Real Time Intrusion Detection for Storage Volume Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems lack effective real-time intrusion detection mechanisms to protect storage volumes from unauthorized access, which can lead to malicious activities such as data theft or corruption.
Innovation Solution
Implementing a Real-Time Intrusion Detection (RTID) system that defines an Atypical Access Rate Detection (AARD) policy to monitor storage volume accesses. The RTID application on the host computer works in conjunction with an AARD application on the storage system to detect and respond to unauthorized access attempts by blocking IO operations and notifying the RTID application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection methods are used, then system security is improved, but real-time detection capability deteriorates due to delayed detection and response
Solution Approach 1:
The system pre-defines AARD policies with access rate thresholds and patterns before monitoring begins. The AARD application on the storage system is pre-configured to recognize atypical access patterns, enabling immediate detection and response to intrusions without waiting for post-event analysis.
Solution Approach 2:
The patent introduces an intermediary AARD application layer between the storage system and the RTID application. This intermediary continuously monitors storage volume accesses and immediately notifies the RTID application of atypical access patterns, enabling real-time detection without requiring the RTID application to continuously poll or analyze all access events.
2Measurement precision
If comprehensive monitoring of all storage volume accesses is implemented, then detection accuracy is improved, but system complexity and processing overhead increase
Solution Approach 1:
The AARD policy applies different monitoring parameters and thresholds to different storage volumes or data regions. Instead of uniform monitoring across all storage, the system tailors access rate thresholds and atypical patterns to specific volumes, improving detection accuracy for critical areas while reducing processing overhead for less sensitive areas.
Solution Approach 2:
The system dynamically adjusts monitoring parameters such as access rate thresholds and time windows based on the AARD policy. The AARD application compares actual access rates against configurable thresholds and adapts its monitoring intensity, maintaining high detection accuracy while managing system complexity through parameterized control.
3Speed
If the RTID application continuously monitors and analyzes all storage accesses, then real-time detection capability is improved, but processing overhead and response time increase
Solution Approach 1:
The AARD application on the storage system performs preliminary filtering and analysis of access patterns before notifying the RTID application. By pre-identifying atypical access patterns and only notifying the RTID application of suspicious events, the system avoids the overhead of continuous analysis while maintaining real-time response capability.
Solution Approach 2:
The AARD application autonomously monitors storage volume accesses and self-manages the detection process by comparing accesses against the AARD policy. It independently identifies atypical patterns and generates notifications, reducing the processing burden on the RTID application and enabling efficient real-time detection with minimal energy overhead.
Data Source
AI summary
Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.