Machine Learning IO Monitoring for Storage System Ransomware Detection

The patent introduces storage system IO requests as an intermediary to detect ransomware attacks. Instead of relying on host-level execution information, the storage system monitors IO requests from hosts, analyzing patterns such as sequential write operations and rapid data modification. This intermediary approach enables detection of storage-targeted ransomware attacks without requiring direct access to host execution contexts.

The patent inverts the traditional detection approach by moving the detection capability from the host level to the storage system level. Rather than having the host detect and report ransomware activity, the storage system independently analyzes IO requests to identify ransomware behavior patterns, effectively reversing where the detection intelligence resides.

The patent transforms complex security analysis into simpler parameter monitoring by focusing on specific IO request characteristics. Instead of analyzing full IO request content, the system monitors parameters such as operation type (read/write), access patterns (sequential/random), frequency, and data modification rates. This parameter-based approach simplifies the monitoring complexity while maintaining detection accuracy.

The patent segments the IO request monitoring into distinct analytical components: identifying sequential write patterns, detecting rapid data modification, analyzing access frequency, and evaluating data characteristics. This segmentation allows each aspect to be monitored independently using simple rules, reducing overall system complexity compared to holistic analysis.

The patent applies partial monitoring by focusing only on specific IO request patterns that indicate ransomware activity, rather than analyzing all IO requests in detail. The system monitors for particular behaviors such as sequential writes and rapid modifications, applying full analytical resources only when suspicious patterns are detected, thus reducing overall computational consumption while maintaining real-time detection capability.

The patent replaces complex computational analysis with simpler rule-based detection mechanisms. Instead of using resource-intensive machine learning models or deep inspection algorithms, the system uses predetermined rules to evaluate IO request patterns, such as checking if write operations follow sequential patterns or if data modification exceeds thresholds. This substitution significantly reduces computational resource requirements.