DE102020007114A1 - Traffic-related detection of a security threat to a storage system - Google Patents

Abstract

One illustrative method includes a data protection system that determines that a total amount of read traffic and write traffic processed by a storage system during a time period exceeds a threshold, the read traffic representing data read from the storage system during the time period, and the Write traffic represents data written to the storage system during the period of time that determines that write traffic is less compressible than read traffic, based on the total amount of read traffic and write traffic that exceeds the threshold and that write traffic is less is compressible as read traffic determines that the storage system may have been affected by a security threat.

Description

Figure list

The attached figures illustrate various embodiments and are part of the specification. The illustrated embodiments are only examples and do not limit the scope of the disclosure. In the figures, identical or similar reference symbols designate identical or similar elements.

• 1A ein erstes Beispielsystem zur Datenspeicherung in Übereinstimmung mit einigen Implementierungen.
• 1B ein zweites Beispielsystem zur Datenspeicherung in Übereinstimmung mit einigen Implementierungen.
• 1C ein drittes Beispielsystem zur Datenspeicherung in Übereinstimmung mit einigen Implementierungen.
• 1D ein viertes Beispielsystem zur Datenspeicherung in Übereinstimmung mit einigen Implementierungen.
• 2A eine perspektivische Ansicht eines Storage-Clusters mit mehreren Speicherknoten und internem Speicher, der an jeden Speicherknoten gekoppelt ist, um gemäß einigen Ausführungsformen Network Attached Storage bereitzustellen.
• 2B ein Blockdiagramm, das einen Interconnect-Switch zeigt, der gemäß einigen Ausführungsformen mehrere Speicherknoten koppelt.
• 2C ein Blockdiagramm mit mehreren Ebenen, das den Inhalt eines Speicherknotens und den Inhalt einer der nichtflüchtigen Solid-State-Speichereinheiten gemäß einigen Ausführungsformen zeigt.
• 2D eine Speicherserver-Umgebung, die Ausführungsformen der Speicherknoten und Speichereinheiten einiger vorhergehender Figuren in Übereinstimmung mit einigen Ausführungsformen verwendet.
• 2E ist ein Blade-Hardware-Blockdiagramm, das eine Steuerungsebene, Rechen- und Speicherebenen und Authorities zeigt, die mit den zugrunde liegenden physischen Ressourcen interagieren, in Übereinstimmung mit einigen Ausführungsformen.
• 2F Elasticity Software Layers in Blades eines Storage-Clusters in Übereinstimmung mit einigen Ausführungsformen.
• 2G Authorities und Speicherressourcen in Blades eines Storage-Clusters in Übereinstimmung mit einigen Ausführungsformen.
• 3A ein Diagramm eines Speichersystems, das für die Datenkommunikation mit einem Anbieter von Cloud-Diensten gemäß einigen Ausführungsformen der vorliegenden Offenbarung gekoppelt ist.
• 3B ein Diagramm eines Speichersystems in Übereinstimmung mit einigen Ausführungsformen der vorliegenden Offenbarung.
• 3C zeigt ein beispielhaftes cloudbasiertes Speichersystem in Übereinstimmung mit einigen Ausführungsformen der vorliegenden Offenbarung.
• 3D illustriert ein beispielhaftes Datenverarbeitungsgerät, das speziell konfiguriert werden kann, um einen oder mehrere der hier beschriebenen Prozesse auszuführen.
• 4 illustriert ein beispielhaftes Datenschutzsystem in Übereinstimmung mit einigen Ausführungsformen der vorliegenden Offenbarung.
• 5 illustriert eine beispielhafte Konfiguration, in der ein Speichersystem Lese- und Schreibverkehr in Übereinstimmung mit einigen Ausführungsformen der vorliegenden Offenbarung verarbeitet.
• 6 zeigt eine beispielhafte Konfiguration, in der ein cloudbasiertes Überwachungssystem gemäß einigen Ausführungsformen der vorliegenden Offenbarung über ein Netzwerk kommunikativ an ein Speichersystem gekoppelt ist.
• 7 bis 42 veranschaulichen beispielhafte Verfahren und Konfigurationen in Übereinstimmung mit einigen Ausführungsformen der vorliegenden Offenbarung.

Show it:

• 1A a first example system for data storage in accordance with some implementations.
• 1B a second example system for data storage in accordance with some implementations.
• 1C a third example system for data storage in accordance with some implementations.
• 1D a fourth example system for data storage in accordance with some implementations.
• 2A Figure 6 is a perspective view of a storage cluster having multiple storage nodes and internal storage coupled to each storage node to provide network attached storage in accordance with some embodiments.
• 2 B FIG. 4 is a block diagram showing an interconnect switch coupling multiple storage nodes in accordance with some embodiments.
• 2C Figure 12 is a multi-level block diagram showing the contents of a storage node and the contents of one of the solid-state non-volatile storage devices, in accordance with some embodiments.
• 2D a storage server environment using embodiments of the storage nodes and storage devices of some previous figures in accordance with some embodiments.
• 2E Figure 3 is a blade hardware block diagram showing a control plane, compute and storage planes, and authorities that interact with the underlying physical resources, in accordance with some embodiments.
• 2F Elasticity software layers in blades of a storage cluster in accordance with some embodiments.
• 2G Authorities and storage resources in blades of a storage cluster in accordance with some embodiments.
• 3A FIG. 4 is a diagram of a storage system coupled for data communication with a cloud service provider in accordance with some embodiments of the present disclosure.
• 3B Figure 4 is a diagram of a storage system in accordance with some embodiments of the present disclosure.
• 3C Figure 12 shows an exemplary cloud-based storage system in accordance with some embodiments of the present disclosure.
• 3D illustrates an example computing device that can be specifically configured to perform one or more of the processes described herein.
• 4th illustrates an exemplary data protection system in accordance with some embodiments of the present disclosure.
• 5 illustrates an exemplary configuration in which a storage system processes read and write traffic in accordance with some embodiments of the present disclosure.
• 6th FIG. 10 shows an exemplary configuration in which a cloud-based surveillance system according to some embodiments of the present disclosure is communicatively coupled to a storage system via a network.
• 7th to 42 illustrate example methods and configurations consistent with some embodiments of the present disclosure.

DESCRIPTION OF EMBODIMENTS

Exemplary methods, systems, devices, and products for identifying a potential security threat to a storage system, performing one or more remedial actions in response to identifying the potential security threat, and other embodiments related to identifying and responding to potential security threats in accordance with the embodiments of the present invention Disclosure related are made with reference to the accompanying figures beginning with 1A described. 1A illustrates an example system for data storage consistent with some implementations. The system 100 (also referred to herein as the “storage system”) contains numerous elements that are used for purposes of illustration and not of limitation. Be on it noted that the system 100 may contain the same, more, or fewer elements configured in the same or different way in other implementations.

The system 100 includes a range of computing devices 164A-B . Data processing devices (also referred to herein as “client devices”) can embody, for example, a server in a data center, a workstation, a personal computer, a notebook or the like. Data processing equipment 164A-B can be used for data communication via a Storage Area Network ("SAN") 158 or a Local Area Network (“LAN”) 160 with one or more storage arrays 102A-B be coupled.

The SAN 158 can be implemented with a variety of data communication structures, devices, and protocols. For example, the structures for SAN 158 Fiber Channel, Ethernet, Infiniband, Serial Attached Small Computer System Interface (“SAS”) or the like. Data communication protocols for use with SAN 158 can include Advanced Technology Attachment (“ATA”), Fiber Channel Protocol, Small Computer System Interface (“SCSI”), Internet Small Computer System Interface (“iSCSI”), HyperSCSI, Non-Volatile Memory Express (“NVMe”) over Fabrics or include similar. It should be noted that SAN 158 It is intended to be illustrative and not limiting. Other data communication links can be used between data processing devices 164A-B and storage arrays 102A-B implemented.

The LAN 160 can also be implemented with a variety of structures, devices, and protocols. For example, the structures for LAN 160 Ethernet (802.3), wireless (802.11), or the like. About the data communication protocols for use in LAN 160 the Transmission Control Protocol ("TCP"), the User Datagram Protocol ("UDP"), the Internet Protocol ("IP"), the HyperText Transfer Protocol ("HTTP"), the Wireless Access Protocol ("WAP"), the Handheld Device Transport Protocol (“HDTP”), the Session Initiation Protocol (“SIP”), the Real Time Protocol (“RTP”) or similar protocols.

Storage arrays 102A-B can provide persistent data storage for the data processing equipment 164A-B provide. In implementations, the storage array can 102A in an enclosure (not shown) and the storage array 102B be contained in a different housing (not shown). The storage arrays 102A and 102B can have one or more storage array controllers 110A-D (also referred to as "controller" here). A storage array controller 110A-D can be designed as a module of an automated data processing device with computer hardware, computer software or a combination of computer hardware and software. In some implementations, the storage array controller can 110A-D can be configured to perform various storage tasks. Storage tasks can include: Writing data from data processing equipment 164A-B are received into the storage array 102A-B , deleting data from the storage array 102A-B , retrieving data from the storage array 102A-B and providing data for the data processing equipment 164A-B , monitoring and reporting of disk utilization and performance, performing redundancy operations such as redundant array of independent drives ("RAID") or RAID-like data redundancy operations, compressing data, encrypting data, etc.

The storage array controller 110A-D can be implemented in several ways, e.g. B. as a Field Programmable Gate Array (“FPGA”]), Programmable Logic Chip (“PLC”), Application Specific Integrated Circuit (“ASIC”), System-on-Chip (“SOC”) or any data processing device that supports discrete Contains components such as B. a processing device, a central processing unit, a computer memory or various adapters. The storage array controller 110A-D For example, it may contain a data communications adapter configured to communicate over the SAN 158 or LAN 160 supported. In some implementations, the storage array controller can 110A-D independently to the LAN 160 be coupled. In implementations, the storage array controller can 110A-D contain an I / O controller or similar that powers the storage array controller 110A-D for data communication via a midplane (not shown) with a persistent memory resource 170A-B (also referred to as "memory resource" here) couples. The persistent storage resource 170A-B can have any number of storage drives 171A-F (also referred to herein as “Storage Devices”) and any number of Non-Volatile Random Access Memories (“NVRAM”) (not shown).

In some implementations, the NVRAM devices can be a persistent memory resource 170A-B be configured to be used by the storage array controller 110A-D Receive data on the storage drives 171A-F should be saved. In some examples, the data can be received from the computing devices 164A-B come. In some examples, writing data to the NVRAM device may be performed faster than writing data directly to the storage drive 171A-F . In implementations, the storage array controller can 110A-D Configured to use the NVRAM devices as a readily accessible buffer for data that is on the storage drives 171A-F should be written. Latency for write requests using NVRAM devices as a buffer can be improved compared to a system using a storage array controller 110A-D Data directly on the storage drives 171A-F writes. In some implementations, the NVRAM devices can be implemented with high bandwidth, low latency computer memory in the form of RAM. The NVRAM device is referred to as “non-volatile” because the NVRAM device may receive or contain a specific power source that will maintain the state of the RAM after the main power failure of the NVRAM device. Such a power source can be a battery, one or more capacitors or the like. In response to a power failure, the NVRAM device can be configured to store the contents of the RAM in persistent storage, such as a memory card. B. the storage drives 171A-F , is written.

In implementations, the storage drive can be 171A-F refer to any device configured to permanently record data, where "persistent" or "persistent" refers to the ability of a device to retain recorded data after a power failure. In some implementations, the storage drive can 171A-F Storage media correspond to those that are not disk storage. For example, the storage drive 171A-F be one or more solid-state drives ('SSDs'), flash memory-based storage devices, any type of non-volatile solid-state storage device, or any other type of non-mechanical storage device. In other implementations, the storage drive can 171A-F contain mechanical or rotating hard drives such as hard disk drives ('HDD').

1B illustrates an example system for data storage, consistent with some implementations. The in 1B storage array controller shown 101 can the in terms of 1A storage array controllers described 110A-D resemble. In one example, the storage array controller can 101 the storage array controller 110A or the storage array controller 110B be similar to. The storage array controller 101 Contains numerous elements that are intended for purposes of illustration and not of limitation. It should be noted that the storage array controller 101 may contain the same, more, or fewer elements configured in the same or different way in other implementations. To illustrate the characteristics of the storage array controller 101 can select from the following items 1A be included.

The storage array controller 101 can be one or more processing devices 104 and a random access memory ('RAM') 111 contain. The processing device 104 (or the controller 101 ) represents one or more general purpose processing devices, such as a microprocessor, central processing unit, or the like. In particular, the processing device 104 (or the controller 101 ) a Complex Instruction Set Computing ("CISC") microprocessor, a Reduced Instruction Set Computing ("RISC") microprocessor, a Very Long Instruction Word ("VLIW") microprocessor or a processor that implements other instruction sets, or a processor, that implements a combination of instruction sets at the processing device 104 (or the controller 101 ) it can also be one or more processing devices for special purposes, such as an ASIC, an FPGA, a digital signal processor (“DSP”), a network processor or the like.

The processing device 104 can use a data communication link 106 to the RAM 111 can be connected, which can be implemented as a high-speed memory bus, such as a double data rate 4 bus ("DDR4"). In RAM 111 is an operating system 112 saved. In some implementations, commands 113 in RAM 111 saved. The commands 113 may contain computer program instructions for performing operations in a direct mapped flash memory system. In one embodiment, a direct mapped flash memory system is a system that addresses blocks of data within flash drives directly without address translation by the flash drives' storage controllers.

In implementations, the storage array controller includes 101 one or more host bus adapters 103A-C over a data communication link 105A-C to the processing device 104 are coupled. In implementations it can be host bus adapters 103A-C Computer hardware that connects a host system (such as the storage array controller) to other network and storage arrays. In some examples, it may be the host bus adapters 103A-C a fiber channel adapter that connects the storage array controller 101 Having a SAN allows to use an ethernet adapter that connects the storage array controller 101 with a LAN, or around a similar adapter. Host bus adapter 103A-C can use a data communication link 105A-C such as a PCIe bus to the processing device 104 be coupled.

In implementations, the storage array controller can 101 a host bus adapter 114 include that with an expander 115 is coupled. The expander 115 can be used to connect a host system to a larger number of storage drives. The expander 115 For example, it can be a SAS expander that is used to make the host bus adapter 114 can be connected to storage drives in an implementation in which the host bus adapter 114 is designed as a SAS controller.

In implementations, the storage array controller can 101 a switch 116 include that over a data communications link 109 is coupled to processing device 104. The switch 116 may be a computing hardware device that can create multiple endpoints from a single endpoint, thereby allowing multiple devices to share a single endpoint. The switch 116 can be, for example, a PCIe switch connected to a PCIe bus (e.g. data communication link 109 ) is coupled and represents several PCIe connection points to the midplane.

In implementations, the storage array controller includes 101 a data communication link 107 for coupling the storage array controller 101 with other storage array controllers. In some examples, the data communications link 107 be a QuickPath Interconnect (QPI) connection.

1C illustrates a third example system 117 for data storage in accordance with some implementations. The system 117 (also referred to herein as the “storage system”) contains numerous elements that are used for purposes of illustration and not of limitation. It should be noted that the system 117 may contain the same, more, or fewer elements configured in the same or different way in other implementations.

In one implementation, the system contains 117 a dual Peripheral Component Interconnect (“PCI”) flash memory device 118 with separately addressable high-speed write memory. The system 117 can be a storage controller 119 lock in. In one embodiment, the storage controller 119A-D a CPU, an ASIC, an FPGA or some other circuit arrangement that implements the control structures required in accordance with the present disclosure. In one embodiment the system closes 117 Flash memory devices (e.g., including flash memory devices 120a-n ) one that is operational with different channels of the memory controller 119 are coupled. Flash memory devices 120a-n can the controller 119A-D presented as an addressable collection of flash pages, erase blocks, and / or controls sufficient to the memory controller 119A-D enable programming and retrieval of various aspects of the flash memory device. In one embodiment, the storage controller 119A-D Operations on flash memory devices 120a-n including storing and retrieving data content from pages, arranging and erasing blocks, keeping track of statistics related to the use and reuse of flash memory pages, erase blocks and cells, tracking and predicting error codes and errors within the flash Memory, control of voltage levels associated with programming and retrieving contents of flash cells, etc.

In one embodiment, the system 117 a RAM 121 included to store separately addressable fast write data. In one embodiment, the RAM 121 consist of one or more separate discrete building blocks. In another embodiment, the RAM 121 into the storage controller 119A-D or integrated into multiple storage controllers. The RAM 121 can also be used for other purposes, e.g. as temporary program memory for a processing device (e.g. a CPU) in the memory controller 119 .

In one embodiment, the system 117 an energy storage device 122 contain, for example, a rechargeable battery or a capacitor. The energy storage device 122 can store energy sufficient to power the storage controller 119 , part of the RAM memory (e.g. RAM 121 ) and part of the flash memory (e.g. flash memory 120a-120n ) to be supplied long enough to write the contents of the RAM memory to the flash memory. In one embodiment, the storage controller 119A-D write the contents of the RAM to the flash memory when the memory controller detects a loss of external power supply.

In one embodiment, the system comprises 117 two data communication links 123a , 123b . In one embodiment, the data communication links 123a , 123b PCI interfaces. In another embodiment, the data communication links 123a , 123b based on other communication standards (e.g. HyperTransport, InfiniBand etc.). Data communication links 123a , 123b can access non-volatile memory Express ("NVMe") specifications or NVMe over Fabrics ("NVMf") specifications are based that provide an external connection to the storage controller 119A-D from other components in the storage system 117 enable. It should be noted that data communication links can be referred to interchangeably here as PCI buses for the sake of simplicity.

1D illustrates a third example system 124 for data storage in accordance with some implementations. In one embodiment, the system comprises 124 the storage controller 125a , 125b . In one embodiment, the are storage controllers 125a , 125b operational with dual PCI storage devices 119a , 119b or. 119c , 119d coupled. The storage controller 125a , 125b can be operational (e.g. via a storage network 130 ) with a certain number of host computers 127a-n be coupled.

