Storage System Monitoring for Anomalous Outgoing Network Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face inefficiencies in managing and monitoring network traffic, particularly in detecting anomalies that could indicate potential security threats or performance issues, leading to potential data breaches or system failures.
Innovation Solution
A storage system integrated with a network monitoring service that monitors operations within a managed network, detects anomalies, and sends metadata to a network monitoring system to enhance security and performance by identifying and addressing unusual network traffic patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a storage system monitors network traffic for anomalies, then network security is improved, but device complexity increases
Solution Approach 1:
The patent combines storage system functions with network monitoring capabilities by integrating a network monitoring service into the storage system architecture. The storage system monitors outgoing network traffic from managed network hosts, detecting anomalies such as data exfiltration attempts. This merging allows the storage system to provide both storage services and security monitoring, improving network security while managing complexity through functional integration rather than separate independent systems.
2Difficulty of detecting and measuring
If network traffic monitoring is implemented, then anomaly detection capability is improved, but loss of information increases
Solution Approach 1:
The patent extracts only the necessary monitoring functions from the storage system by implementing a dedicated network monitoring service that specifically tracks outgoing network traffic for anomalies. The system extracts and analyzes only relevant traffic patterns (such as unusual data transfers, unauthorized access attempts) rather than monitoring all network traffic comprehensively. This selective extraction approach improves anomaly detection capability while minimizing information loss by focusing monitoring resources on critical security-related traffic.
3Reliability
If storage system monitors network operations, then system resilience is improved, but use of energy increases
Solution Approach 1:
The network monitoring service operates periodically rather than continuously, analyzing network traffic at scheduled intervals to detect anomalies. The storage system monitors outgoing traffic from managed network hosts for security threats such as data exfiltration, but does so through periodic sampling and analysis rather than continuous real-time processing of all traffic. This periodic action approach improves system resilience by maintaining security monitoring capabilities while reducing energy consumption compared to continuous monitoring of all network operations.
Data Source
AI summary
An illustrative method includes monitoring, by a storage system, one or more operations performed by a host with respect to data stored within a storage system, the host and the storage system operating within an environment bounded by a managed network; detecting, by the storage system based on the monitoring, an anomaly associated with the one or more operations; and sending, by the storage system based on the detecting the anomaly, metadata descriptive of the anomaly to a network monitoring system configured to perform a network monitoring service with respect to outgoing network traffic from the managed network, wherein the metadata is usable by the network monitoring system to perform the network traffic monitoring service.