Storage Deduplication for Compression-Free Ransomware Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing storage systems face significant performance degradation due to the need for continuous compression processing to detect ransomware, which encrypts files and causes data loss, necessitating a more efficient method to identify such malicious programs without compromising system performance.

Innovation Solution

A storage system that deduplicates data and calculates a duplication rate before and after updates, detecting a decrease in duplication rate exceeding a threshold to identify potential ransomware attacks, thereby avoiding the need for compression processing.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If compression processing is executed to detect ransomware, then detection capability is improved, but storage system performance significantly decreases

Engineering Contradiction:

Improveransomware detection capabilityVSAvoidstorage system performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The invention extracts the essential detection function from the compression processing step. Instead of requiring full compression to detect ransomware, the system extracts and analyzes only the duplication rate metric from the data structure, which is sufficient to identify malicious modifications without executing the complete compression algorithm.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The invention uses a lightweight, disposable detection mechanism based on duplication rate calculation rather than expensive compression processing. This cheap short-living check provides sufficient detection capability while minimizing computational overhead and performance impact on the storage system.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

2Measurement precision

If compression processing is executed for every data update, then detection accuracy is improved, but processing time increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The invention applies partial action by calculating only the duplication rate metric rather than executing full compression processing. This partial check provides sufficient detection accuracy for ransomware identification while significantly reducing the processing time required for each data update operation.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system performs preliminary duplication rate calculation as a lightweight pre-check before any compression processing would be executed. This preliminary action filters out obvious ransomware cases quickly, and only full compression would be needed for suspected cases, thereby reducing overall processing time.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS12613963B2Storage system and malicious program detection method

Publication Date: 2026.04.28 HITACHI VANTARA LTD

AI summary

Provided is a storage system capable of detecting a malicious program without executing compression processing of data. A storage system includes a processor that processes data input to and output from a storage device. The processor operates thereon a duplication detection program which deduplicates duplicated data, stores the deduplicated data in the storage device, calculates a duplication rate being a ratio of duplicated data in a predetermined unit of storage, and detects a change between a duplication rate before an update of the data and a duplication rate after the update of the data in units of the predetermined unit of storage. Moreover, the processor operates thereon a ransomware detection program which detects that the data is updated by ransomware, when a decrease amount of the duplication rate exceeds a duplication rate threshold value relating to the change in duplication rate detected by the duplication detection program.