In one embodiment, two storage controllers (e.g. 125a and 125b ) Storage services available, e.g. B. an SCS block storage array, a file server, an object server, a database or a data analysis service, etc. The storage controllers 125a , 125b can use a certain number of network interfaces (e.g. 126a-d ) Host computer services 127a-n outside of the storage system 124 provide. The storage controller 125a , 125b can be integrated services or an application entirely within the storage system 124 provide and thus form a converged storage and computing system. The storage controller 125a , 125b can use the fast write memory within or via storage devices 119a-d to log ongoing operations to ensure that operations are performed in the event of a power failure, removal of the storage controller, shutdown of the storage controller or storage system, or a failure of one or more software or hardware components within the storage system 124 do not get lost.

In one embodiment, the controllers operate 125a , 125b as a PCI master for one or the other PCI bus 128a , 128b . In another embodiment, the PCI buses 128a and 128b based on other communication standards (e.g. HyperTransport, InfiniBand etc.). Other storage system designs can include storage controllers 125a , 125b as multi-master for both PCI buses 128a , 128b operate. Alternatively, a PCI / NVMe / NVMf switching infrastructure or fabric can connect multiple storage controllers. Some designs of storage systems allow storage devices to communicate directly with each other rather than just communicating with storage controllers. In one embodiment, a storage controller 119a under the direction of a storage controller 125a operated to extract data to be stored in flash memory devices from data that has been stored in RAM (e.g. RAM 121 in 1C ), synthesize and transmit. For example, a recalculated version of the RAM contents can be transmitted after a memory controller has determined that an operation has been fully committed to the entire memory system, or when the fast write memory on the device has reached a certain used capacity, or after a certain amount Time to improve the security of the data or to free up addressable high-speed write capacity for reuse. This mechanism can be used, for example, to initiate a second transmission over a bus (e.g. 128a , 128b ) from the storage controllers 125a , 125b to avoid. In one embodiment, recalculation may include compressing data, appending indexing or other metadata, combining multiple data segments together, performing erasure code calculations, and so on.

In one embodiment, a storage controller 119a , 119b under the direction of a storage controller 125a , 125b be ready to transfer data from in RAM (e.g. RAM 121 in 1C ) Stored data, to be calculated and transmitted to other devices without the involvement of the storage controller 125a , 125b . This operation can be used to retrieve data that is in a controller 125a are stored on another controller 125b or it can be used to offload compression, data aggregation, and / or erasure coding calculations and transfers to storage devices to reduce the load on the storage controller or storage controller interface 129a , 129b on the PCI bus 128a , 128b to reduce.

A storage controller 119A-D may provide mechanisms for implementing high availability primitives for use by other parts of a storage system outside of the dual PCI storage device 118 contain. For example, reservation or exclusion primitives can be provided so that in a storage system with two storage controllers that provide a high-availability storage service, one storage controller can prevent the other storage controller from accessing the storage device or preventing further access to it. For example, this could be used in cases where one controller determines that the other controller is not working properly, or when the connection between the two storage controllers themselves is not working properly.

2A Figure 3 is a perspective view of a storage cluster 161 with multiple storage nodes 150 and solid-state internal storage coupled to each storage node to provide network attached storage or storage area network in accordance with some embodiments. A network-attached storage, a storage area network or a storage cluster or other storage could be one or more storage clusters 161 each with one or more storage nodes 150 contained in a flexible and reconfigurable arrangement of both the physical components and the amount of storage space thereby provided. The storage cluster 161 is designed to fit in a rack, and one or more racks can be set up and populated for storage as desired. The storage cluster 161 has a housing 138 with multiple slots 142 . It should be noted that the chassis 138 can be referred to as a housing, slide-in unit or rack unit. In one version, the chassis has 138 over fourteen slots 142 , although other numbers of slots are easily possible. For example, some embodiments have four slots, eight slots, sixteen slots, thirty-two slots, or some other suitable number of slots. Any slot 142 may, in some embodiments, be a storage node 150 take up. The chassis 138 contains flaps 148 that are used to assemble the chassis 138 can be used in a rack. Fan 144 ensure air circulation to cool the storage nodes 150 and their components, although other cooling components could be used or a design without cooling components could be developed. A switch fabric 146 connects the storage nodes 150 inside the chassis 138 with each other and with a network for communication with the memory, In an embodiment shown here, the slots 142 to the left of the switch fabric 146 and the fans 144 with storage nodes 150 occupied while the slots 142 to the right of the switch fabric 146 and the fans 144 are empty and to illustrate the insertion of storage nodes 150 be available. This configuration is an example, and one or more storage nodes 150 could the slots 142 in various other arrangements. The storage node arrays need not be sequential or contiguous in some embodiments. The storage nodes 150 are hot-pluggable, ie a storage node 150 can in a slot 142 in the chassis 138 inserted or from a slot 142 removed without stopping or turning off the system. When inserting or removing the storage node 150 out of the slot 142 the system automatically reconfigures itself to recognize the change and adapt to it. Reconfiguration, in some embodiments, includes restoring redundancy and / or rebalancing data or load.

Any storage node 150 can have multiple components. In the embodiment shown here, the storage node contains 150 a circuit board 159 that come with a CPU 156 is populated, ie a processor, a memory 154 that is with the CPU 156 is coupled, and a non-volatile solid-state memory 152 that is with the CPU 156 is coupled, although other mounts and / or components could be used in other embodiments. The memory 154 has commands issued by the CPU 156 to be executed and / or data received by the CPU 156 to be edited. As will be explained in more detail below, the non-volatile solid-state memory contains 152 Flash memory or, in further embodiments, other types of solid-state memories.

2 B Figure 3 is a block diagram showing a communications link 171A-F and a power distribution bus 172 shows the multiple storage nodes 150 couple. Referring again to 2A , the communication link can 171A-F in some embodiments in the switch fabric 146 be included or implemented with it. When multiple storage clusters 161 occupy a rack, the communication link 171A-F in some embodiments built into or implemented with a switch at the top of the rack. As in 2 B Shown is the storage cluster 161 in a single chassis 138 locked in. An external port 176 is over the communication link 171A-F with the storage nodes 150 connected while an external port 174 connected directly to a storage node. An external power supply connection 178 is with the power distribution bus 172 connected. Storage node 150 can have different numbers and different capacities of the non-volatile solid-state memory 152 included, as in 2A described. It can also have one or more storage nodes 150 be a pure compute storage node, as in 2 B shown. Authorities 168 are on the non-volatile solid-state memories 152 implemented, e.g. as lists or other data structures stored in memory. In some embodiments, the authorities are within the non-volatile solid-state memory 152 stored and supported by software running on a controller or other processor of the non-volatile solid state memory 152 is performed. In a further embodiment, the authorities are 168 on the storage node 150 implemented, for example, as lists or other data structures that are in memory 154 are stored and supported by software running on the CPU 156 of the storage node 150 is performed. Authorities 168 In some embodiments, control how and where data is in the non-volatile solid-state memories 152 get saved. These controls help determine what type of Erasure coding scheme applied to the data and which storage nodes 150 which data parts have. Every authority 168 can be a non-volatile solid-state memory 152 be assigned. Each authority can control a range of inode numbers, segment numbers or other data identifiers that control the data through a file system through the storage nodes 150 or through the non-volatile solid-state memory 152 can be assigned in different embodiments.

2C Figure 13 is a multilevel block diagram showing the contents of a storage node 150 and the contents of a non-volatile solid-state memory 152 of the storage node 150 shows. In some embodiments, data goes to and from the storage node 150 through a network interface controller ('NIC') 202 transfer. Any storage node 150 has a CPU 156 and one or more non-volatile solid-state memories 152 as described above. One level deeper in 2C everyone has non-volatile solid-state memory 152 a relatively fast non-volatile solid-state memory, such as a non-volatile random access memory ('NVRAM') 204 and a flash memory 206 . In some embodiments, NVRAM 204 be a component that does not require any program / erase cycles (DRAM, MRAM, PCM), and can be a memory that supports being written to significantly more often than is read from the memory. On another level in 2C becomes the NVRAM 204 implemented in one embodiment as high speed volatile memory, e.g. B. as dynamic memory with random access (DRAM) 216 by an energy reserve 218 is secured. The energy reserve 218 provides sufficient electrical power to run the DRAM 216 to be supplied with power long enough so that content is stored on the flash memory in the event of a power failure 206 can be transferred. In some embodiments, the energy reserve is 218 a capacitor, supercapacitor, battery, or other device that provides a suitable supply of power sufficient to allow the contents of the DRAM to be transferred in the event of a power failure 216 on a permanent storage medium. The flash memory 206 is called multiple flash dies 222 implemented as packets of flash dies 222 or an array of flash dies 222 can be designated. It should be noted that the flash dies 222 can be packaged in any number of ways, with a single chip per package, multiple chips per package (i.e. multichip package), in hybrid packages, as bare chips on a circuit board or other substrate, as encapsulated chips, etc. in the embodiment shown the non-volatile solid-state memory 152 a controller 212 or another processor and one with the controller 212 coupled input-output (I / O) port 210 . The I / O port 210 is with the CPU 156 and / or the network interface controller 202 of the flash storage node 150 coupled. The flash input output (I / O) port 220 is with the flash dies 222 coupled, and a Direct Memory Access Unit (DMA) 214 is with the controller 212 , the DRAM 216 and the flash dies 222 coupled. In the version shown are the I / O port 210 , the controller 212 who have favourited the DMA unit 214 and the flash I / O port 220 on a programmable logic module ("PLD") 208 implemented, e.g. a Field Programmable Gate Array (FPGA). In this version everyone has Flash Die 222 Pages organized as sixteen kB (kilobyte) pages 224 , and a register 226 , about the data on the flash die 222 can be written or read by him. In other embodiments, other types of solid state memories are used in place of, or in addition to, the flash memories that are included in the flash die 222 are shown.

2D Figure 11 shows a storage server environment incorporating the embodiments of the storage nodes 150 and storage units 152 the 2A-C used. In this version, each storage unit has 152 via a processor such as B. a controller 212 (please refer 2C ), an FPGA (Field Programmable Gate Array), a flash memory 206 and an NVRAM 204 (which is a DRAM 216 acts with supercapacitor support, see 2 B and 2C ) on a PCIe (Peripheral Component Interconnect Express) board in a chassis 138 (please refer 2A) . The storage unit 152 can be implemented as a single board with memory and may represent the largest tolerable failure domain within the chassis. In some embodiments, up to two storage units 152 fail and the device continues to run without data loss.

Physical memory, in some embodiments, is divided into named regions based on application usage. The NVRAM 204 is a contiguous block of reserved memory in the storage unit 152 DRAM 216 and is secured by NAND flash. The NVRAM 204 is logically divided into several memory regions that are written as a spool for two (e.g. spool_region). The space within the NVRAM 204 spools is owned by each authority 168 independently managed. Every device represents every authority 168 a certain amount of storage space is available. This authority 168 also manages the lifetime and the allocations within this storage space. Examples of a spool are distributed transactions or terms. When the primary power supply of a storage unit 152 fails, built-in supercapacitors ensure that the power outage lasts for a short time. During this bridging interval, the contents of the NVRAM 204 into the flash memory 206 emptied. At the next The contents of the NVRAM will be switched on 204 from the flash memory 206 restored.

As far as the controller of the storage unit is concerned, the responsibility of the logical “controller” is distributed to the individual blades, which authorities 168 contain. This distribution of logical control is in 2D as a host controller 242 , Mid-tier controller 244 and storage unit controller 246 shown. Management of the control plane and storage plane are handled independently, although parts can physically reside on the same blade. Any authority 168 effectively serves as an independent controller. Any authority 168 provides their own data and metadata structures and their own background workers and maintains their own life cycle.

2E is a blade 252 - Hardware block diagram showing a control plane 254 , the computation and storage levels 256 , 258 and the authorities 168 shows that interact with the underlying physical resources, with embodiments of the storage nodes 150 and storage units 152 the 2A-C in the storage server environment of 2D be used. The control level 254 is in a number of Authorities 168 which divides the computational resources in the computational level 256 can use to on each of the blades 252 to be executed. The storage tier 258 is partitioned into a number of devices, each of which has access to the resources of flash 206 and NVRAM 204 enables. In one embodiment, the computing level 256 the operations described here of a storage array controller on one or more devices of the storage array 258 (e.g. a storage array).

In the computation and storage levels 256 , 258 the 2E the authorities interact 168 with the underlying physical resources (i.e. the devices). From the point of view of an authority 168 their resources are distributed across all physical devices. From the point of view of a device, it represents all authorities 168 Resources available regardless of where the authorities are currently active. Any authority 168 has one or more partitions 260 the storage space in the storage units 152 assigned or got assigned, e.g. partitions 260 in flash memory 206 and NVRAM 204 . Any authority 168 uses the partitions assigned to it 260 belonging to her, for writing or reading user data. The authorities can be connected to different amounts of physical memory in the system. For example, an Authority 168 a larger number of partitions 260 or larger partitions 260 in one or more storage units 152 as one or more other authorities 168 .

2F shows elasticity software layers in blades 252 of a storage cluster in accordance with some embodiments. In the elastic structure, the elasticity software is symmetrical, that is, the computational module 270 each blade carries the three identical layers of the in 2F processes shown. Storage manager 274 handle read and write requests from other blades 252 for data and metadata stored in the local storage unit 152 NVRAM 204 and in flash 206 are stored. Authorities 168 meet client needs by making the necessary reads and writes to the blades 252 run on their storage units 152 the corresponding data or metadata are located. Endpoints 272 analyze the monitoring software Switch Fabric 146 received client connection requests, forward the client connection requests to the authorities responsible for compliance 168 forward and forward the responses from the authorities 168 to the clients. The symmetrical three-layer structure enables the high degree of simultaneity of the storage system. Elasticity scales efficiently and reliably in these embodiments. In addition, elasticity implements a unique scale-out technique that evenly distributes the work across all resources regardless of the client access pattern, and maximizes concurrency by eliminating much of the inter-blade coordination that typically occurs with traditional distributed locking .

Continuing with reference to 2F run the authorities 168 that are in the computation modules 270 of a blade 252 run through the internal operations necessary to meet client requirements. A characteristic of elasticity is that the Authorities 168 are stateless, ie they cache active data and metadata in the 252 DRAMs of their own blades for quick access, but the authorities store each update in their NVRAM 204 partitions on three separate blades 252 until the update in the flash 206 was written. All write accesses of the storage system to NVRAM 204 run in triplicate on partitions on three separate blades in some embodiments 252 . With triple mirrored NVRAM 204 and persistent storage, which is protected by parity and Reed-Solomon RAID checksums, the storage system can prevent the simultaneous failure of two blades 252 survive without loss of data, metadata, or access to both.

2G shows authorities 168 and storage resources in blades 252 of a storage cluster in accordance with some embodiments. Any authority 168 is only for one partition of the flash 206 and NVRAM 204 on every blade 252 responsible. The authority 168 manages the content and the integrity of your partitions independently of other authorities 168 . The authority 168 compresses incoming data and temporarily stores it in its NVRAM 204 partitions. The data is then consolidated, RAID-protected and made persistent in segments of the memory on your Flash 206 partitions. While the Authorities 168 Data in the flash 206 write, run memory manager 274 perform the necessary Flash translation to optimize writing performance and maximize media longevity. In the background, the “garbage collection” is carried out by the authorities 168 or they reclaim storage space that is occupied by data that is obsolete by clients by overwriting the data. Since the partitions of the Authorities 168 are disjoint, it should be understood that a distributed lock is not required to perform client and write operations, or to perform background functions.

3A Figure 3 shows a diagram of a storage system 306 that is used for data communication with a cloud service provider 302 is coupled in accordance with some embodiments of the present disclosure. Although it is shown in less detail, this can be done in 3A storage system shown 306 the one above with reference to the 1A-1D and 2A-2G storage systems described be similar.

In the in 3A The example shown is the storage system 306 over a data communication link 304 to the cloud service provider 302 coupled. The data communication link 304 can be implemented as a dedicated data communication link, as a data communication path that is provided through the use of one or more data communication networks such as a wide area network (“WAN”) or a local area network (“LAN”), or as another mechanism that is digital Information between the storage system 306 and the cloud service provider 302 can transport.

3B Figure 3 shows a diagram of a storage system 306 illustrated in accordance with some embodiments of the present disclosure. Although shown in less detail, this can be done in 3B storage system shown 306 the one above with reference to the 1A-1D and 2A-2G storage systems described, as the storage system can include many of the components described above.

This in 3B storage system shown 306 can use a huge amount of memory resources 308 that can be embodied in many forms. For example, memory resources 308 Nano-RAM or other form of non-volatile random access memory using carbon nanotubes deposited on a substrate, 3D cross-point non-volatile memory, flash memory including single-level cell ('SLC') NAND flash, multi- Level Cell ('MLC') NAND Flash, Triple-Level Cell ('TLC') NAND Flash, Quad-Level Cell ('QLC') NAND Flash or others.

This in 3B storage system shown 306 also contains communication resources 310 that can be useful in facilitating data communication between components within the storage system 306 as well as data communication between the storage system 306 and data processing equipment that is external to the storage system 306 including embodiments in which these resources are separated by a relatively large area.

This in 3B storage system shown 306 also contains processing resources 312 involved in the execution of computer program instructions and other computing tasks within the storage system 306 can be useful. The processing resources 312 may contain one or more ASICs adapted for a specific purpose, as well as one or more CPUs. The processing resources 312 may also include one or more digital DSPs, one or more FPGAs, one or more single-chip systems ("SoCs"), or some other form of processing resources 312 include. The storage system 306 can use memory resources 312 use to perform a variety of tasks including, but not limited to, aiding the execution of the software resources 314 which are described in more detail below.

This in 3B storage system shown 306 also includes the software resources 314 that when executed by the processing resources 312 within the storage system 306 can perform various tasks. The software resources 314 For example, they may contain one or more modules of computer program instructions that, when received from the processing resource 312 within the storage system 306 are useful in performing various backup procedures to maintain the integrity of the data stored in the storage systems.

