Intelligent Snapshot Protection via Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data management systems face challenges in protecting computing snapshots from undesired deletion due to user errors or malicious actions, leading to potential loss of critical data and increased storage costs from retaining all snapshots beyond expiration.
Innovation Solution
Implementing heuristic analysis within the data management system to determine whether a snapshot deletion is anomalous, allowing for selective retention of potentially unintended deletions and deletion of non-anomalous ones, thereby balancing snapshot protection and storage costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all snapshots are retained beyond expiration to protect from undesired deletion, then reliability is improved, but storage costs increase
Solution Approach 1:
The system changes the retention parameter dynamically based on anomaly detection results. Normal snapshots are deleted at expiration to control storage costs, while anomalous snapshots are retained beyond expiration to ensure reliability. This parameter change resolves the contradiction by making retention selective rather than universal.
Solution Approach 2:
Anomaly detection mechanisms serve as an intermediary between snapshot expiration and deletion. The system introduces detection of deletion events, user behavior analysis, and risk assessment as intermediate steps to determine whether to retain or delete snapshots. This intermediary layer enables intelligent decision-making that balances reliability and storage costs.
2Reliability
If heuristic analysis is implemented to detect anomalous deletions, then snapshot protection is improved, but device complexity increases
Solution Approach 1:
The system segments the snapshot management process into distinct phases: normal expiration handling, anomaly detection, user behavior analysis, and conditional retention. By dividing the complex heuristic analysis into modular segments, the system achieves improved protection while managing complexity through organized, manageable components.
Solution Approach 2:
The system implements self-service through automated anomaly detection and risk assessment mechanisms that operate without constant human intervention. The heuristic analysis automatically evaluates deletion events, analyzes user behavior patterns, and makes retention decisions, reducing the operational complexity while maintaining high reliability.
3Reliability
If snapshots are retained beyond expiration, then reliability is improved, but storage space increases
Solution Approach 1:
The system applies local quality by providing different retention treatments to different snapshots based on their anomaly status. Anomalous snapshots receive extended retention for protection, while normal snapshots are deleted at expiration. This localized approach ensures reliability for critical snapshots while minimizing overall storage space consumption.
Solution Approach 2:
The system discards normal snapshots at expiration to free storage space, while recovering and retaining anomalous snapshots that require protection. This selective discarding and recovering mechanism optimizes storage space utilization while maintaining reliability for snapshots that need protection against undesired deletion.
Data Source
AI summary
A data management system (DMS) may support intelligent snapshot protection techniques. For example, the DMS may backup a computing system and facilitate that capture and storage of snapshots of the computing system. The DMS may identify a deletion event associated with one or more of the snapshots, the deletion event being associated with the one or more snapshots being deleted at a first time. The DMS may determine that deletion event is anomalous and retain the one or more snapshots beyond the first time. For example, the DMS may determine that one or more parameters associated with the deletion event are indicative of the deletion event being anomalous. In response, the DMS may retain the one or more snapshots for a retention period beyond the first time.