Storage IO Pattern Analysis for Real-Time Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional ransomware detection methods focus on host-level analysis, which is inadequate for enterprise storage systems lacking direct access to execution information, leading to delayed postmortem detection and increased damage.
Innovation Solution
A machine learning-based approach that analyzes input/output (IO) requests on storage systems to generate features like overwrite, sequential read/write percentages, and IOPS, using a supervised classification model for real-time ransomware detection on file and block storage devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If host-level detection methods are used, then detection capability is available, but storage systems lack direct access to execution information leading to delayed detection
Solution Approach 1:
The patent introduces an intermediary detection mechanism at the storage system level that monitors IO requests between the host and storage device. This intermediary approach allows the storage system to detect ransomware attacks independently without relying on host-level execution information, thereby eliminating detection delays while maintaining high accuracy through direct observation of suspicious IO patterns characteristic of ransomware behavior.
2Measurement precision
If storage system monitors IO requests and generates multiple IO features for analysis, then detection accuracy improves, but computational complexity and processing overhead increase
Solution Approach 1:
The patent extracts and monitors only the most critical IO features that are indicative of ransomware attacks, such as overwrite percentage, sequential read/write patterns, and IOPS metrics. By selectively extracting these key features rather than analyzing all possible IO parameters, the system achieves high detection accuracy while minimizing computational complexity and processing overhead.
3Adaptability or versatility
If machine learning model is trained on multiple ransomware variants for multi-class classification, then detection coverage improves, but model overfitting risk increases
Solution Approach 1:
The patent focuses on detecting a limited set of dominant IO patterns that are common across multiple ransomware variants, rather than attempting to learn every possible variant-specific behavior. By concentrating on these partial but critical patterns (such as high overwrite percentages and sequential access patterns), the model achieves broad detection coverage across different ransomware types while avoiding overfitting to specific variant characteristics.
Data Source
AI summary
A method, computer program product, and computing system for processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system. A plurality of IO features may be generated using the plurality of IO requests including one or more of: a percentage of overwrite IO requests, a percentage of sequential read IO requests, and a percentage of sequential write IO requests. The plurality of IO features may be processed using a machine learning model. A ransomware attack may be monitored for on the storage system in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.