3C shows an example of a cloud-based storage system 318 in accordance with some embodiments of the present disclosure. In the in 3C The example shown is the cloud-based storage system 318 entirely in a cloud computing environment 316 created, such as Amazon Web Services ("AWS"), Microsoft Azure, Google Cloud Platform, IBM Cloud, Oracle Cloud and others. The cloud-based storage system 318 can be used to provide services that are similar to the services that can be provided by the storage systems described above. For example, the cloud-based storage system 318 used to provide block storage services to users of the cloud-based storage system 318 provide, the cloud-based storage system 318 Can be used to provide storage services to users of the cloud-based storage system 318 through the use of solid-state storage, and so on.

This in 3C illustrated cloud-based storage system 318 includes two cloud computing instances 320 , 322 each to support the execution of a storage controller application 324 , 326 be used. The cloud computing instances 320 , 322 For example, they can be embodied as instances of cloud computing resources (e.g. virtual machines) by the cloud computing environment 316 be provided to the execution of software applications such as the storage controller application 324 , 326 to support. In one embodiment, the cloud computing entities 320 , 322 run as Amazon Elastic Compute Cloud ("EC2") instances. In one such example, an Amazon Machine Image ("AMI") that the storage controller application 324 , 326 includes, booted to create and configure a virtual machine that will run the storage controller application 324 , 326 can perform.

In the in 3C The example method shown can be the memory controller application 324 , 326 be embodied as a module of computer program instructions which, when executed, performs various memory tasks. For example, the storage controller application 324 , 326 be embodied as a module of computer program instructions which, when executed, perform the same tasks as the controllers described above 110A , 110B in 1A .

This in 3C illustrated cloud-based storage system 318 includes the cloud computing instances 340a , 340b , 340n with local storage 330 , 334 , 338 . In the 3C illustrated cloud computing instances 340a , 340b , 340n For example, they can be embodied as instances of cloud computing resources used by the cloud computing environment 316 can be provided to support the execution of software applications. The cloud computing instances 340a , 340b , 340n of 3C can differ from the cloud computing instances described above 320 , 322 differ as the cloud computing instances 340a , 340b , 340n of 3C via local storage resources 330 , 334 , 338 have while the cloud computing instances 320 , 322 running the storage controller application 324 , 326 do not need to have local storage resources. The cloud computing instances 340a , 340b , 340n with local storage 330 , 334 , 338 can be executed as EC2 M5 instances with one or more SSDs, as EC2 R5 instances with one or more SSDs, as EC2 I3 instances with one or more SSDs, etc. In some embodiments, local storage must be 330 , 334 , 338 as solid-state storage (e.g. SSDs) and not as storage with hard disk drives.

In the in 3C The example shown can be any of the cloud computing instances 340a , 340b , 340n with local storage 330 , 334 , 338 a software daemon 328 , 332 , 336 included that when coming from a cloud computing instance 340a , 340b , 340n running itself the storage controller applications 324 , 326 can present as if the cloud computing instance 340a , 340b , 340n would be a physical storage device (e.g., one or more SSDs). In such an example, the software daemon 328 , 332 , 336 Include computer program instructions similar to those that would normally be contained on a storage device so that the storage controller applications 324 , 326 Send and receive the same commands that a storage controller would send to storage devices. This allows the storage controller applications 324 , 326 Contain code that is identical (or substantially identical to) the code that would be executed by the controllers in the storage systems described above. In these and similar embodiments, communication between the storage controller applications 324 , 326 and the cloud computing instances 340a , 340b , 340n with local storage 330 , 334 , 338 Use iSCSI, NVMe over TCP, messaging, a user protocol, or some other mechanism.

In the in 3C The example shown can be any of the cloud computing instances 340a , 340b , 340n with local storage 330 , 334 , 338 also to a block storage 342 , 344 , 346 coupled to that of the cloud computing environment 316 is offered. The block storage 342 , 344 , 346 that of the cloud computing environment 316 offered, for example, can be implemented as an Amazon Elastic Block Store (“EBS”) volume. For example, a first EBS volume can with a first cloud computing instance 340a , a second EBS volume with a second cloud computing instance 340b and a third EBS volume with a third cloud computing instance 340n be coupled. In such an example, the block memory 342 , 344 , 346 that of the cloud computing environment 316 is offered to be used in a similar way as the NVRAM devices described above, as the software daemon 328 , 332 , 336 (or another module) that is within a particular cloud computing instance 340a , 340b , 340n is executed, when a request to write data is received, the data is written to the connected EBS volume and the data is written to the local storage 330 , 334 , 338 Can initiate resources. In some alternative embodiments, data can only be stored in local storage resources 330 , 334 , 338 within a specific cloud computing instance 340a , 340b , 340n to be written. In an alternative embodiment, instead of the block memory 342 , 344 , 346 that of the cloud computing environment 316 Offered as NVRAM, the actual RAM in each of the cloud computing instances 340a , 340b , 340n with local storage 330 , 334 , 338 can be used as NVRAM, reducing the network usage costs associated with using an EBS volume as NVRAM.

In some examples, a non-transitory computer readable medium that stores computer readable instructions can be provided in accordance with the principles described herein. The instructions, when executed by a processor of a data processing device, may instruct the processor and / or the data processing device to perform one or more operations, including one or more of the operations described herein. Such instructions can be stored and / or transmitted using a variety of known computer readable media.

A non-transitory computer-readable medium within the meaning of this document can include any non-transitory storage medium that is involved in the provision of data (e.g. commands) that can be read and / or executed by a data processing device (e.g. by a processor of a data processing device) . For example, a non-transitory computer readable medium can include, but is not limited to, any combination of non-volatile storage media and / or volatile storage media. Exemplary non-volatile storage media include read-only memory, flash memory, an SSD drive, a magnetic storage device (e.g., a hard drive, floppy disk, magnetic tape, etc.), ferroelectric random access memory ("RAM"), and an optical disk (e.g., a compact disc , a digital video disc, a Blu-ray disc, etc.). Examples of volatile storage media include RAM (e.g. dynamic RAM).

3D shows an exemplary data processing device 350 that can be specifically configured to perform one or more of the processes described here. As in 3D shown, the data processing device 350 a communication interface 352 , a processor 354 , a storage device 356 and an input / output module 358 include that via a communication infrastructure 360 are communicatively connected to each other. While an exemplary data processing device 350 in 3D shown are those in 3D components shown are not intended as a limitation. In other embodiments, additional or alternative components can be used. In the 3D illustrated components of the data processing device 350 are now additionally described in detail.

The communication interface 352 can be configured to communicate with one or more computing devices. Examples of the communication interface 352 include a wired network interface (e.g., a network interface card), a wireless network interface (e.g., a wireless network interface card), a modem, an audio / video connection, and any other suitable interface.

One processor 354 generally represents any type or form of processing unit capable of processing data and / or interpreting, executing and / or controlling the execution of one or more of the commands, processes and / or operations described herein. One processor 354 can perform operations by giving computer executable instructions 362 (e.g. an application, software, code and / or other executable data instance) executing in the storage device 356 are stored.

The storage device 356 may include one or more data storage media, devices, or configurations, and may employ any type, shape, and combination of data storage media and / or devices. For example, the storage device can 356 includes, but is not limited to, any combination of the non-volatile media and / or volatile media described herein. Electronic data, including the data described herein, may be stored temporarily and / or permanently on the storage device 356 get saved. For example, data necessary for computer-executable instructions 362 are representative - that are configured to run the processor 354 instruct a perform the operations described herein - on the storage device 356 get saved. In some examples, the data may be located in one or more databases located on the storage device 356 are located.

The I / O module 358 may include one or more I / O modules configured to receive user input and provide user output. The I / O module 358 may contain any hardware, firmware, software, or a combination thereof that supports input and output capability. For example, the I / O module 358 may include hardware and / or software for capturing user input including, but not limited to, a keyboard or keypad, a touchscreen component (e.g., touchscreen display), a receiver (e.g., a HF or infrared receiver), motion sensors and / or one or more input keys.

The I / O module 358 may include one or more devices for presenting output to a user including, but not limited to, a graphics engine, a display (e.g., a screen), one or more output drivers (e.g., a monitor), one or more output drivers (e.g., a monitor) Display driver), one or more audio speakers, and one or more audio drivers. In certain embodiments, the I / O module 358 is configured to provide graphical data for display for presentation to a user. The graphical data may be representative of one or more graphical user interfaces and / or any other graphical content that serves a particular implementation. In some examples, any of the systems, computing devices, and / or other components described herein can be used by the computing device 350 implemented.

1. 1. Ein Verfahren, umfassend: Bestimmen, durch ein Datenschutzsystem, dass eine Gesamtmenge des Leseverkehrs und des Schreibverkehrs, die von einem Speichersystem während einer Zeitperiode verarbeitet werden, einen Schwellenwert überschreitet, wobei der Leseverkehr Daten repräsentiert, die während der Zeitperiode aus dem Speichersystem gelesen wurden, und der Schreibverkehr Daten repräsentiert, die während der Zeitperiode in das Speichersystem geschrieben wurden; Bestimmen durch das Datenschutzsystem, dass der Schreibverkehr weniger komprimierbar ist als der Leseverkehr; und Bestimmen durch das Datenschutzsystem, darauf basierend, dass die Gesamtmenge des Leseverkehrs und des Schreibverkehrs den Schwellenwert überschreitet, und darauf basierend, dass der Schreibverkehr weniger komprimierbar ist als der Leseverkehr, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Ermitteln eines Attributs, das mit einem oder mehreren der aus dem Speichersystem gelesenen Daten oder der in das Speichersystem geschriebenen Daten verbunden ist, durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Attribut basiert.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Attribut eines oder mehreres von Folgendem umfasst: ein Host-Attribut, das einem Host zugeordnet ist, der dem Speichersystem zugeordnet ist, wobei die aus dem Speichersystem gelesenen Daten oder die in das Speichersystem geschriebenen Daten dem Host zugeordnet sind; ein Attribut einer Quelle des Leseverkehrs und des Schreibverkehrs; ein Attribut einer Speicherstruktur innerhalb des Speichersystems, aus der die Daten gelesen oder in die die Daten geschrieben werden; oder ein Speicherformat-Attribut, das einem vom Speichersystem verwendeten Speicherformat zugeordnet ist.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Ermitteln eines Formattyps einer Dateninstanz, die in den in das Speichersystem geschriebenen Daten enthalten ist, durch das Datenschutzsystem; und Bestimmen, durch das Datenschutzsystem, dass ein Inhalt der Dateninstanz nicht mit dem übereinstimmt, was von dem Speichersystem für den ermittelten Formattyp erwartet wird; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass der Inhalt der Dateninstanz nicht mit dem übereinstimmt, was von dem Speichersystem für den ermittelten Formattyp erwartet wird.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Ermitteln eines Musters, das mit einem oder mehreren von dem Leseverkehr oder dem Schreibverkehr verbunden ist, durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Muster basiert.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen, durch das Datenschutzsystem, dass die in das Speichersystem geschriebenen Daten keine identifizierbaren Header-Informationen enthalten oder dass die in das Speichersystem geschriebenen Daten Header-Informationen enthalten, die nicht mit dem Inhalt übereinstimmen, der in den in das Speichersystem geschriebenen Daten enthalten ist; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass die in das Speichersystem geschriebenen Daten nicht die identifizierbaren Header-Informationen enthalten oder dass die in das Speichersystem geschriebenen Daten Header-Informationen enthalten, die nicht mit dem Inhalt übereinstimmen, der in den in das Speichersystem geschriebenen Daten enthalten ist.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen, durch das Datenschutzsystem, dass die aus dem Speichersystem gelesenen Daten zumindest teilweise komprimiert sind und die identifizierbaren Header-Informationen enthalten; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass die aus dem Speichersystem gelesenen Daten komprimiert sind und die identifizierbaren Header-Informationen einschließen.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen, durch das Datenschutzsystem, dass die in das Speichersystem geschriebenen Daten Daten enthalten, die mit einem Schlüssel, der von einem autorisierten Schlüsselverwaltungssystem außerhalb des Speichersystems verwaltet wird, nicht entschlüsselbar sind; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass die in das Speichersystem geschriebenen Daten Daten enthalten, die mit dem von dem Schlüsselverwaltungssystem verwalteten Schlüssel nicht entschlüsselbar sind.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen, durch das Datenschutzsystem, dass die in das Speichersystem geschriebenen Daten keine korrekte kryptographische Signatur enthalten, die mit einem externen Datenverschlüsselungsdienst verbunden ist, der mit dem Speichersystem verbunden ist; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass die in das Speichersystem geschriebenen Daten nicht die korrekte kryptographische Signatur enthalten.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen, durch das Datenschutzsystem, dass bereits durch das Speichersystem gespeicherte Daten gelöscht oder durch die in das Speichersystem geschriebenen Daten überschrieben werden; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass die bereits durch das Speichersystem gespeicherten Daten gelöscht oder durch die in das Speichersystem geschriebenen Daten überschrieben werden.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Zugreifen, durch das Datenschutzsystem auf Telefon-Heimdaten, die durch das Speichersystem übertragen werden; und Erfassen einer Anomalie, die mit dem Speichersystem verbunden ist, durch das Datenschutzsystem auf der Grundlage der Telefon-Heimdaten; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf der Grundlage der erfassten Anomalie erfolgt.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Erkennen der Anomalie das Bestimmen umfasst, dass eine Gesamtkomprimierbarkeit der durch das Speichersystem gespeicherten Daten unter einer historischen Norm liegt, die mit einem oder mehreren von dem Speichersystem oder einem anderen Speichersystem verbunden ist.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Erfassen einer Rate durch das Datenschutzsystem, mit der Daten aus dem Speichersystem gelesen und in verschlüsselter Form in das Speichersystem zurückgeschrieben werden; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf der erfassten Rate basiert.
14. 14. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Eingeben von Daten, durch das Datenschutzsystem, die für ein oder mehrere Attribute des Leseverkehrs, des Schreibverkehrs oder des Speichersystems repräsentativ sind, in ein maschinelles Lernmodell; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf einer Ausgabe des maschinellen Lernmodells basiert.
15. 15. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen einer Anomalie in einem durch das Speichersystem durchgeführten Garbage Collection Prozess durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen der Anomalie im Garbage Collection Prozess basiert.
16. 16. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Ermitteln eines Attributs eines zusätzlichen Speichersystems, das so konfiguriert ist, dass es vom Speichersystem gespeicherte Daten repliziert, durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Attribut des zusätzlichen Speichersystems basiert.
17. 17. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der Schwellenwert eines oder mehreres von einer Rate, einem Gesamtbetrag oder einer Differenz im Vergleich zu einem mit dem Speichersystem verbundenen historischen Trend darstellt.
18. 18. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Durchführen einer Abhilfemaßnahme in Bezug auf das Speichersystem durch das Datenschutzsystem, als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
19. 19. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Anweisen des Speichersystems umfasst, einen Wiederherstellungsdatensatz für Daten zu erzeugen, die durch das Speichersystem gespeichert wurden.
20. 20. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme ferner umfasst, dass das Speichersystem angewiesen wird, den Wiederherstellungsdatensatz an ein entferntes Speichersystem zur Speicherung durch das entfernte Speichersystem zu übertragen.
21. 21. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die Übertragung des Wiederherstellungsdatensatzes an das entfernte Speichersystem unter Verwendung eines NFS-Protokolls (Network File System) durchgeführt wird.
22. 22. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Benachrichtigen des entfernten Speichersystems über die Sicherheitsbedrohung umfasst.
23. 23. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen durch das Datenschutzsystem, dass das Speichersystem tatsächlich nicht von der Sicherheitsbedrohung betroffen ist; und Anweisen des Speichersystems, durch das Datenschutzsystem, den Wiederherstellungsdatensatz zu löschen, als Reaktion auf das Bestimmen, dass die Host-Daten tatsächlich nicht von der Sicherheitsbedrohung betroffen sind.
24. 24. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der Wiederherstellungsdatensatz einen Snapshot einer Speicherstruktur innerhalb des Speichersystems umfasst.
25. 25. Das Verfahren nach einer der vorhergehenden Aussagen, die ferner darin besteht, durch das Datenschutzsystem zu verhindern, dass der Wiederherstellungsdatensatz gelöscht wird, bis eine oder mehrere Bedingungen erfüllt sind.
26. 26. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Anweisen des Speichersystems durch das Datenschutzsystem, Wiederherstellungsdatensätze im Laufe der Zeit in Übereinstimmung mit einem Datenschutzparametersatz zu erzeugen, wobei die Wiederherstellungsdatensätze zum Wiederherstellen von Daten, die durch das Speichersystem gepflegt wurden, in einen Zustand, der einem wählbaren Zeitpunkt entspricht, verwendbar sind.
27. 27. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme darin besteht, als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, das Speichersystem anzuweisen, einen oder mehrere der Wiederherstellungsdatensätze zu verwenden, um die vom Speichersystem gepflegten Daten in einen Zustand wiederherzustellen, der einem Zeitpunkt entspricht, der vor einem Zeitpunkt liegt, zu dem das Datenschutzsystem feststellt, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
28. 28. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme ferner umfasst: das Ändern des Datenschutzparametersatzes für einen oder mehrere der Wiederherstellungsdatensätze als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
29. 29. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Aufbewahrungsdauer für die Wiederherstellungsdatensätze spezifiziert, wobei die Aufbewahrungsdauer eine Dauer definiert, die jeder Wiederherstellungsdatensatz vor dem Löschen gespeichert wird; und das Modifizieren des Datenschutzparametersatzes eines oder mehreres von Folgendem umfasst: Erhöhen der Aufbewahrungsdauer oder Aussetzen der Aufbewahrungsdauer, so dass zumindest einige der Wiederherstellungsdatensätze nicht ohne einen spezifischen Befehl gelöscht werden, der von einer Quelle bereitgestellt wird, die das Speichersystem verwaltet.
30. 30. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Wiederherstellungsdatensatz-Erzeugungsfrequenz spezifiziert, die eine Frequenz definiert, mit der die Wiederherstellungsdatensätze erzeugt werden; und das Modifizieren des Datenschutzparametersatzes eine Erhöhung der Wiederherstellungsdatensatz-Erzeugungsfrequenz umfasst.
31. 31. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Fernspeicherfrequenz spezifiziert, die eine Frequenz definiert, mit der eine Teilmenge von Wiederherstellungsdatensätzen in den Wiederherstellungsdatensätzen zu einem entfernten Speichersystem übertragen wird, das mit dem Speichersystem über ein Netzwerk verbunden ist; und das Modifizieren des Datenschutzparametersatzes das Modifizieren der Fernspeicherfrequenz umfasst.
32. 32. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Aufrechterhalten von Konfigurationsdaten für das Speichersystem durch das Datenschutzsystem; und Bestimmen durch das Datenschutzsystem, dass das Speichersystem aufgrund der Sicherheitsbedrohung beschädigt ist; wobei das Durchführen der Abhilfemaßnahme die Verwendung der Konfigurationsdaten als Reaktion auf das Bestimmen, dass das Speichersystem beschädigt ist, umfasst, um ein Ersatzspeichersystem für das Speichersystem zu rekonstruieren.
33. 33. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Bereitstellen einer Benachrichtigung über die Sicherheitsbedrohung umfasst.
34. 34. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Wiederherstellen von Daten, die vom Speichersystem gespeichert wurden, in einen nicht beschädigten Zustand durch das Datenschutzsystem umfasst, auf der Grundlage eines oder mehrerer Wiederherstellungsdatensätze, die vom Speichersystem erzeugt wurden.
35. 35. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der eine oder die mehreren Wiederherstellungsdatensätze umfassen: einen oder mehrere von einem Wiederherstellungsdatensatz, der vor dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde, oder von einem Wiederherstellungsdatensatz, der nach dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde.
36. 36. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der Wiederherstellungsdatensatz, der vor dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde, eine vorläufige Ransomware-Wiederherstellungsstruktur umfasst, die nur in Übereinstimmung mit einem oder mehreren Parametern für die Wiederherstellung von Ransomware-Software gelöscht oder geändert werden kann.
37. 37. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der eine oder die mehreren Parameter für die Ransomware-Wiederherstellung eine Anzahl oder einen Typ von authentifizierten Einheiten angeben, die eine Löschung oder Änderung der vorläufigen Ransomware-Wiederherstellungsstruktur genehmigen müssen, bevor die vorläufige Ransomware-Wiederherstellungsstruktur gelöscht oder geändert werden kann.
38. 38. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der eine oder die mehreren Parameter für die Ransomware-Wiederherstellung eine Aufbewahrungsdauer angeben, vor der die vorläufige Ransomware-Wiederherstellungsstruktur gelöscht oder geändert werden kann.
39. 39. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die Wiederherstellung ferner auf einer Version der Daten basiert, die von dem Speichersystem gespeichert werden, das sich auf einem anderen System als dem Speichersystem befindet.
40. 40. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, einen ersten Bedrohungserfassungsprozess darstellt; und das Verfahren ferner das Durchführen eines zweiten Bedrohungserfassungsprozesses durch das Datenschutzsystem als Reaktion auf das Durchführen des ersten Bedrohungserfassungsprozesses umfasst, der sich von dem ersten Bedrohungserfassungsprozess unterscheidet und so konfiguriert ist, dass er entweder bestätigt, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung - mit einer Bedrohungserfassung mit höherem Konfidenzniveau als der erste Bedrohungserfassungsprozess - betroffen ist, oder bestimmt, dass das Speichersystem nicht von der Sicherheitsbedrohung betroffen ist.
41. 41. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, das Bestimmen umfasst, dass es eine potentielle Datenverfälschung in dem Speichersystem gibt, und wobei das Verfahren ferner umfasst: Analysieren von Metriken des Speichersystems durch das Datenschutzsystem als Reaktion auf das Erkennen der potentiellen Datenverfälschung; und Bestimmen eines verfälschungsfreien Wiederherstellungspunktes durch das Datenschutzsystem auf der Grundlage der Analyse der Metriken des Speichersystems zur potentiellen Verwendung zur Wiederherstellung von der potentiellen Datenverfälschung.
42. 42. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen durch das Datenschutzsystem, dass der Leseverkehr innerhalb eines Schwellenwerts des Schreibverkehrs während der Zeitperiode liegt; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf dem Bestimmen basiert, dass der Leseverkehr innerhalb des Schwellenwerts des Schreibverkehrs während der Zeitperiode liegt.
43. 43. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Ermitteln eines Attributs, das einem oder mehreren der aus dem Speichersystem gelesenen Daten oder der in das Speichersystem geschriebenen Daten zugeordnet ist, durch das Datenschutzsystem; Darstellen graphischer Information, die dem Attribut zugeordnet ist, durch das Datenschutzsystem innerhalb einer graphischen Benutzeroberfläche, die durch eine Anzeigevorrichtung angezeigt wird; und Empfangen einer Benutzereingabe durch das Datenschutzsystem mittels der graphischen Benutzeroberfläche; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, ferner auf der Benutzereingabe basiert.
44. 44. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Verwenden einer nicht manipulierbaren internen Taktquelle des Speichersystems durch das Datenschutzsystem zum Rückverfolgen der Zeitspanne umfasst.
45. 45. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch einen Controller innerhalb des Speichersystems implementiert wird.
46. 46. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch ein Computersystem implementiert wird, das über ein Netzwerk kommunikativ mit dem Speichersystem gekoppelt ist.
47. 47. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, das Bestimmen umfasst, dass sich möglicherweise Ransomware-Software auf dem Speichersystem befindet (z.B. dass möglicherweise ein Ransomware-Angriff gegen das Speichersystem im Werden oder im Gange ist).
48. 48. Ein System, umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Bestimmen, dass die Gesamtmenge des Leseverkehrs und des Schreibverkehrs, die von einem Speichersystem während einer Zeitspanne verarbeitet werden, einen Schwellenwert überschreitet, wobei der Leseverkehr Daten repräsentiert, die während der Zeitspanne aus dem Speichersystem gelesen wurden, und der Schreibverkehr Daten repräsentiert, die während der Zeitspanne in das Speichersystem geschrieben wurden; Bestimmen, dass der Schreibverkehr weniger komprimierbar ist als der Leseverkehr; und Bestimmen, auf der Grundlage der Gesamtmenge des Leseverkehrs und des Schreibverkehrs, die den Schwellenwert überschreitet, und des Schreibverkehrs, der weniger komprimierbar ist als der Leseverkehr, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist.
49. 49. Das System nach Aussage 48, das eines der in den vorhergehenden Erklärungen genannten Verfahren implementiert.
50. 50. Ein nicht-transitorisches computerlesbares Medium zum Speichern von Befehlen, die bei ihrer Ausführung einen Prozessor eines Datenverarbeitungsgerätes anweisen zum: Bestimmen, dass die Gesamtmenge des Leseverkehrs und des Schreibverkehrs, die von einem Speichersystem während einer Zeitspanne verarbeitet werden, einen Schwellenwert überschreitet, wobei der Leseverkehr Daten repräsentiert, die während der Zeitspanne aus dem Speichersystem gelesen wurden, und der Schreibverkehr Daten repräsentiert, die während der Zeitspanne in das Speichersystem geschrieben wurden; Bestimmen, dass der Schreibverkehr weniger komprimierbar ist als der Leseverkehr; und Bestimmen, auf der Grundlage der Gesamtmenge des Leseverkehrs und des Schreibverkehrs, die den Schwellenwert überschreitet, und des Schreibverkehrs, der weniger komprimierbar ist als der Leseverkehr, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist.
51. 51. Das nicht-transitorische computerlesbare Medium nach Aussage 50, das eine der in den vorhergehenden Aussagen genannten Verfahren implementiert.

