Stable Data Storage Monitoring for Malicious IO Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems lack effective methods to detect and prevent malicious attacks that target stable data, such as ransomware encryption or data theft, by monitoring host server input-output (IO) access to storage objects.
Innovation Solution
Implementing a host server stable data access activity monitor to identify and create stable data storage objects, monitor IO access, and trigger an alert or response upon detecting suspicious writes or large-scale reads to these objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a monitor tracks all IO access to all storage objects, then detection coverage is comprehensive, but false alarms increase and system complexity increases
Solution Approach 1:
The patent segments storage objects into two distinct categories: stable data storage objects (containing immutable data like snapshots and backups) and dynamic data storage objects (containing frequently changing data). The monitoring system then applies different monitoring strategies to each segment, tracking all IO access to stable objects while using threshold-based monitoring for dynamic objects. This segmentation reduces false alarms by recognizing that writes to stable objects are inherently suspicious, while eliminating the need to monitor every IO to dynamic objects, thereby reducing system complexity.
2Reliability
If monitoring is applied to all storage objects, then detection coverage is complete, but false alarms increase
Solution Approach 1:
The patent applies local quality by implementing location-specific monitoring policies based on the storage object's characteristics. Stable data storage objects receive intensive monitoring where any write operation triggers an alert, while dynamic data storage objects receive lighter monitoring using configurable thresholds. This local quality approach ensures high detection accuracy for stable objects without generating false alarms from expected write operations to dynamic objects, thereby resolving the contradiction between complete detection coverage and false alarm reduction.
3Measurement precision
If stable data is segregated for targeted monitoring, then detection precision improves, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-classifying storage objects as stable or dynamic based on their data characteristics and access patterns before monitoring begins. This pre-classification is performed using metadata analysis and historical access pattern evaluation. Once classified, stable data storage objects are automatically placed under intensive monitoring while dynamic objects receive standard monitoring. This preliminary action eliminates the need for complex real-time analysis during monitoring operations, thereby improving detection precision without significantly increasing device complexity.
Data Source
AI summary
Cyber-attacks on data maintained by a storage node are detected by monitoring for suspicious IOs to storage objects that contain only stable data. Data may be inherently stable or become stable based on elapsed time since the most recent update. Suspicious IOs to stable data storage objects include WR IOs that update stable data and, potentially, large-scale RD IOs. Metadata associated with storage objects is scanned to identify stable data storage objects and monitor for suspicious IOs. Further, stable data storage objects can be created by separating stable data from dynamic data, e.g., moving old data to a storage object that contains only old data. Exceptions are made for WR IOs that update metadata when processing small-scale RDs.