Storage Snapshot Defense Against Suspicious IO Data Damage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data restoration methods in storage devices are inadequate in restoring data completely due to the inability to capture changes made during virus attacks, leading to incomplete data recovery.
Innovation Solution
A data protection method that identifies suspicious IO sequences initiated by potentially malicious hosts, generates a defense mechanism to prevent further access, and creates a snapshot at the time of detection to minimize data loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a snapshot is generated periodically at fixed intervals, then the storage device can restore data to a previous state, but data changes made between snapshot intervals cannot be restored, leading to incomplete data recovery
Solution Approach 1:
The system performs preliminary detection of IO sequences to identify suspicious patterns before data damage occurs. When a suspicious IO sequence is detected, the system proactively generates a snapshot at that moment, rather than waiting for the next scheduled snapshot interval. This preliminary action captures the data state at the precise moment of potential compromise, eliminating the time window for data loss between periodic snapshots.
Solution Approach 2:
The system continuously monitors IO sequences and uses feedback from the detection results to dynamically adjust snapshot generation timing. When suspicious IO sequences are detected, the system triggers an immediate snapshot, creating a feedback loop where detection results directly influence restoration actions. This ensures snapshots are generated at the most critical moments rather than at fixed intervals.
2Reliability
If the storage device generates a snapshot immediately upon detecting suspicious IO sequences, then data restoration completeness is improved, but the complexity of the storage device increases due to real-time monitoring and dynamic snapshot generation
Solution Approach 1:
The storage device is divided into functional modules: an IO sequence detection module that analyzes access patterns, a snapshot generation module that creates data copies, and a restoration module that recovers data. This segmentation allows each module to specialize in its function, making the overall system more manageable despite the increased complexity. The detection module focuses on pattern recognition, while the snapshot module handles data copying, and the restoration module manages recovery operations.
Solution Approach 2:
The storage device performs self-monitoring of its own IO sequences and automatically generates snapshots when suspicious patterns are detected, without requiring external intervention. The system services itself by detecting its own potential vulnerabilities and taking protective actions autonomously. This self-service capability reduces the need for complex external monitoring systems while maintaining high restoration completeness.
3Device complexity
If periodic snapshots are used for data protection, then the storage device structure remains simple, but data changes made between snapshot intervals cannot be restored, resulting in data loss
Solution Approach 1:
The system performs preliminary detection of IO sequences to identify suspicious patterns before data damage occurs. When a suspicious IO sequence is detected, the system proactively generates a snapshot at that moment, rather than waiting for the next scheduled snapshot interval. This preliminary action captures the data state at the precise moment of potential compromise, eliminating the time window for data loss between periodic snapshots.
Solution Approach 2:
The system continuously monitors IO sequences and uses feedback from the detection results to dynamically adjust snapshot generation timing. When suspicious IO sequences are detected, the system triggers an immediate snapshot, creating a feedback loop where detection results directly influence restoration actions. This ensures snapshots are generated at the most critical moments rather than at fixed intervals.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A data protection method and apparatus, related to the field of storage technologies, are provided for restoring data in a storage device as completely as possible. In this application, the method includes: A storage device obtains an IO sequence for accessing the storage device, determines a suspicious IO sequence from the IO sequence, where the suspicious IO sequence is initiated by a suspicious host when the suspicious host accesses first data in the storage device, the suspicious IO sequence indicates that the suspicious host has a possibility of damaging data stored in the storage device, and the data stored in the storage device includes the first data, and generates a defense mechanism and a snapshot in response to determining the suspicious IO sequence, where the snapshot is used to restore the data stored in the storage device, and the defense mechanism is used to prevent, before generating the snapshot is completed, the suspicious host from accessing the data stored in the storage device.