The advantages and features of the present disclosure can be further described by the following statements.

1. A method comprising: determining, by a data protection system, that a total of the read traffic and write traffic processed by a storage system during a time period exceeds a threshold, the read traffic representing data read from the storage system during the time period and the write traffic represents data written to the storage system during the time period; Determining, by the data protection system, that the write traffic is less compressible than the read traffic; and determining, by the data protection system, based on the total amount of the read traffic and the write traffic exceeding the threshold and based on the write traffic being less compressible than the read traffic, that the storage system may be affected by a security threat.
2. 2. The method according to one of the preceding statements, further comprising: determining, by the data protection system, an attribute which is associated with one or more of the data read from the storage system or the data written into the storage system; wherein the determining that the storage system may be affected by the security threat is further based on the attribute.
3. 3. The method of one of the preceding statements, wherein the attribute comprises one or more of the following: a host attribute associated with a host associated with the storage system, the data being read from the storage system or the data being written to the storage system Data is associated with the host; an attribute of a source of the read traffic and the write traffic; an attribute of a memory structure within the memory system from which the data is read or to which the data is written; or a storage format attribute associated with a storage format used by the storage system.
4. 4. The method according to one of the preceding statements, further comprising: the data protection system determining a format type of a data instance which is contained in the data written in the storage system; and determining, by the data protection system, that a content of the data instance does not match what is expected of the storage system for the determined format type; wherein the determining that the storage system may be affected by the security threat is further based on determining that the content of the data instance does not match what is expected of the storage system for the determined format type.
5. 5. The method of any preceding statement, further comprising: the data protection system determining a pattern associated with one or more of the read traffic or the write traffic; wherein the determining that the storage system may be affected by the security threat is further based on the pattern.
6. 6. The method according to one of the preceding statements, further comprising: determining, by the data protection system, that the data written to the storage system does not contain any identifiable header information or that it is in the storage system written data includes header information inconsistent with the content contained in the data written in the storage system; wherein determining that the storage system may be affected by the security threat is further based on determining that the data written to the storage system does not include the identifiable header information or that the data written to the storage system includes header information that does not include match the content contained in the data written in the storage system.
7. 7. The method according to one of the preceding statements, further comprising: determining, by the data protection system, that the data read from the storage system is at least partially compressed and contains the identifiable header information; wherein the determining that the storage system may be affected by the security threat is further based on determining that the data read from the storage system is compressed and includes the identifiable header information.
8. 8. The method according to one of the preceding statements, further comprising: determining, by the data protection system, that the data written in the storage system contains data which cannot be decrypted with a key which is managed by an authorized key management system outside the storage system; wherein the determining that the storage system may be affected by the security threat is further based on determining that the data written to the storage system contains data that cannot be decrypted with the key managed by the key management system.
9. 9. The method of any preceding statement, further comprising: determining, by the data protection system, that the data written to the storage system does not contain a correct cryptographic signature associated with an external data encryption service associated with the storage system; wherein the determining that the storage system may be affected by the security threat is further based on determining that the data written to the storage system does not contain the correct cryptographic signature.
10. 10. The method according to one of the preceding statements, further comprising: determining, by the data protection system, that data already stored by the storage system will be deleted or overwritten by the data written in the storage system; wherein the determining that the storage system may be affected by the security threat is further based on determining that the data already stored by the storage system will be deleted or overwritten by the data written to the storage system.
11. 11. The method of any preceding claim, further comprising: accessing, by the data protection system, telephone home data transmitted by the storage system; and detecting, by the data protection system, an anomaly associated with the storage system based on the home phone data; wherein determining that the storage system may be affected by the security threat is further based on the detected anomaly.
12. 12. The method of any preceding statement, wherein detecting the anomaly comprises determining that an overall compressibility of the data stored by the storage system is below a historical norm associated with one or more of the storage system or another storage system.
13. 13. The method according to one of the preceding statements, further comprising: detecting by the data protection system a rate at which data is read from the storage system and written back to the storage system in encrypted form; wherein the determining that the storage system may be affected by the security threat is further based on the detected rate.
14. 14. The method according to one of the preceding statements, further comprising: inputting data, by the data protection system, which are representative of one or more attributes of the read traffic, the write traffic or the storage system, into a machine learning model; wherein the determining that the storage system may be affected by the security threat is further based on an output of the machine learning model.
15. 15. The method according to one of the preceding statements, further comprising: the data protection system determining an anomaly in a garbage collection process carried out by the storage system; wherein the determining that the storage system may be affected by the security threat is further based on determining the anomaly in the garbage collection process.
16. 16. The method of any preceding claim, further comprising: the data protection system determining an attribute of an additional storage system configured to replicate data stored by the storage system; wherein the determining that the storage system may be affected by the security threat is further based on the attribute of the additional storage system.
17. 17. The method of any preceding statement, wherein the threshold represents one or more of a rate, a total, or a difference compared to a historical trend associated with the storage system.
18. 18. The method of any preceding claim, further comprising the data protection system taking remedial action on the storage system in response to determining that the storage system may be affected by the security threat.
19. 19. The method of any preceding claim, wherein performing the remedial action comprises instructing the storage system to generate a recovery record for data that was stored by the storage system.
20. 20. The method of any preceding claim, wherein performing the remedial action further comprises instructing the storage system to transfer the recovery record to a remote storage system for storage by the remote storage system.
21. 21. The method according to one of the preceding statements, wherein the transfer of the recovery data set to the remote storage system is carried out using an NFS protocol (Network File System).
22. 22. The method of any preceding claim, wherein performing the remedial action comprises notifying the remote storage system of the security threat.
23. 23. The method according to one of the preceding statements, further comprising: determining by the data protection system that the storage system is actually not affected by the security threat; and instructing, through the data protection system, the storage system to delete the recovery record in response to determining that the host data is in fact not affected by the security threat.
24. 24. The method according to one of the preceding statements, wherein the recovery data record comprises a snapshot of a storage structure within the storage system.
25. 25. The method according to one of the preceding statements, which further consists in preventing the data protection system from deleting the recovery data set until one or more conditions are met.
26. 26. The method of any preceding statement, further comprising instructing the storage system by the data protection system to generate recovery records over time in accordance with a data protection parameter set, the recovery records for recovering data maintained by the storage system in a State that corresponds to a selectable point in time can be used.
27. 27. The method of any preceding claim, wherein performing the remedial action is, in response to determining that the storage system may be affected by the security threat, instructing the storage system to use one or more of the recovery records to recover from the storage system restore maintained data to a state that corresponds to a point in time that is before a point in time at which the data protection system determines that the storage system may be affected by the security threat.
28. 28. The method of any preceding statement, wherein performing the remedial action further comprises: changing the data protection parameter set for one or more of the recovery data sets in response to determining that the storage system may be affected by the security threat.
29. 29. The method of one of the preceding statements, wherein: the data protection parameter set specifies a retention period for the recovery data sets, the retention period defining a period that each recovery data set is stored before deletion; and modifying the data protection parameter set comprises one or more of the following: increasing the retention period or suspending the retention period so that at least some of the recovery records are not deleted without a specific command provided by a source managing the storage system.
30. 30. The method of one of the preceding statements, wherein: the data protection parameter set specifies a recovery data record generation frequency that defines a frequency at which the recovery data records are generated; and modifying the data protection parameter set comprises increasing the recovery data set generation frequency.
31. 31. The method of any preceding claim, wherein: the data protection parameter set specifies a remote storage frequency that defines a frequency at which a subset of recovery records in the recovery records are transmitted to a remote storage system connected to the storage system via a network; and modifying the data protection parameter set comprises modifying the remote storage frequency.
32. 32. The method of any preceding claim, further comprising: the data protection system maintaining configuration data for the storage system; and determining by the data protection system that the storage system is corrupted due to the security threat; wherein performing the remedial action comprises using the configuration data in response to determining that the storage system is corrupted to rebuild a replacement storage system for the storage system.
33. 33. The method of one of the preceding statements, wherein performing the remedial action comprises providing a notification of the security threat.
34. 34. The method of any preceding claim, wherein performing the remedial action comprises restoring data stored by the storage system to an undamaged state by the data protection system based on one or more restoration records generated by the storage system.
35. 35. The method of any preceding claim, wherein the one or more recovery records include: one or more of a recovery record that was created prior to determining that the storage system may be affected by the security threat, or a recovery record that after determining that the storage system may be affected by the security threat.
36. 36. The method of any preceding claim, wherein the recovery record that was generated prior to determining that the storage system may be affected by the security threat comprises a ransomware provisional recovery structure that is configured only in accordance with one or more parameters for the Recovery from ransomware software can be deleted or modified.
37. 37. The method of any preceding statement, wherein the one or more parameters for ransomware recovery indicate a number or type of authenticated entities that must approve deletion or modification of the provisional ransomware recovery structure before the provisional ransomware Recovery structure can be deleted or modified.
38. 38. The method according to any of the preceding statements, wherein the one or more parameters for the ransomware recovery specify a retention period before which the provisional ransomware recovery structure can be deleted or changed.
39. 39. The method of any preceding claim, wherein the recovery is further based on a version of the data stored by the storage system that is on a different system than the storage system.
40. 40. The method of any preceding claim, wherein: determining that the storage system may be affected by the security threat is a first threat detection process; and the method further comprises the data protection system performing a second threat detection process in response to performing the first threat detection process that is different from the first threat detection process and configured to either confirm that the storage system may be of the security threat - with a threat detection with a higher confidence level than the first threat detection process - is affected, or determines that the storage system is not affected by the security threat.
41. 41. The method of any preceding statement, wherein determining that the storage system may be affected by the security threat comprises determining that there is potential data corruption in the storage system, and wherein the method further comprises: analyzing of metrics of the storage system by the data protection system in response to the detection of the potential data corruption; and determining, by the data protection system, a corruption-free recovery point based on the analysis of the metrics of the storage system for potential use to recover from the potential corruption of data.
42. 42. The method of any preceding statement, further comprising: determining by the data protection system that the read traffic is within a threshold of write traffic during the time period; wherein the determining that the storage system may be affected by the security threat is further based on determining that the read traffic is within the threshold of write traffic during the time period.
43. 43. The method according to one of the preceding statements, further comprising: determining, by the data protection system, an attribute which is assigned to one or more of the data read from the storage system or the data written into the storage system; The data protection system presenting graphical information associated with the attribute within a graphical user interface displayed by a display device; and receiving a user input by the data protection system using the graphical user interface; wherein the determining that the storage system may be affected by the security threat is further based on the user input.
44. 44. The method according to any of the preceding statements, further comprising the data protection system using a non-manipulable internal clock source of the storage system to track the time span.
45. 45. The method according to one of the preceding statements, wherein the data protection system is implemented by a controller within the storage system.
46. 46. The method according to one of the preceding statements, wherein the data protection system is implemented by a computer system that is communicatively coupled to the storage system via a network.
47. 47. The method of any of the preceding statements, wherein determining that the storage system may be affected by the security threat comprises determining that ransomware software may be on the storage system (e.g., that there may be a ransomware attack against the storage system in the Being or is in progress).
48. 48. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: determine that the total amount of read traffic and write traffic processed by a memory system during a period of time exceeds a threshold, the read traffic being data represents that was read from the storage system during the period, and the write traffic represents data that was written to the storage system during the period; Determining that the write traffic is less compressible than the read traffic; and determining, based on the total amount of read traffic and write traffic that exceeds the threshold, and write traffic that is less compressible than read traffic, that the storage system may be exposed to a security threat.
49. 49. The system of statement 48 that implements one of the practices identified in the previous statements.
50. 50. A non-transitory computer readable medium for storing instructions that, when executed, direct a processor of a computing device to: Determine that the total amount of read and write traffic processed by a storage system during a period of time exceeds a threshold, wherein the read traffic represents data read from the storage system during the period and the write traffic represents data written to the storage system during the period; Determining that the write traffic is less compressible than the read traffic; and determining, based on the total amount of read traffic and write traffic that exceeds the threshold, and write traffic that is less compressible than read traffic, that the storage system may be exposed to a security threat.
51. 51. The non-transitory computer readable medium of Statement 50 that implements any of the methods identified in the preceding statements.

