO operations, access patterns, and metadata characteristics. By taking out and focusing only on these specific features rather than analyzing all IO request details, the system achieves real-time detection speed while keeping processing complexity manageable
Solution Approach 2:
The patent applies partial action by monitoring only specific IO patterns that are characteristic of ransomware attacks rather than analyzing all possible IO operations in detail. This selective monitoring approach enables real-time detection while reducing the overall processing load and system complexity, as the system focuses resources on the most indicative attack signatures
3Measurement precision
If multiple ransomware variants are detected, then detection precision improves, but false positives increase leading to false alarms
Solution Approach 1:
The patent applies local quality by creating variant-specific detection profiles that capture the unique IO patterns characteristic of each ransomware variant. Instead of using a single generic detection rule, the system tailors the detection criteria to match the specific behavior of different ransomware families, thereby improving detection precision while reducing false positives through localized, targeted pattern matching
Solution Approach 2:
The patent changes detection parameters dynamically based on the observed IO patterns and compares them against known ransomware variant profiles. By adjusting detection thresholds and pattern matching criteria according to the specific characteristics of different ransomware variants, the system achieves high detection precision while minimizing false alarms through adaptive parameter tuning
4Reliability
If comprehensive IO feature analysis is performed, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The patent segments the IO feature analysis into distinct processing stages: initial pattern matching, feature extraction, and detailed analysis. By segmenting the analysis process, the system performs only the necessary level of analysis for each IO request, achieving comprehensive detection accuracy where needed while reducing computational resource consumption for routine operations
Solution Approach 2:
The patent performs preliminary action by pre-processing and indexing IO request patterns during normal operations, building baseline profiles of legitimate access patterns. This preliminary analysis enables the system to quickly compare incoming IO requests against established patterns, achieving high detection accuracy while minimizing real-time computational resources by relying on pre-computed reference data
Data Source
AI summary
A method, computer program product, and computing system for processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system. A plurality of IO features are generated using the plurality of IO requests. The plurality of IO features are processed using a machine learning model. A ransomware attack on the storage system may be monitored for in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.