Snapshot Deletion Pattern Detection for Ransomware in Storage Recovery

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing storage systems face inefficiencies in data management and reliability due to unnecessary write operations and lack of centralized control over storage processes, particularly in flash storage systems, leading to reduced reliability and increased wear on storage devices.

Innovation Solution

Implementing a direct-mapped flash storage system where higher-level operating systems manage data allocation and storage processes without involving lower-level storage controllers, utilizing non-volatile RAM for quick data buffering and proactive data management to ensure data integrity and reduce unnecessary writes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If storage controllers manage data allocation and storage processes, then storage device control is maintained, but device complexity increases and reliability decreases due to unnecessary write operations

Engineering Contradiction:

Improvestorage system reliabilityVSAvoidstorage controller complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the data allocation and storage management functions from the storage controller and relocates them to the operating system. The storage controller is reduced to performing only basic I/O operations, while the OS handles snapshot creation, deletion, and data management. This extraction reduces storage controller complexity and eliminates redundant write operations, thereby improving reliability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent inverts the traditional storage management hierarchy by having the operating system (higher-level software) perform management functions that were traditionally handled by storage controllers (lower-level hardware). This inversion allows the OS to make intelligent decisions about data allocation and snapshot management, reducing unnecessary writes to storage devices and improving overall system reliability.

Inventive Principle:

Principle #13The other way round (Inversion)

2Duration of action of stationary object

If traditional storage systems perform write operations for data management, then data allocation is maintained, but storage device wear increases and lifespan decreases

Engineering Contradiction:

Improvestorage device lifespanVSAvoidstorage device wear

Core Design Contradiction:

Duration of action of stationary objectVSObject-generated harmful factors

Solution Approach 1:

The patent implements preliminary action by creating snapshots in volatile memory (RAM) before actual storage operations. This allows the system to prepare and organize data in memory, perform necessary operations, and then write to storage only when changes are finalized. This preliminary action in RAM prevents unnecessary write operations to flash storage, reducing wear and extending device lifespan.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces volatile memory (RAM) as an intermediary between the operating system and flash storage devices. This intermediary layer allows data to be buffered, managed, and prepared before being written to flash storage. By using RAM as a mediator, the system minimizes direct write operations to flash storage, thereby reducing wear and extending the storage devices' operational life.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If storage systems use conventional data management approaches, then basic storage operations are performed, but data integrity is compromised during power failures

Engineering Contradiction:

Improvedata integrityVSAvoidpower failure impact

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent implements beforehand cushioning by maintaining snapshots of data in volatile memory (RAM) before power failures can occur. These in-memory snapshots serve as a protective buffer that preserves data state information. In the event of a power failure, this pre-established cushioning in RAM protects against data corruption, as the system can recover the snapshot state without losing integrity.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

4Productivity

If lower-level storage controllers handle all storage processes, then storage device control is maintained, but data management efficiency decreases

Engineering Contradiction:

Improvedata management efficiencyVSAvoidstorage system architecture

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent applies universality by enabling the operating system to perform multiple storage management functions that were previously handled exclusively by storage controllers. The OS now handles snapshot creation, deletion, data allocation, and coordination of storage operations. This multi-functionality in the OS layer improves data management efficiency by making more intelligent decisions, while the storage controller focuses on executing I/O operations.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentEP4523110B1Snapshot deletion pattern-based determination of ransomware attack against data maintained by a storage system

Publication Date: 2026.04.15 PURE STORAGE INC

Figure 1A
Figure 1B
Figure 1C

AI summary

An exemplary method includes a data protection system detecting one or more delete requests to delete one or more recovery datasets of a storage system, determining that the one or more delete requests are inconsistent with a recovery dataset deletion pattern associated with the storage system, and determining, based on the determining that the one or more delete requests are inconsistent with the recovery dataset deletion pattern, that data stored by the storage system is possibly being targeted by a security threat.