1. 1. Verfahren, umfassend: Durchführen eines ersten Sicherheitsbedrohungs-Erfassungsprozesses durch ein Datenschutzsystem für ein Speichersystem; Bestimmen durch das Datenschutzsystem auf der Grundlage des Durchführens des ersten Sicherheitsbedrohungs-Erfassungsprozesses, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist; und Durchführen eines zweiten Sicherheitsbedrohungs-Erfassungsprozesses durch das Datenschutzsystem, wobei der zweite Sicherheitsbedrohungs-Erfassungsprozess eine Bedrohungserfassung mit höherem Konfidenzniveau als der erste Sicherheitsbedrohungs-Erfassungsprozess bereitstellt.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Bestätigen durch das Datenschutzsystem auf der Grundlage des Durchführens des zweiten Sicherheitsbedrohungs-Erfassungsprozesses umfasst, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner umfasst: Durchführen einer ersten Abhilfemaßnahme in Bezug auf das Speichersystem durch das Datenschutzsystem auf der Grundlage des Bestimmens, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist; und Durchführen einer zweiten Abhilfemaßnahme in Bezug auf das Speichersystem durch das Datenschutzsystem auf der Grundlage der Bestätigung, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei sich die erste Abhilfemaßnahme von der zweiten Abhilfemaßnahme unterscheidet.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die erste Abhilfemaßnahme oder die zweite Abhilfemaßnahme eine oder mehrere der folgenden Maßnahmen umfasst: Bereitstellen einer Benachrichtigung, Erzeugen eines ersten Wiederherstellungs-Datensatzes, Verhindern, dass ein zweiter Wiederherstellungs-Datensatz gelöscht oder modifiziert wird, Modifizieren eines Datenschutz-Parametersatzes für einen dritten Wiederherstellungs-Datensatz oder Wiederherstellen von Daten, die durch das Speichersystem gespeichert sind, in einen nicht beschädigten Zustand.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Bestimmen umfasst, durch das Datenschutzsystem auf der Grundlage der Durchführung des zweiten Sicherheitsbedrohungs-Erfassungsprozesses, dass das Speichersystem nicht Ziel der Sicherheitsbedrohung ist.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, die ferner die Rückgängigmachung durch das Datenschutzsystem umfasst, basierend auf dem Bestimmen, dass das Speichersystem nicht von der Sicherheitsbedrohung betroffen ist, um den ersten Sicherheitsbedrohungs-Erfassungsprozess durchzuführen.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Durchführen einer Abhilfemaßnahme in Bezug auf das Speichersystem umfasst, durch das Datenschutzsystem auf der Grundlage des Bestimmens, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen des zweiten Sicherheitsbedrohungs-Erfassungsprozesses als Reaktion auf das Bestimmen erfolgt, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen des zweiten Sicherheitsbedrohungs-Erfassungsprozesses parallel zum Durchführen des ersten Sicherheitsbedrohungs-Erfassungsprozesses erfolgt.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch einen Controller innerhalb des Speichersystems implementiert wird.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch ein Computersystem implementiert wird, das über ein Netzwerk kommunikativ mit dem Speichersystem gekoppelt ist.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, das Bestimmen umfasst, dass möglicherweise ein Ransomware-Angriff auf das Speichersystem im Gange ist.
14. 14. Ein System, umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt, zum: Durchführen, für ein Speichersystem, eines ersten Sicherheitsbedrohungs-Erfassungsprozesses; Bestimmen, auf der Grundlage der Durchführung des ersten Sicherheitsbedrohungs-Erfassungsprozesses, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist; und Durchführen eines zweiten Sicherheitsbedrohungs-Erfassungsprozesses, wobei der zweite Sicherheitsbedrohungs-Erfassungsprozess eine Bedrohungserfassung höherem Konfidenzniveau als der erste Sicherheitsbedrohungs-Erfassungsprozess bereitstellt.
15. 15. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt, um auf der Grundlage des Durchführens des zweiten Sicherheitsbedrohungs-Erfassungsprozesses zu bestätigen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Durchführen, basierend auf dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, einer ersten Abhilfemaßnahme in Bezug auf das Speichersystem; und basierend auf der Bestätigung, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, Durchführen einer zweiten Abhilfemaßnahme in Bezug auf das Speichersystem.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei sich die erste Abhilfemaßnahme von der zweiten Abhilfemaßnahme unterscheidet.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei die erste Abhilfemaßnahme oder die zweite Abhilfemaßnahme eines oder mehreres von Folgendem umfasst: Bereitstellen einer Benachrichtigung, Erzeugen eines ersten Wiederherstellungsdatensatzes, Verhindern, dass ein zweiter Wiederherstellungsdatensatz gelöscht oder modifiziert wird, Modifizieren eines Datenschutzparametersatzes für einen dritten Wiederherstellungsdatensatz oder Wiederherstellen von Daten, die vom Speichersystem gespeichert sind, in einen nicht beschädigten Zustand.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt, um auf der Grundlage der Durchführung des zweiten Sicherheitsbedrohungs-Erfassungsprozesses festzustellen, dass das Speichersystem nicht von der Sicherheitsbedrohung betroffen ist.
20. 20. Ein nicht-transitorisches computerlesbares Medium zum Speichern von Befehlen, die, wenn sie ausgeführt werden, einen Prozessor eines Datenverarbeitungsgeräts anweisen zum: Durchführen, für ein Speichersystem, eines ersten Prozesses zum Erkennen von Sicherheitsbedrohungen; Bestimmen, auf der Grundlage des Durchführens des ersten Sicherheitsbedrohungs-Erfassungsprozesses, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist; und Durchführen eines zweiten Sicherheitsbedrohungs-Erfassungsprozesses, wobei der zweite Sicherheitsbedrohungs-Erfassungsprozess ein Erkennen mit höherem Konfidenzniveau als der erste Sicherheitsbedrohungs-Erfassungsprozess bietet.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: performing a first security threat detection process by a data protection system for a storage system; Determining, by the data protection system, based on performing the first security threat detection process, that the storage system may be affected by a security threat; and performing a second security threat detection process by the data protection system, the second security threat detection process providing a threat detection with a higher level of confidence than the first security threat detection process.
2. 2. The method of any preceding claim, further comprising confirming by the data protection system based on performing the second security threat detection process that the storage system may be affected by the security threat.
3. 3. The method of any preceding claim, further comprising: the data protection system performing a first remedial action on the storage system based on determining that the storage system may be affected by the security threat; and the data protection system performing a second remedial action on the storage system based on the confirmation that the storage system may be affected by the security threat.
4. 4. The method according to one of the preceding statements, wherein the first corrective measure differs from the second corrective measure.
5. 5. The method according to one of the preceding statements, wherein the first remedial measure or the second remedial measure comprises one or more of the following measures: providing a notification, generating a first recovery data record, preventing a second recovery data record from being deleted or modified, Modifying a data protection parameter set for a third recovery data set or restoring data stored by the storage system to an undamaged state.
6. 6. The method of any preceding statement, further comprising determining, by the data protection system based on the performance of the second security threat detection process, that the storage system is not a target of the security threat.
7. 7. The method of any preceding statement, further comprising undoing by the data protection system based on determining that the storage system is not affected by the security threat to perform the first security threat detection process.
8. 8. The method of any preceding claim, further comprising the data protection system taking remedial action to the storage system based on determining that the storage system may be affected by the security threat.
9. 9. The method of any preceding statement, wherein performing the second security threat detection process is in response to determining that the storage system may be affected by the security threat.
10. 10. The method according to one of the preceding statements, wherein the performance of the second security threat detection process takes place in parallel with the performance of the first security threat detection process.
11. 11. The method according to one of the preceding statements, wherein the data protection system is implemented by a controller within the storage system.
12. 12. The method according to one of the preceding statements, wherein the data protection system is implemented by a computer system that is communicatively coupled to the storage system via a network.
13. 13. The method of any preceding statement, wherein determining that the storage system may be affected by the security threat comprises determining that a ransomware attack on the storage system may be in progress.
14. 14. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: perform, for a memory system, a first security threat detection process; Determining, based on the performance of the first security threat detection process, that the storage system may be affected by a security threat; and performing a second security threat detection process, wherein the second security threat detection process has a higher confidence level threat detection than the first Provides security threat detection process.
15. 15. The system of any preceding claim, wherein the processor is further configured to execute the instructions to confirm that the storage system may be affected by the security threat based on performing the second security threat detection process.
16. 16. The system of any preceding claim, wherein the processor is further configured to execute the instructions to: perform a first remedial action on the storage system based on the determination that the storage system may be affected by the security threat ; and based on the confirmation that the storage system may be affected by the security threat, taking a second remedial action on the storage system.
17. 17. The system of any of the preceding statements, wherein the first corrective action is different from the second corrective action.
18. 18. The system according to one of the preceding statements, wherein the first remedial action or the second remedial action comprises one or more of the following: providing a notification, generating a first recovery data set, preventing a second recovery data set from being deleted or modified, modifying a data protection parameter set for a third recovery data set or restoring data stored on the storage system to an undamaged state.
19. 19. The system of any preceding claim, wherein the processor is further configured to execute the instructions to determine that the storage system is not affected by the security threat based on the performance of the second security threat detection process.
20. 20. A non-transitory computer readable medium for storing instructions which, when executed, instruct a processor of a computing device to: perform, for a storage system, a first process of detecting security threats; Determining, based on performing the first security threat detection process, that the storage system may be affected by a security threat; and performing a second security threat detection process, the second security threat detection process providing detection with a higher level of confidence than the first security threat detection process.

1. 1. Verfahren, umfassend: Anweisen eines Speichersystems durch ein Datenschutzsystem, Wiederherstellungsdatensätze im Laufe der Zeit in Übereinstimmung mit einem Datenschutzparametersatz zu erzeugen, wobei die Wiederherstellungsdatensätze verwendbar sind, um Daten, die durch das Speichersystem gepflegt werden, in einen Zustand wiederherzustellen, der einem wählbaren Zeitpunkt entspricht; Bestimmen durch das Datenschutzsystem, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist; und Modifizieren des Datenschutzparametersatzes für einen oder mehrere der Wiederherstellungsdatensätze durch das Datenschutzsystem als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Aufbewahrungsdauer für die Wiederherstellungsdatensätze spezifiziert, wobei die Aufbewahrungsdauer eine Dauer definiert, die jeder Wiederherstellungsdatensatz vor dem Löschen gespeichert wird; und das Modifizieren des Datenschutzparametersatzes eines oder mehreres von Folgendem umfasst: Erhöhen der Aufbewahrungsdauer oder Aussetzen der Aufbewahrungsdauer, so dass zumindest einige der Wiederherstellungsdatensätze nicht ohne einen spezifischen Befehl gelöscht werden, der von einer Quelle bereitgestellt wird, die das Speichersystem verwaltet.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Wiederherstellungsdatensatz-Erzeugungsfrequenz spezifiziert, die eine Frequenz definiert, mit der die Wiederherstellungsdatensätze erzeugt werden; und das Modifizieren des Datenschutzparametersatzes eine Erhöhung der Wiederherstellungsdatensatz-Erzeugungsfrequenz umfasst.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Fernspeicherfrequenz spezifiziert, die eine Frequenz definiert, mit der eine Teilmenge von Wiederherstellungsdatensätzen in den Wiederherstellungsdatensätzen zu einem entfernten Speichersystem übertragen wird, das mit dem Speichersystem über ein Netzwerk verbunden ist; und das Modifizieren des Datenschutzparametersatzes das Modifizieren der Fernspeicherfrequenz umfasst.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner umfasst: Ermitteln einer Anomalie in Bezug auf das Speichersystem durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, auf dem Ermitteln der Anomalie basiert.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie umfasst: Bestimmen, dass eine Gesamtmenge an Leseverkehr und Schreibverkehr, die durch das Speichersystem während einer Zeitperiode verarbeitet werden, einen Schwellenwert überschreitet, wobei der Leseverkehr Daten repräsentiert, die während der Zeitperiode aus dem Speichersystem gelesen wurden, und der Schreibverkehr Daten repräsentiert, die während der Zeitperiode in das Speichersystem geschrieben wurden; und Bestimmen durch das Datenschutzsystem, dass der Schreibverkehr weniger komprimierbar ist als der Leseverkehr.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Durchführen einer zusätzlichen Abhilfemaßnahme in Bezug auf das Speichersystem durch das Datenschutzsystem als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der zusätzlichen Abhilfemaßnahme das Anweisen des Speichersystems umfasst, einen in den Wiederherstellungsdatensätzen enthaltenen Wiederherstellungsdatensatz an ein entferntes Speichersystem zum Speichern durch das entfernte Speichersystem zu übertragen.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der zusätzlichen Abhilfemaßnahmen das Bereitstellen einer Benachrichtigung über die Sicherheitsbedrohung umfasst.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch einen Controller innerhalb des Speichersystems implementiert wird.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch ein Computersystem implementiert wird, das über ein Netzwerk kommunikativ mit dem Speichersystem gekoppelt ist.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, das Bestimmen umfasst, dass sich möglicherweise Ransomware auf dem Speichersystem befindet.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner die Verwendung mindestens eines der Wiederherstellungsdatensätze durch das Datenschutzsystem umfasst, um die vom Speichersystem gepflegten Daten in den Zustand wiederherzustellen, der dem wählbaren Zeitpunkt entspricht.
14. 14. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, durchgeführt wird, während die Wiederherstellungsdatensätze erzeugt werden.
15. 15. Ein System, das folgendes umfasst: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Anweisen eines Speichersystems, Wiederherstellungsdatensätze im Laufe der Zeit in Übereinstimmung mit einem Datenschutzparametersatz zu erzeugen, wobei die Wiederherstellungsdatensätze dazu verwendet werden können, Daten, die durch das Speichersystem aufrechterhalten wurden, in einen Zustand wiederherzustellen, der einem wählbaren Zeitpunkt entspricht; Bestimmen, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist; und als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, Modifizieren des Datenschutzparametersatzes für einen oder mehrere der Wiederherstellungsdatensätze.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Aufbewahrungsdauer für die Wiederherstellungsdatensätze spezifiziert, wobei die Aufbewahrungsdauer eine Dauer definiert, die jeder Wiederherstellungsdatensatz vor dem Löschen gespeichert wird; und das Modifizieren des Datenschutzparametersatzes eine oder mehrere der folgenden Maßnahmen umfasst: Erhöhen der Aufbewahrungsdauer oder Aussetzen der Aufbewahrungsdauer, so dass zumindest einige der Wiederherstellungsdatensätze nicht ohne einen spezifischen Befehl gelöscht werden, der von einer Quelle bereitgestellt wird, die das Speichersystem verwaltet.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Wiederherstellungsdatensatz-Erzeugungsfrequenz spezifiziert, die eine Frequenz definiert, mit der die Wiederherstellungsdatensätze erzeugt werden; und das Modifizieren des Datenschutzparametersatzes ein Erhöhen der Wiederherstellungsdatensatz-Erzeugungsfrequenz umfasst.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei: der Datenschutzparametersatz eine Fernspeicherfrequenz spezifiziert, die eine Frequenz definiert, mit der eine Teilmenge von Wiederherstellungsdatensätzen in den Wiederherstellungsdatensätzen zu einem entfernten Speichersystem übertragen wird, das mit dem Speichersystem über ein Netzwerk verbunden ist; und das Modifizieren des Datenschutzparametersatzes das Modifizieren der Fernspeicherfrequenz umfasst.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner konfiguriert ist, um die Befehle auszuführen, um eine Anomalie in Bezug auf das Speichersystem zu ermitteln; und das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, auf dem Ermitteln der Anomalie basiert.
20. 20. Ein nicht-transitorisches computerlesbares Medium, das Befehle speichert, die, wenn sie ausgeführt werden, einen Prozessor eines Datenverarbeitungsgerätes anweisen zum: Anweisen eines Speichersystems, Wiederherstellungs-Datensätze im Laufe der Zeit in Übereinstimmung mit einem Datenschutzparametersatz zu erzeugen, wobei die Wiederherstellungs-Datensätze dazu verwendet werden können, Daten, die durch das Speichersystem aufrechterhalten wurden, in einen Zustand wiederherzustellen, der einem wählbaren Zeitpunkt entspricht; Bestimmen, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist; und als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, Ändern des Datenschutzparametersatzes für einen oder mehrere der Wiederherstellungs-Datensätze.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: instructing a storage system by a data protection system to generate recovery records over time in accordance with a data protection parameter set, the recovery records being usable to recover data maintained by the storage system to a state that is a selectable one Time corresponds to; Determining, by the data protection system, that the storage system may have been affected by a security threat; and modifying, by the data protection system, the data protection parameter set for one or more of the recovery data sets in response to determining that the storage system may be affected by the security threat.
2. 2. The method according to one of the preceding statements, wherein: the data protection parameter set specifies a retention period for the recovery data sets, the retention period defining a period that each recovery data set is stored before deletion; and modifying the data protection parameter set comprises one or more of the following: increasing the retention period or suspending the retention period so that at least some of the recovery records are not deleted without a specific command provided by a source managing the storage system.
3. 3. The method of any preceding claim, wherein: the data protection parameter set specifies a recovery data record generation frequency that defines a frequency at which the recovery data records are generated; and modifying the data protection parameter set comprises increasing the recovery data set generation frequency.
4. 4. The method of one of the preceding statements, wherein: the data protection parameter set specifies a remote storage frequency that defines a frequency at which a subset of recovery records in the recovery records form a remote storage system connected to the storage system via a network; and modifying the data protection parameter set comprises modifying the remote storage frequency.
5. 5. The method of any preceding statement, further comprising: the data protection system determining an anomaly related to the storage system; wherein determining that the storage system may be affected by the security threat is based on determining the anomaly.
6. 6. The method of any of the preceding statements, wherein determining the anomaly comprises: determining that a total amount of read traffic and write traffic processed by the storage system during a period of time exceeds a threshold, the read traffic representing data received during the Time period was read from the storage system and the write traffic represents data written to the storage system during the time period; and determining by the data protection system that the write traffic is less compressible than the read traffic.
7. 7. The method of any preceding statement, further comprising the data protection system taking additional remedial action to the storage system in response to determining that the storage system may be affected by the security threat.
8. 8. The method of any preceding claim, wherein performing the additional remedial action comprises instructing the storage system to transfer a recovery record contained in the recovery records to a remote storage system for storage by the remote storage system.
9. 9. The method of one of the preceding statements, wherein performing the additional remedial measures comprises providing a notification of the security threat.
10. 10. The method according to one of the preceding statements, wherein the data protection system is implemented by a controller within the storage system.
11. 11. The method according to one of the preceding statements, wherein the data protection system is implemented by a computer system that is communicatively coupled to the storage system via a network.
12. 12. The method of any preceding claim, wherein determining that the storage system may be affected by the security threat comprises determining that ransomware may be on the storage system.
13. 13. The method according to one of the preceding statements, further comprising the use of at least one of the recovery data sets by the data protection system in order to restore the data maintained by the storage system to the state that corresponds to the selectable point in time.
14. 14. The method of any preceding claim, wherein determining that the storage system may be affected by the security threat is performed while the recovery records are being generated.
15. 15. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to carry out the instructions for: instructing a memory system to generate recovery records over time in accordance with a data protection parameter set, the recovery records being able to be used to modify data that is processed by the storage system has been maintained to be restored to a state corresponding to a selectable point in time; Determining that the storage system may be affected by a security threat; and in response to determining that the storage system may be affected by the security threat, modifying the data protection parameter set for one or more of the recovery data sets.
16. 16. The system of any preceding claim, wherein: the data protection parameter set specifies a retention period for the recovery records, the retention period defining a length of time each recovery record is stored prior to deletion; and modifying the data protection parameter set comprises one or more of the following measures: increasing the retention period or suspending the retention period so that at least some of the recovery records are not deleted without a specific command provided by a source managing the storage system.
17. 17. The system of any preceding claim, wherein: the data protection parameter set specifies a recovery data set generation frequency that is a Defines the frequency with which the recovery data sets are generated; and modifying the data protection parameter set comprises increasing the recovery data set generation frequency.
18. 18. The system of any preceding claim, wherein: the data protection parameter set specifies a remote storage frequency that defines a frequency at which a subset of recovery records in the recovery records are transmitted to a remote storage system connected to the storage system via a network; and modifying the data protection parameter set comprises modifying the remote storage frequency.
19. 19. The system of any preceding statement, wherein the processor is further configured to execute the instructions to determine an anomaly related to the storage system; and determining that the storage system may be affected by the security threat is based on determining the anomaly.
20. 20. A non-transitory computer readable medium that stores instructions that, when executed, instruct a processor of a computing device to: instruct a storage system to generate recovery records over time in accordance with a data protection parameter set, the recovery Data sets can be used to restore data maintained by the storage system to a state that corresponds to a selectable point in time; Determining that the storage system may be affected by a security threat; and in response to determining that the storage system may be affected by the security threat, changing the data protection parameter set for one or more of the recovery data sets.

