Remote R2 Storage Array for Asynchronous Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems lack effective methods to detect ransomware activity without compromising the primary storage array's performance, which is crucial for maintaining high IOPS and response time.
Innovation Solution
Implementing a remote R2 storage array on an asynchronous remote data replication facility, where data from a primary R1 storage array is replicated and analyzed for ransomware activity, allowing for detection and protection without using the primary array's CPU resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware detection is implemented on the primary storage array, then ransomware detection capability is improved, but the primary storage array's IOPS and response time deteriorate due to CPU resource consumption
Solution Approach 1:
The ransomware detection function is extracted from the primary storage array and relocated to a separate remote storage array. The primary array continues to handle normal storage operations without the overhead of ransomware detection processing, while the remote array performs specialized analysis on replicated data, thereby resolving the conflict between detection capability and operational performance
Solution Approach 2:
An asynchronous remote data replication facility serves as an intermediary between the primary storage array and the analysis system. Data is replicated to the remote array where ransomware detection is performed, allowing the primary array to maintain high performance while still enabling comprehensive security monitoring through the intermediary replication mechanism
2Reliability
If real-time ransomware analysis is performed on incoming data, then data protection is improved, but processing time and system complexity increase
Solution Approach 1:
Data is replicated to the remote storage array in advance of needing it for analysis. The asynchronous replication process prepares data ahead of time, so when ransomware detection is needed, the analysis can be performed on pre-positioned data rather than requiring real-time processing of incoming data streams, thereby reducing processing time delays
Data Source
AI summary
Ransomware activity detection and data protection is implemented by a remote R2 storage array on an asynchronous remote data replication facility, on which data from a primary R1 storage array is replicated to the remote storage array. Write operations on storage volumes in a remote data replication group are collected in a capture cycle on the primary storage array, along with IO pattern metadata describing both read and write operations on the storage volumes. At the end of the capture cycle, the update and metadata is transmitted to the remote storage array. The remote storage array receives the update and metadata and temporarily stores the update prior to applying it to its copy of the storage volumes. Ransomware anomaly detection is implemented using the update and metadata, and if ransomware activity is detected, the data on the remote R2 storage array is protected, and the update is not applied.