Snapshot Anomaly Detection for Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face challenges in detecting malicious attacks in a timely manner, often requiring restoration to a significantly earlier point in time, which can be disruptive and inefficient.
Innovation Solution
The method involves identifying a storage object, computing a profile of characteristics of a normal snapshot, creating a new snapshot, identifying its characteristics, and comparing them with the profile to detect anomalies indicative of malicious attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If foreground monitoring of IOs is performed to detect malicious attacks, then early detection capability is improved, but system performance deteriorates
Solution Approach 1:
The patent extracts the monitoring function from foreground IO processing and implements it in the background using snapshots. The malicious activity detection module operates independently on snapshot data without interfering with foreground IO operations, thus maintaining system performance while achieving early detection of malicious attacks.
Solution Approach 2:
The patent introduces snapshots as an intermediary between the storage system and the detection mechanism. Instead of directly monitoring IOs, the system creates snapshots that capture storage object states, and the detection module analyzes these snapshots to identify malicious activities, thereby decoupling detection from performance-critical IO paths.
2Measurement precision
If IO-level granularity monitoring is used, then detection detail is improved, but detection scope is limited
Solution Approach 1:
The patent transitions from monitoring at the IO level to monitoring at the snapshot level, adding a temporal dimension to detection. Snapshots provide point-in-time snapshots of storage objects, enabling detection of patterns across multiple time points while maintaining the ability to analyze detailed characteristics within each snapshot.
Solution Approach 2:
The snapshot-based detection mechanism serves multiple functions: it can detect various types of malicious activities (ransomware, data overwriting, data theft), supports different storage object types, and provides both detailed anomaly detection and broad attack pattern recognition, thereby achieving versatile detection scope.
3Reliability
If restoration to earlier point in time is performed after attack detection, then data recovery is achieved, but operational disruption increases
Solution Approach 1:
The system performs preliminary actions by continuously creating snapshots and pre-computing their characteristics before malicious attacks occur. When an attack is detected, the system can immediately restore to a recent pre-attack snapshot state, minimizing operational disruption because the restoration target is already prepared and verified.
Solution Approach 2:
The patent implements feedback by continuously monitoring snapshot characteristics and comparing them against learned normal patterns. When anomalies indicating malicious activity are detected, the system provides feedback to trigger restoration operations, enabling proactive recovery before significant damage occurs and reducing overall operational disruption.
Data Source
AI summary
A profile of characteristics of a normal snapshot of a storage object is computed from previous snapshots of the storage object. Characteristics of a new snapshot are compared with the characteristics in the profile to identify an anomaly indicative of a malicious attack. The characteristics include percent data changed between consecutive snapshots, write LBA dispersion, write data reducibility, number and size of writes, write workload profile, and write content profile. The new snapshot is only vaulted or air-gapped if all its characteristics are within ranges defined by the profile.