• 1. Verfahren, umfassend: Erfassen einer potentiellen Datenverfälschung in dem Speichersystem durch ein Datenschutzsystem für ein Speichersystem;
• 2. Analysieren einer oder mehrerer Metriken des Speichersystems durch das Datenschutzsystem als Reaktion auf das Erkennen der potentiellen Datenbeschädigung; und Bestimmen eines korruptionsfreien Wiederherstellungspunktes durch das Datenschutzsystem auf der Grundlage der Analyse der einen oder der mehreren Metriken des Speichersystems, für das potentielle Verwenden zum Wiederherstellen nach der potentiellen Datenbeschädigung.
• 2. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner umfasst: Auswählen eines Wiederherstellungsdatensatzes, der dem korruptionsfreien Wiederherstellungspunkt entspricht, durch das Datenschutzsystem auf der Grundlage des korruptionsfreien Wiederherstellungspunktes; und Wiederherstellen von Daten, die durch das Speichersystem gespeichert sind, durch das Datenschutzsystem auf der Grundlage des ausgewählten Wiederherstellungsdatensatzes in einen nicht korrupten Zustand.
• 3. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Bestimmen durch das Datenschutzsystem, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist, die die potenzielle Datenkorruption verursacht.
• 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der Wiederherstellungsdatensatz einen oder mehrere von einem Wiederherstellungsdatensatz umfasst, der vor dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde, oder einem Wiederherstellungsdatensatz, der nach dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde.
• 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der Wiederherstellungsdatensatz, der vor dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde, eine vorläufige Ransomware-Wiederherstellungsstruktur umfasst, die nur in Übereinstimmung mit einem oder mehreren Ransomware- Wiederherstellungsparametern gelöscht oder geändert werden kann.
• 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der eine oder die mehreren Ransomware-Wiederherstellungsparameter eine Anzahl oder einen Typ von authentifizierten Einheiten angeben, die eine Löschung oder Änderung der vorläufigen Ransomware-Wiederherstellungsstruktur genehmigen müssen, bevor die vorläufige Ransomware-Wiederherstellungsstruktur gelöscht oder geändert werden kann.
• 7. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der eine oder die mehreren Ransomware-Wiederherstellungsparameter eine Aufbewahrungsdauer angeben, vor der die vorläufige Ransomware-Wiederherstellungsstruktur gelöscht oder geändert werden kann.
• 8. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner umfasst: Empfangen einer Benutzereingabe durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, auf der Benutzereingabe basiert.
• 9. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Ermitteln einer Anomalie in Bezug auf das Speichersystem durch das Datenschutzsystem; wobei das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, auf dem Ermitteln der Anomalie basiert.
• 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Wiederherstellen ferner auf einer Version der Daten basiert, die von dem Speichersystem gespeichert werden, das sich auf einem anderen System als dem Speichersystem befindet.
• 11. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Darstellen einer Visualisierung mindestens einer in der einen oder den mehreren Metrik(en) enthaltenen Metrik(en) durch das Datenschutzsystem.
• 12. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Empfangen von Benutzereingaben durch das Datenschutzsystem auf der Grundlage der Visualisierung; wobei das Bestimmen des korruptionsfreien Wiederherstellungspunktes ferner auf der Benutzereingabe basiert.
• 13. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch einen Controller innerhalb des Speichersystems implementiert wird.
• 14. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Datenschutzsystem durch ein Computersystem implementiert wird, das über ein Netzwerk kommunikativ mit dem Speichersystem gekoppelt ist.
• 15. Ein System, umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Erkennen einer potentiellen Datenkorruption in einem Speichersystem; als Reaktion auf das Erkennen der potentiellen Datenkorruption, Analysieren einer oder mehrerer Metriken des Speichersystems; und auf der Grundlage des Analysierens der einen oder mehreren Metriken des Speichersystems, Bestimmen eines korruptionsfreien Wiederherstellungspunkts für die potentielle Verwendung zum Wiederherstellen von der potentiellen Datenkorruption.
• 16. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Auswählen, auf der Grundlage des korruptionsfreien Wiederherstellungspunktes, eines dem korruptionsfreien Wiederherstellungspunkt entsprechenden Wiederherstellungsdatensatzes; und, auf der Grundlage des ausgewählten Wiederherstellungsdatensatzes, Wiederherstellen der vom Speichersystem gespeicherten Daten in einen nicht korrupten Zustand.
• 17. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt, um festzustellen, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist, die eine potenzielle Datenverfälschung verursacht.
• 18. Das System nach einer der vorhergehenden Aussagen, wobei der Wiederherstellungsdatensatz einen oder mehrere Wiederherstellungsdatensätze umfasst, die vor dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, oder einen Wiederherstellungsdatensatz, der nach dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde.
• 19. Das System nach einer der vorhergehenden Aussagen, wobei der Wiederherstellungsdatensatz, der vor dem Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, erzeugt wurde, eine vorläufige Ransomware-Wiederherstellungsstruktur umfasst, die nur in Übereinstimmung mit einem oder mehreren Ransomware-Wiederherstellungsparametern gelöscht oder geändert werden kann.
• 20. Ein nicht-transitorisches computerlesbares Medium zum Speichern von Befehlen, die, wenn sie ausgeführt werden, einen Prozessor eines Datenverarbeitungsgeräts anweisen, eine potentielle Datenverfälschung in einem Speichersystem zu erkennen; als Reaktion auf das Erkennen der potentiellen Datenverfälschung, Analysieren einer oder mehrerer Metriken des Speichersystems; und auf der Grundlage des Analysierens der einen oder mehreren Metriken des Speichersystems, Bestimmen eines verfälschungsfreien Wiederherstellungspunkts für die potentielle Verwendung zum Wiederherstellen von der potentiellen Datenverfälschung.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

• A method, comprising: detecting a potential data corruption in the storage system by a data protection system for a storage system;
• 2. The data protection system analyzing one or more metrics of the storage system in response to detecting potential data corruption; and determining, by the data protection system, a corruption-free recovery point based on the analysis of the one or more metrics of the storage system for potential use in recovering from the potential data corruption.
• 2. The method of one of the preceding statements, further comprising: selecting, by the data protection system, a recovery data set corresponding to the corruption-free recovery point based on the corruption-free recovery point; and restoring data stored by the storage system to a non-corrupt state based on the selected restoration data set by the data protection system.
• 3. The method of any preceding statement, further comprising determining by the data protection system that the storage system may be affected by a security threat that is causing the potential data corruption.
• 4. The method according to any of the preceding statements, wherein the recovery data set comprises one or more of a recovery data set that was generated prior to determining that the storage system may be affected by the security threat, or a recovery data set that was generated after determining that the Storage system may be affected by the security threat that was created.
• 5. The method according to any of the preceding statements, wherein the recovery record that was generated prior to determining that the storage system may be affected by the security threat comprises a provisional ransomware recovery structure that is only in accordance with one or more ransomware recovery parameters can be deleted or changed.
• 6. The method according to any of the preceding statements, wherein the one or more ransomware recovery parameters specify a number or a type of authenticated entities that must approve a deletion or modification of the provisional ransomware recovery structure before the provisional ransomware Recovery structure can be deleted or modified.
• 7. The method according to one of the preceding statements, wherein the one or more ransomware recovery parameters specify a retention period before which the provisional ransomware recovery structure can be deleted or changed.
• 8. The method of any preceding claim, further comprising: the data protection system receiving user input; wherein the determining that the storage system may be affected by the security threat is based on the user input.
• 9. The method of any preceding statement, further comprising: the data protection system determining an anomaly relating to the storage system; wherein determining that the storage system may be affected by the security threat is based on determining the anomaly.
• 10. The method of any preceding claim, wherein the restoring is further based on a version of the data stored by the storage system that is on a system other than the storage system.
• 11. The method according to one of the preceding statements, further comprising the display of a visualization of at least one metric (s) contained in the one or more metrics by the data protection system.
• 12. The method of one of the preceding statements, further comprising: receiving user input by the data protection system based on the visualization; wherein determining the corruption free recovery point is further based on the user input.
• 13. The method according to one of the preceding statements, wherein the data protection system is implemented by a controller within the storage system.
• 14. The method according to one of the preceding statements, wherein the data protection system is implemented by a computer system that is communicatively coupled to the storage system via a network.
• 15. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: detect potential data corruption in a memory system; in response to detecting potential data corruption, analyzing one or more metrics of the storage system; and based on analyzing the one or more metrics of the storage system, determining a corruption-free recovery point for potential use to recover from the potential data corruption.
• 16. The system of any preceding claim, wherein the processor is further configured to execute the instructions to: select, based on the corruption-free recovery point, a recovery data set corresponding to the corruption-free recovery point; and, based on the selected recovery data set, recovering the data stored by the storage system to a non-corrupted state.
• 17. The system of any preceding statement, wherein the processor is further configured to execute the instructions to determine that the storage system may have been affected by a security threat that is causing potential data corruption.
• 18. The system of any preceding claim, wherein the recovery record includes one or more recovery records that were prior to determining that the storage system may be affected by the security threat, or a recovery record that was post-determined after determining that the storage system may be affected by the security threat is affected, was generated.
• 19. The system of any of the preceding statements, wherein the recovery record that was generated prior to determining that the storage system may be affected by the security threat comprises a ransomware provisional recovery structure that is only in accordance with one or more ransomware recovery parameters can be deleted or changed.
• 20. A non-transitory computer readable medium for storing instructions which, when executed, instruct a processor of a data processing device to detect potential data corruption in a storage system; in response to detecting potential data corruption, analyzing one or more metrics of the storage system; and based on analyzing the one or more metrics of the storage system, determining a corruption-free recovery point for potential use to recover from the potential corruption of data.

1. 1. Verfahren, umfassend: Erfassen einer Anforderung zum Durchführen einer Operation in Bezug auf ein Speichersystem durch ein Datenschutzsystem; Ermitteln eines oder mehrerer Attribute der Anforderung durch das Datenschutzsystem; Bestimmen durch das Datenschutzsystem, auf der Grundlage des einen oder der mehreren Attribute, dass die Anforderung möglicherweise mit einer Sicherheitsbedrohung gegen das Speichersystem in Zusammenhang steht; und Drosseln einer Durchführung der Operation durch das Datenschutzsystem, auf der Grundlage des Bestimmens, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung gegen das Speichersystem in Zusammenhang steht.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Erfassen einer zusätzlichen Anforderung zum Durchführen einer zusätzlichen Operation in Bezug auf das Speichersystem durch das Datenschutzsystem; Ermitteln eines oder mehrerer Attribute der zusätzlichen Anforderung durch das Datenschutzsystem; Bestimmen durch das Datenschutzsystem auf der Grundlage des einen oder der mehreren Attribute der zusätzlichen Anforderung, dass die zusätzliche Anforderung nicht mit der Sicherheitsbedrohung gegen das Speichersystem in Zusammenhang steht; und Unterlassen der Drosselung einer Leistung der zusätzlichen Operation durch das Datenschutzsystem auf der Grundlage des Bestimmens, dass die zusätzliche Operation nicht mit der Sicherheitsbedrohung gegen das Speichersystem in Zusammenhang steht.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen, durch das Datenschutzsystem, vor dem Erfassen der Anforderung zum Durchführen der Operation, dass ein durch das Speichersystem gespeicherter Datensatz sich in einem gefährdeten Zustand befindet, in dem der Datensatz möglicherweise von der Sicherheitsbedrohung betroffen ist; wobei die Drosselung der Durchführung der Operation ferner auf dem Bestimmen basiert, dass der durch das Speichersystem gespeicherte Datensatz sich in dem gefährdeten Zustand befindet.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen durch das Datenschutzsystem, nach der Drosselung der Durchführung der Operation, dass sich der vom Speichersystem gespeicherte Datensatz nicht mehr in dem gefährdeten Zustand befindet; Erfassen einer zusätzlichen Anforderung zum Durchführen einer zusätzlichen Operation in Bezug auf das Speichersystem durch das Datenschutzsystem, während sich der vom Speichersystem gespeicherte Datensatz nicht mehr in dem gefährdeten Zustand befindet; und Unterlassen der Drosselung der Durchführung der zusätzlichen Operation durch das Datenschutzsystem auf der Grundlage des vom Speichersystem gespeicherten Datensatzes, der sich nicht mehr in dem gefährdeten Zustand befindet.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die Operation eine oder mehrere Schreiboperationen, Leseoperationen oder eingeschränkte Operationen enthält.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: die Anforderung eine Anforderung zum Schreiben von Daten in das Speichersystem umfasst; das Ermitteln des einen oder mehrerer Attribute der Anforderung das Ermitteln einer Komprimierbarkeit der Daten umfasst; und das Bestimmen, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung in Zusammenhang steht, das Bestimmen umfasst, dass die Komprimierbarkeit unter einem Schwellenwert liegt.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: die Anforderung eine Anforderung zum Schreiben von Daten in das Speichersystem umfasst; das Ermitteln des einen oder der mehrerer Attribute der Anforderung das Ermitteln eines Formats der Daten umfasst; und das Bestimmen, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung zusammenhängt, das Bestimmen umfasst, dass das Format nicht mit einem erwarteten Format für die Daten übereinstimmt.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des einen oder der mehrerer Attribute der Anforderung das Ermitteln einer Quelle der Anforderung umfasst; und das Bestimmen, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung in Zusammenhang steht, eines oder mehrere der folgenden Verfahren umfasst: Bestimmen, dass die Quelle zuvor mit einer oder mehreren Sicherheitsbedrohungen gegen das Speichersystem in Zusammenhang gebracht wurde, Bestimmen, dass die Quelle die Quelle für mehr als einen vorbestimmten Schwellenwert von Anforderungen zum Durchführen von Operationen in Bezug auf das Speichersystem während einer vorbestimmten Zeitperiode ist, oder Ermitteln einer Anomalie in einem Muster von Anforderungen, die von der Quelle bereitgestellt werden.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: die Anforderung eine Anforderung zum Löschen oder Ändern von Daten umfasst, die durch das Speichersystem gespeichert sind; und das Ermitteln des einen oder der mehreren Attribute der Anforderung das Ermitteln eines Attributs der Daten umfasst.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Drosseln das Begrenzen einer Schreibgeschwindigkeit in Bezug auf das Speichersystem auf eine bestimmte Anzahl von Schreibvorgängen pro Sekunde umfasst.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen eines oder mehrerer eines aktuellen Speicherzustands oder eines aktuellen Arbeitsbelastungszustands des Speichersystems durch das Datenschutzsystem vor dem Erfassen der Anforderung zum Durchführen der Operation; wobei das Drosseln der Durchführung der Operation ferner auf einem oder mehreren von dem aktuellen Speicherzustand und dem aktuellen Arbeitsbelastungszustands basiert.
12. 12. Ein Verfahren, umfassend: Erfassen, durch ein Datenschutzsystem, einer Vielzahl von Anforderungen zum Durchführen einer Vielzahl von Operationen in Bezug auf ein Speichersystem, während sich ein durch das Speichersystem gespeicherter Datensatz in einem gefährdeten Zustand befindet, in dem der durch das Speichersystem gespeicherte Datensatz möglicherweise von einer Sicherheitsbedrohung betroffen ist; Ermitteln, durch das Datenschutzsystem, eines oder mehrerer Attribute der Anforderungen; Bestimmen, durch das Datenschutzsystem, auf der Grundlage des einen oder der mehreren Attribute, dass eine erste Teilmenge von Anforderungen innerhalb der Vielzahl von Anforderungen möglicherweise mit der Sicherheitsbedrohung in Zusammenhang steht, wobei die erste Teilmenge von Anforderungen Anforderungen zum Durchführen einer ersten Teilmenge von Operationen umfasst, die in der Vielzahl von Optionen enthalten sind; Bestimmen, durch das Datenschutzsystem, auf der Grundlage des einen oder der mehreren Attribute, dass eine zweite Teilmenge von Anforderungen innerhalb der Vielzahl von Anforderungen nicht mit der Sicherheitsbedrohung in Beziehung steht, wobei die zweite Teilmenge von Anforderungen Anforderungen zum Durchführen einer zweiten Teilmenge von Operationen umfasst, die in der Vielzahl von Optionen enthalten sind; Drosseln einer Leistung der ersten Teilmenge von Operationen durch das Datenschutzsystem auf der Grundlage des Bestimmens, dass die erste Teilmenge von Anforderungen mit der Sicherheitsbedrohung in Beziehung steht; und Verzichten, durch das Datenschutzsystem, auf das Drosseln einer Leistung der zweiten Teilmenge von Operationen, auf der Grundlage des Bestimmens, dass die zweite Teilmenge von Anforderungen nicht mit der Sicherheitsbedrohung in Beziehung steht.
13. 13. System, folgendes umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Erfassen einer Anforderung zum Durchführen einer Operation in Bezug auf ein Speichersystem; Ermitteln eines oder mehrerer Attribute der Anforderung; Bestimmen, auf der Grundlage des einen oder der mehreren Attribute, dass die Anforderung möglicherweise mit einer Sicherheitsbedrohung gegen das Speichersystem zusammenhängt; und Drosseln, auf der Grundlage des Bestimmens, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung zusammenhängt, eines Durchführens der Operation.
14. 14. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Erkennen einer zusätzlichen Anforderung zum Durchführen einer zusätzlichen Operation in Bezug auf das Speichersystem; Ermitteln eines oder mehrerer Attribute der zusätzlichen Anforderung; Bestimmen, auf der Grundlage des einen oder der mehreren Attribute der zusätzlichen Anforderung, dass die zusätzliche Anforderung nicht mit der Sicherheitsbedrohung gegen das Speichersystem in Zusammenhang steht; und Verzichten, auf der Grundlage des Bestimmens, dass die zusätzliche Operation nicht mit der Sicherheitsbedrohung gegen das Speichersystem in Zusammenhang steht, auf das Drosseln einer Leistung der zusätzlichen Operation.
15. 15. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Bestimmen, vor dem Erfassen der Anforderung zum Durchführen der Operation, dass sich der vom Speichersystem gespeicherte Datensatz in einem gefährdeten Zustand befindet, in dem der vom Speichersystem gespeicherte Datensatz möglicherweise von der Sicherheitsbedrohung betroffen ist; wobei das Drosseln der Leistung der Operation ferner auf dem Bestimmen basiert, dass sich der vom Speichersystem gespeicherte Datensatz in dem gefährdeten Zustand befindet.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Bestimmen, nach der Drosselung der Leistung der Operation, dass der vom Speichersystem gespeicherte Datensatz nicht mehr im gefährdeten Zustand ist; Erkennen, während der vom Speichersystem gespeicherte Datensatz nicht mehr im gefährdeten Zustand ist, einer zusätzlichen Anforderung zum Durchführen einer zusätzlichen Operation in Bezug auf das Speichersystem; und Verzichten, auf der Grundlage des vom Speichersystem gespeicherten Datensatzes, der sich nicht mehr im gefährdeten Zustand befindet, auf das Drosseln der Leistung der zusätzlichen Operation.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei die Operation eine oder mehrere Schreiboperationen, Leseoperationen oder eingeschränkte Operationen einschließt.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei: die Anforderung eine Anforderung zum Schreiben von Daten in das Speichersystem umfasst; das Ermitteln des einen oder der mehreren Attribute der Anforderung das Ermitteln einer Komprimierbarkeit der Daten umfasst; und das Bestimmen, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung in Zusammenhang steht, das Bestimmen umfasst, dass die Komprimierbarkeit unter einem Schwellenwert liegt.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei: die Anforderung eine Anforderung zum Schreiben von Daten in das Speichersystem umfasst; das Ermitteln des einen oder der mehreren Attribute der Anforderung das Ermitteln eines Formats der Daten umfasst; und das Bestimmen, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung zusammenhängt, das Bestimmen umfasst, dass das Format nicht mit einem erwarteten Format für die Daten übereinstimmt.
20. 20. Das System nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des einen oder der mehreren Attribute der Anforderung das Ermitteln einer Quelle der Anforderung umfasst; und das Bestimmen, dass die Anforderung möglicherweise mit der Sicherheitsbedrohung in Zusammenhang steht, eines oder mehrere der folgenden Verfahren umfasst: Bestimmen, dass die Quelle zuvor mit einer oder mehreren Sicherheitsbedrohungen gegen das Speichersystem in Zusammenhang gebracht wurde, Bestimmen, dass die Quelle die Quelle ist für mehr als einen vorbestimmten Schwellenwert von Anforderungen zum Durchführen von Operationen in Bezug auf das Speichersystem während einer vorbestimmten Zeitperiode, oder Ermitteln einer Anomalie in einem Muster von Anforderungen, die von der Quelle bereitgestellt werden.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: detecting a request by a data protection system to perform an operation on a storage system; The data protection system determining one or more attributes of the request; Determining, by the data protection system, based on the one or more attributes, that the request may be related to a security threat to the storage system; and throttling the data protection system from performing the operation based on the determination that the request may be related to the security threat to the storage system.
2. 2. The method of one of the preceding statements, further comprising: detecting an additional request for performing an additional operation with respect to the storage system by the data protection system; The data protection system determining one or more attributes of the additional requirement; Determining, by the data protection system, based on the one or more attributes of the additional requirement, that the additional requirement is not related to the security threat to the storage system; and the data protection system failing to throttle performance of the additional operation based on the determination that the additional operation is unrelated to the security threat to the storage system.
3. 3. The method of one of the preceding statements, further comprising: determining, by the data protection system, prior to detecting the request to perform the operation, that a data set stored by the storage system is in a compromised state in which the data set may be of the Security threat is affected; wherein the throttling of the performance of the operation is further based on determining that the data set stored by the storage system is in the compromised state.
4. 4. The method according to one of the preceding statements, further comprising: determining by the data protection system, after the performance of the operation has been throttled, that the data set stored by the storage system is no longer in the vulnerable state; Detecting by the data protection system an additional request to perform an additional operation in relation to the storage system while the data set stored by the storage system is no longer in the compromised state; and failing to throttle the data protection system from performing the additional operation based on the data set stored by the storage system that is no longer in the compromised state.
5. 5. The method according to one of the preceding statements, wherein the operation contains one or more write operations, read operations or restricted operations.
6. 6. The method of any preceding claim, wherein: the request comprises a request to write data to the storage system; determining the one or more attributes of the request comprises determining compressibility of the data; and determining that the request may be related to the security threat comprises determining that the compressibility is below a threshold.
7. 7. The method of any preceding claim, wherein: the request comprises a request to write data to the storage system; determining the one or more attributes of the request comprises determining a format of the data; and determining that the request may be related to the security threat comprises determining that the format does not match an expected format for the data.
8. 8. The method of one of the preceding statements, wherein: determining the one or more attributes of the request comprises determining a source of the request; and determining that the request may be related to the security threat comprises one or more of the following methods: determining that the source was previously associated with one or more security threats to the storage system, determining that the source is the source for is more than a predetermined threshold of requests to perform operations on the storage system for a predetermined period of time, or detecting an anomaly in a pattern of requests provided by the source.
9. 9. The method of any preceding claim, wherein: the request comprises a request to delete or change data stored by the storage system are stored; and determining the one or more attributes of the request comprises determining an attribute of the data.
10. 10. The method according to any one of the preceding statements, wherein the throttling comprises limiting a write speed with respect to the storage system to a specific number of write operations per second.
11. 11. The method of one of the preceding statements, further comprising: the data protection system determining one or more of a current memory state or a current workload state of the memory system prior to detecting the request to perform the operation; wherein the throttling of the performance of the operation is further based on one or more of the current memory state and the current workload state.
12. 12. A method comprising: detecting, by a data protection system, a plurality of requests to perform a plurality of operations on a storage system while a data set stored by the storage system is in a compromised state like that stored by the storage system Record may be affected by a security threat; Determine, through the data protection system, one or more attributes of the requirements; Determining, by the data protection system, based on the one or more attributes, that a first subset of requirements within the plurality of requirements may be related to the security threat, the first subset of requirements including requirements to perform a first subset of operations included in the multitude of options; Determining, by the data protection system, based on the one or more attributes, that a second subset of requirements within the plurality of requirements is unrelated to the security threat, the second subset of requirements including requirements to perform a second subset of operations included in the multitude of options; The data protection system throttling a performance of the first subset of operations based on determining that the first subset of requests is related to the security threat; and foregoing, by the data protection system, throttling a performance of the second subset of operations based on determining that the second subset of requirements is unrelated to the security threat.
13. 13. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: acquire a request to perform an operation on a memory system; Determining one or more attributes of the requirement; Determining, based on the one or more attributes, that the request may be related to a security threat to the storage system; and throttling, based on determining that the request may be related to the security threat, from performing the operation.
14. 14. The system of any preceding claim, wherein the processor is further configured to execute the instructions to: recognize a additional request to perform an additional operation on the storage system; Determining one or more attributes of the additional requirement; Determining, based on the one or more attributes of the additional requirement, that the additional requirement is not related to the security threat to the storage system; and foregoing throttling a performance of the additional operation based on the determining that the additional operation is unrelated to the security threat to the storage system.
15. 15. The system of any preceding claim, wherein the processor is further configured to execute the instructions to: determine, prior to detecting the request to perform the operation, that the data set stored by the storage system is in a compromised state; in which the data set stored on the storage system may be affected by the security threat; wherein throttling the performance of the operation is further based on determining that the data set stored by the storage system is in the compromised state.
16. 16. The system of any preceding statement, wherein the processor is further configured to execute the instructions to: determine, after the operation is throttled, that the data set stored by the storage system is no longer in the compromised state; Detecting, while the data set stored by the storage system is no longer in the compromised state, an additional request for performing an additional operation with respect to the storage system; and foregoing throttling the performance of the additional operation based on the data set stored by the storage system that is no longer in the compromised state.
17. 17. The system of any preceding statement, wherein the operation includes one or more write, read, or restricted operations.
18. 18. The system of any preceding claim, wherein: the request comprises a request to write data to the storage system; determining the one or more attributes of the request comprises determining compressibility of the data; and determining that the request may be related to the security threat comprises determining that the compressibility is below a threshold.
19. 19. The system of any preceding claim, wherein: the request comprises a request to write data to the storage system; determining the one or more attributes of the request comprises determining a format of the data; and determining that the request may be related to the security threat comprises determining that the format does not match an expected format for the data.
20. 20. The system of any preceding claim, wherein: determining the one or more attributes of the request comprises determining a source of the request; and determining that the request may be related to the security threat comprises one or more of the following methods: determining that the source was previously associated with one or more security threats to the storage system; determining that the source is the source for more than a predetermined threshold of requests to perform operations on the storage system for a predetermined period of time, or detecting an anomaly in a pattern of requests provided by the source.

1. 1. Verfahren, umfassend: Ermitteln einer oder mehrerer Eingabeoperationen und einer oder mehrerer Ausgabeoperationen, die zwischen einer Quelle und einem Speichersystem durchgeführt werden, durch ein Datenschutzsystem; Ermitteln einer Anomalie in einer Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen durch das Datenschutzsystem; und Bestimmen, durch das Datenschutzsystem auf der Grundlage des Ermittelns der Anomalie, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen umfasst: Ermitteln eines Timings zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen; und Bestimmen, basierend auf dem Timing, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen korreliert sind.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen das Bestimmen umfasst, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen gemäß einem identifizierbaren Muster durchgeführt werden.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen gemäß dem identifizierbaren Muster durchgeführt werden, das Bestimmen umfasst, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen durch sequentiell nummerierte logische Speichereinheiten einer Speicherstruktur innerhalb des Speichersystems fortlaufen.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die sequentiell nummerierten logischen Speichereinheiten Sektoren der Speicherstruktur umfassen.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen gemäß dem identifizierbaren Muster durchgeführt werden, das Bestimmen umfasst, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen von einem Beginn einer Partition innerhalb einer Speicherstruktur des Speichersystems an kontinuierlich sind.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen umfasst: Bestimmen, dass die eine oder die mehreren Ausgabeoperationen Leseoperationen enthalten, die bewirken, dass Daten, die vom Speichersystem länger als eine vorbestimmte Zeitdauer gespeichert sind, vom Speichersystem zur Quelle übertragen werden; Ermitteln einer Gesamtmenge der vom Speichersystem zur Quelle übertragenen Daten; Bestimmen, dass die eine oder die mehreren Eingabeoperationen Schreiboperationen enthalten, die neue Daten zur Quelle schreiben; und Bestimmen, dass eine Gesamtmenge der neuen Daten innerhalb einer Schwellenwertmenge der Gesamtmenge der vom Speichersystem zur Quelle übertragenen Daten liegt.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen ferner das Bestimmen umfasst, dass die Schreiboperationen jeweils innerhalb einer Schwellen-Zeitspanne nach einem Auftreten einer anderen der Leseoperationen auftreten.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen ferner das Bestimmen umfasst, dass die vom Speichersystem zur Quelle übertragenen Daten für mehr als eine Schwellen-Zeitspanne vor dem Durchführen der Leseoperationen nicht aus dem Speichersystem gelesen wurden.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen ferner das Bestimmen umfasst, dass jede Dateninstanz, die in den vom Speichersystem zur Quelle übertragenen Daten enthalten ist, nur einmal zur Quelle übertragen wird.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Durchführen einer Abhilfemaßnahme in Bezug auf das Speichersystem durch das Datenschutzsystem umfasst, als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
12. 12. System, das folgendes umfasst: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Ermitteln einer oder mehrerer Eingabeoperationen und einer oder mehrerer Ausgabeoperationen, die zwischen einer Quelle und einem Speichersystem ausgeführt werden; Ermitteln einer Anomalie in einer Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen; und auf der Grundlage des Ermittelns der Anomalie, Bestimmen, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist.
13. 13. Das System nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen umfasst: Ermitteln eines Timings zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen; und Bestimmen, basierend auf dem Timing, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen korreliert sind.
14. 14. Das System nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen das Bestimmen umfasst, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen gemäß einem identifizierbaren Muster durchgeführt werden.
15. 15. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen gemäß dem identifizierbaren Muster durchgeführt werden, das Bestimmen umfasst, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen durch sequentiell nummerierte logische Speichereinheiten einer Speicherstruktur innerhalb des Speichersystems fortlaufen.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen gemäß dem identifizierbaren Muster durchgeführt werden, das Bestimmen umfasst, dass die eine oder die mehreren Eingabeoperationen und die eine oder die mehreren Ausgabeoperationen von einem Beginn einer Partition innerhalb einer Speicherstruktur des Speichersystems an kontinuierlich sind.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen umfasst: Bestimmen, dass die eine oder die mehreren Ausgabeoperationen Leseoperationen enthalten, die bewirken, dass Daten, die vom Speichersystem länger als eine vorbestimmte Zeitdauer gespeichert sind, vom Speichersystem zur Quelle übertragen werden; Ermitteln einer Gesamtmenge der vom Speichersystem zur Quelle übertragenen Daten; Bestimmen, dass die eine oder die mehreren Eingabeoperationen Schreiboperationen enthalten, die neue Daten zur Quelle schreiben; und Bestimmen, dass eine Gesamtmenge der neuen Daten innerhalb einer Schwellenwertmenge der Gesamtmenge der vom Speichersystem zur Quelle übertragenen Daten liegt.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen ferner das Bestimmen umfasst, dass die Schreiboperationen jeweils innerhalb einer Schwellen-Zeitspanne nach einem Auftreten einer anderen der Leseoperationen auftreten.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei das Ermitteln der Anomalie in der Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen ferner das Bestimmen umfasst, dass jede Dateninstanz, die in den vom Speichersystem zur Quelle übertragenen Daten enthalten ist, nur einmal zur Quelle übertragen wird.
20. 20. Ein nicht-transitorisches computerlesbares Medium zum Speichern von Befehlen, die, wenn sie ausgeführt werden, einen Prozessor eines Datenverarbeitungsgeräts anweisen zum: Ermitteln einer oder mehrerer Eingabeoperationen und einer oder mehrerer Ausgabeoperationen, die zwischen einer Quelle und einem Speichersystem ausgeführt werden; Ermitteln einer Anomalie in einer Beziehung zwischen der einen oder den mehreren Eingabeoperationen und der einen oder den mehreren Ausgabeoperationen; und Bestimmen, auf der Grundlage des Ermittelns der Anomalie, dass das Speichersystem möglicherweise von einer Sicherheitsbedrohung betroffen ist.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: a data protection system determining one or more input operations and one or more output operations performed between a source and a storage system; The data protection system determining an anomaly in a relationship between the one or more input operations and the one or more output operations; and determining, by the data protection system based on the determination of the anomaly, that the storage system may be affected by a security threat.
2. 2. The method of any preceding claim, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations comprises: determining a timing between the one or more input operations and the one or more Output operations; and determining, based on the timing, that the one or more input operations and the one or more output operations are correlated.
3. 3. The method of any preceding statement, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations comprises determining that the one or more input operations and the one or more output operations be performed according to an identifiable pattern.
4. 4. The method of one of the preceding statements, wherein determining that the one or more input operations and the one or more output operations are performed according to the identifiable pattern comprises determining that the one or more input operations and the one or more the multiple output operations proceed through sequentially numbered logical storage units of a storage structure within the storage system.
5. 5. The method according to one of the preceding statements, wherein the sequentially numbered logical storage units comprise sectors of the storage structure.
6. 6. The method of any preceding claim, wherein determining that the one or more input operations and the one or more output operations are performed according to the identifiable pattern comprises determining that the one or more input operations and the one or more the multiple output operations from the beginning of a partition within a Storage structure of the storage system to be continuous.
7. 7. The method of any preceding statement, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations comprises: determining that the one or more output operations include read operations that cause Transferring data stored by the storage system for more than a predetermined period of time from the storage system to the source; Determining a total amount of the data transferred from the storage system to the source; Determining that the one or more input operations include write operations that write new data to the source; and determining that a total amount of the new data is within a threshold amount of the total amount of data transferred from the storage system to the source.
8. 8. The method of one of the preceding statements, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations further comprises determining that the write operations are each within a threshold time period after an occurrence of a other of the read operations occur.
9. 9. The method of any preceding claim, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations further comprises determining that the data transferred from the storage system to the source for more than one threshold -The length of time before the read operations were performed were not read from the storage system.
10. 10. The method of any preceding statement, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations further comprises determining that each data instance included in the data transferred from the storage system to the source is included, is only transmitted once to the source.
11. 11. The method of any preceding claim, further comprising the data protection system performing remedial action on the storage system in response to determining that the storage system may be affected by the security threat.
12. 12. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: determine one or more input operations and one or more output operations performed between a source and a storage system; Determining an anomaly in a relationship between the one or more input operations and the one or more output operations; and based on the determining of the anomaly, determining that the storage system may have been affected by a security threat.
13. 13. The system of any preceding claim, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations comprises: determining a timing between the one or more input operations and the one or more Output operations; and determine, based on the timing, that the one or more input operations and the one or more output operations are correlated.
14. 14. The system of any preceding claim, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations comprises determining that the one or more input operations and the one or more output operations according to an identifiable pattern.
15. 15. The system of any preceding claim, wherein determining that the one or more input operations and the one or more output operations are performed according to the identifiable pattern comprises determining that the one or more input operations and the one or more output operations are performed the multiple output operations proceed through sequentially numbered logical storage units of a storage structure within the storage system.
16. 16. The system of any preceding claim, wherein determining that the one or more input operations and the one or more output operations are performed according to the identifiable pattern comprises determining that the one or more input operations and the one or more the multiple output operations are continuous from a beginning of a partition within a storage structure of the storage system.
17. 17. The system of any preceding claim, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations comprises: determining that the one or more output operations include read operations that cause Transferring data stored by the storage system for more than a predetermined period of time from the storage system to the source; Determining a total amount of the data transferred from the storage system to the source; Determining that the one or more input operations include write operations that write new data to the source; and determining that a total amount of the new data is within a threshold amount of the total amount of data transferred from the storage system to the source.
18. 18. The system of one of the preceding statements, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations further comprises determining that the write operations are each within a threshold period of time after an occurrence of a other of the read operations occur.
19. 19. The system of any preceding statement, wherein determining the anomaly in the relationship between the one or more input operations and the one or more output operations further comprises determining that each data instance included in the data transferred from the storage system to the source is included, is only transmitted once to the source.
20. 20. A non-transitory computer readable medium for storing instructions that, when executed, instruct a processor of a computing device to: determine one or more input operations and one or more output operations performed between a source and a storage system; Determining an anomaly in a relationship between the one or more input operations and the one or more output operations; and determine, based on the determination of the anomaly, that the storage system may be affected by a security threat.

1. 1. Verfahren mit den folgenden Schritten: Erfassen einer von einer Quelle bereitgestellten Anforderung durch ein Datenschutzsystem, eine Operation in Bezug auf ein Speichersystem durchzuführen, wobei die Anforderung eine logische Adresse enthält, die ein logisches Element umfasst, das einen Speicherort innerhalb des Speichersystems darstellt; Bestimmen durch das Datenschutzsystem, ob die logische Adresse ferner ein Autorisierungselement umfasst, das anzeigt, dass die Quelle autorisiert ist, Operationen in Bezug auf das Speichersystem einzuleiten; und Durchführen einer Aktion in Bezug auf die Operation durch das Datenschutzsystem auf der Grundlage des Bestimmens, ob die logische Adresse das Autorisierungselement einschließt.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Bestimmen, ob die logische Adresse das Berechtigungselement enthält, das Bestimmen umfasst, dass die logische Adresse das Berechtigungselement enthält; und das Durchführen der Aktion in Bezug auf die Operation das Erlauben umfasst, dass die Operation in Bezug auf den durch die logische Adresse dargestellten Speicherort durchgeführt wird.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Zulassen des Durchführens der Operation das Durchführen der Operation umfasst.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Zulassen der durchzuführenden Operation das Anweisen des Speichersystems zum Durchführen der Operation umfasst.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, ob die logische Adresse das Berechtigungselement enthält, das Bestimmen umfasst, dass die logische Adresse das Berechtigungselement nicht enthält; und das Durchführen der Aktion in Bezug auf die Operation das Verhindern des Durchführens der Operation umfasst.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die Anforderung eine oder mehrere der folgenden Abfragen umfasst: Schreiben von Daten an die durch die logische Adresse dargestellte Speicherstelle, Lesen von Daten aus der durch das logische Element dargestellten Speicherstelle, Löschen von Daten, die an der durch das logische Element dargestellten Speicherstelle gespeichert sind, oder Modifizieren von Daten, die an der durch das logische Element dargestellten Speicherstelle gespeichert sind.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Bereitstellen von Daten durch das Datenschutzsystem umfasst, die das Berechtigungselement der Quelle spezifizieren, bevor die Quelle die Anforderung zum Durchführen der Operation bereitstellt.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Empfangen einer Autorisierungsanforderung von der Quelle durch das Datenschutzsystem; und Authentifizieren der Quelle durch das Datenschutzsystem auf der Grundlage der Autorisierungsanforderung; wobei das Bereitstellen der Daten, die das Autorisierungselement für die Quelle spezifizieren, als Antwort auf die Authentifizierung durchgeführt wird.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner umfasst: das Verwalten von Daten, die das Berechtigungselement darstellen, durch das Datenschutzsystem; wobei das Bestimmen, ob die logische Adresse das Berechtigungselement enthält, das Vergleichen von Daten, die in der logischen Adresse enthalten sind, mit den Daten, die das Berechtigungselement darstellen, umfasst.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, ob die logische Adresse das Berechtigungselement enthält, die Analyse einer vorbestimmten Folge von Bits umfasst, die in der logischen Adresse für das Berechtigungselement enthalten sind.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die vorgegebene Bitfolge an einem Anfang der logischen Adresse steht.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die vorgegebene Bitfolge mindestens acht Bits enthält.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das logische Element eine Blockadresse umfasst.
14. 14. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Berechtigungselement eines oder mehrere von einem Sicherheits-Token, einer digitalen Signatur von Daten, die mit der Operation verbunden sind, einer digitalen Signatur des logischen Elements oder einer Bitsequenz, die gemäß einem vom Datenschutzsystem verwendeten Berechtigungsschema erzeugt wird, umfasst.
15. 15. System, folgendes umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Erfassen einer von einer Quelle bereitgestellten Anforderung, eine Operation bezüglich eines Speichersystems durchzuführen, wobei die Anforderung eine logische Adresse enthält, die ein logisches Element umfasst, das eine Speicherstelle innerhalb des Speichersystems darstellt; Bestimmen, ob die logische Adresse ferner ein Autorisierungselement umfasst, das anzeigt, dass die Quelle autorisiert ist, Operationen bezüglich des Speichersystems einzuleiten; und, basierend auf dem Bestimmen, ob die logische Adresse das Autorisierungselement enthält, Durchführen einer Aktion bezüglich der Operation.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, ob die logische Adresse das Berechtigungselement enthält, das Bestimmen umfasst, dass die logische Adresse das Berechtigungselement enthält; und das Durchführen der Aktion in Bezug auf die Operation das Erlauben umfasst, dass die Operation in Bezug auf den durch die logische Adresse dargestellten Speicherort durchgeführt wird.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, ob die logische Adresse das Berechtigungselement enthält, das Bestimmen umfasst, dass die logische Adresse das Berechtigungselement nicht enthält; und das Durchführen der Aktion in Bezug auf die Operation das Verhindern der Durchführung der Operation umfasst.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei die Anforderung eine oder mehrere der folgenden Anforderungen umfasst: Schreiben von Daten in die durch die logische Adresse dargestellte Speicherstelle, Lesen von Daten aus der durch das logische Element dargestellten Speicherstelle, Löschen von Daten, die an der durch das logische Element dargestellten Speicherstelle gespeichert sind, oder Modifizieren von Daten, die an der durch das logische Element dargestellten Speicherstelle gespeichert sind.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt, um der Quelle Daten zur Verfügung zu stellen, die das Berechtigungselement spezifizieren, bevor die Quelle die Anforderung zum Durchführen der Operation bereitstellt.
20. 20. Ein nicht-transitorisches computerlesbares Medium, das Befehle speichert, die, wenn sie ausgeführt werden, einen Prozessor einer Rechenvorrichtung anweisen zum: Erfassen einer von einer Quelle bereitgestellten Anforderung, eine Operation bezüglich eines Speichersystems durchzuführen, wobei die Anforderung eine logische Adresse enthält, die ein logisches Element umfasst, das eine Speicherstelle innerhalb des Speichersystems darstellt; Bestimmen, ob die logische Adresse ferner ein Autorisierungselement umfasst, das anzeigt, dass die Quelle autorisiert ist, Operationen bezüglich des Speichersystems einzuleiten; und, basierend auf dem Bestimmen, ob die logische Adresse das Autorisierungselement enthält, Durchführen einer Aktion bezüglich der Operation.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising the steps of: a data protection system detecting a source-provided request to perform an operation on a storage system, the request including a logical address comprising a logical element representing a storage location within the storage system; Determining, by the data protection system, whether the logical address further includes an authorization element indicating that the source is authorized to initiate operations with respect to the storage system; and taking action on the operation by the data protection system based on determining whether the logical address includes the authorization element.
2. 2. The method of any preceding claim, wherein: determining whether the logical address includes the token comprises determining that the logical address includes the token; and performing the action on the operation includes allowing the operation to be performed on the storage location represented by the logical address.
3. 3. The method of any preceding claim, wherein allowing the operation to be performed comprises performing the operation.
4. 4. The method of any preceding claim, wherein allowing the operation to be performed comprises instructing the storage system to perform the operation.
5. 5. The method of any of the preceding statements, wherein determining whether the logical address contains the authorization element comprises determining that the logical address does not contain the authorization element; and performing the action related to the operation comprises preventing the operation from being performed.
6. 6. The method according to one of the preceding statements, wherein the request comprises one or more of the following queries: writing data to the memory location represented by the logical address, reading data from the memory location represented by the logical element, deleting data that at the through the Logical element represented memory location are stored, or modification of data which are stored in the memory location represented by the logical element.
7. 7. The method of any preceding claim, further comprising providing, by the data protection system, data specifying the authorization element of the source prior to the source providing the request to perform the operation.
8. 8. The method of any preceding claim, further comprising: the data protection system receiving an authorization request from the source; and authenticating the source by the data protection system based on the authorization request; wherein providing the data specifying the authorization element for the source is performed in response to the authentication.
9. 9. The method according to any of the preceding statements, further comprising: the data protection system managing data representing the authorization element; wherein determining whether the logical address includes the token comprises comparing data contained in the logical address with the data representing the token.
10. 10. The method of any of the preceding statements, wherein determining whether the logical address contains the authorization element comprises analyzing a predetermined sequence of bits contained in the logical address for the authorization element.
11. 11. The method according to one of the preceding statements, wherein the predetermined bit sequence is at the beginning of the logical address.
12. 12. The method according to one of the preceding statements, wherein the predetermined bit sequence contains at least eight bits.
13. 13. The method according to one of the preceding statements, wherein the logical element comprises a block address.
14. 14. The method according to one of the preceding statements, wherein the authorization element is one or more of a security token, a digital signature of data associated with the operation, a digital signature of the logical element or a bit sequence that is generated according to one of the data protection system used authorization scheme is generated, includes.
15. 15. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: acquire a source-provided request to perform an operation on a memory system, the request including a logical address comprising a logical element; the one storage location represents within the storage system; Determining whether the logical address further includes an authorization element indicating that the source is authorized to initiate operations with respect to the storage system; and, based on determining whether the logical address includes the authorization element, taking action on the operation.
16. 16. The system of any preceding statement, wherein determining whether the logical address includes the token comprises determining that the logical address includes the token; and performing the action on the operation includes allowing the operation to be performed on the storage location represented by the logical address.
17. 17. The system of any of the preceding statements, wherein determining whether the logical address contains the authorization element comprises determining that the logical address does not contain the authorization element; and performing the action related to the operation comprises preventing the operation from being performed.
18. 18. The system according to one of the preceding statements, wherein the request comprises one or more of the following requirements: writing data to the memory location represented by the logical address, reading data from the memory location represented by the logical element, erasing data that are stored in the memory location represented by the logical element, or modify data stored in the memory location represented by the logical element.
19. 19. The system of any preceding claim, wherein the processor is further configured to execute the instructions to provide data specifying the token to the source prior to the source providing the request to perform the operation.
20. 20. A non-transitory computer readable medium that stores instructions that, when executed, instruct a processor of a computing device to: detect a source-provided request to perform an operation on a storage system, the request including a logical address; which comprises a logical element representing a storage location within the storage system; Determining whether the logical address further includes an authorization element indicating that the source is authorized to initiate operations with respect to the storage system; and, based on determining whether the logical address includes the authorization element, taking action on the operation.

1. 1. Verfahren mit den folgenden Schritten: Empfangen von Attributdaten durch ein Speichersystem, die ein oder mehrere Attribute eines bekannten Angriffs darstellen, der gegen Daten durchgeführt wurde, die von einem Zielsystem gespeichert wurden, das nicht das Speichersystem ist; Aktualisieren eines vom Speichersystem ausgeführten erweiterbaren Angriffsüberwachungsprozesses mit den Attributdaten durch das Speichersystem; und Überwachen von Speicheroperationsanforderungen bezüglich des Speichersystems für ein oder mehrere Attribute, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen, durch das Speichersystem, unter Verwendung des mit den Attributdaten aktualisierten erweiterbaren Angriffsüberwachungsprozesses.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Erfassen, während des Überwachens, des einen oder der mehreren Attribute der Speicheroperationsanforderungen durch das Speichersystem, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen; und Bestimmen, durch das Speichersystem, basierend auf dem Erfassen des einen oder der mehreren Attribute der Speicheroperationsanforderungen, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen, dass Daten, die durch das Speichersystem gespeichert sind, möglicherweise Ziel eines Angriffs werden.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Durchführen einer Abhilfemaßnahme durch das Speichersystem als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme eines oder mehrere der folgenden Verfahren umfasst: Erzeugen eines Wiederherstellungsdatensatzes für die durch das Speichersystem gespeicherten Daten, Drosseln einer oder mehrerer der Speicheroperationsanforderungen, Bereitstellen einer Benachrichtigung oder Verhindern des Durchführens einer oder mehrerer der Speicheroperationsanforderungen.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend das Zulassen, durch das Speichersystem, basierend auf dem Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise Ziel des Angriffs sind, dass das entfernte System die Speicheroperationsanforderungen in Bezug auf das Speichersystem analysiert.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Zulassen das Übertragen von Attributdaten an das entfernte System umfasst, wobei die Attributdaten für das eine oder die mehreren der Attribute der Speicheroperationsanforderungen des Speichersystems repräsentativ sind.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Empfangen einer Bestätigung vom entfernten System durch das Speichersystem, die anzeigt, dass das entfernte System auf der Grundlage der Analyse der Speicheroperationsanforderungen des Speichersystems bestimmt hat, dass die vom Speichersystem gespeicherten Daten Ziel des Angriffs sind; und Ausführen einer zusätzlichen Abhilfemaßnahme durch das Speichersystem als Reaktion auf das Empfangen der Bestätigung.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Empfangen der Attributdaten das Empfangen der Attributdaten von einem entfernten System über ein Netzwerk umfasst.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das entfernte System mit einer Vielzahl von Speichersystemen kommuniziert und so konfiguriert ist, dass es die Attributdaten auf der Grundlage einer Analyse von Speicheroperationsanforderungen in Bezug auf die Vielzahl von Speichersystemen erzeugt.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Empfangen der Attributdaten das Empfangen der Attributdaten direkt vom Zielsystem über ein Netzwerk umfasst.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Aktualisieren des Überwachungsprozesses des erweiterbaren Angriffs das dynamische Aktualisieren des Überwachungsprozesses des erweiterbaren Angriffs, während der Ausführung des Überwachungsprozesses des erweiterbaren Angriffs durch das Speichersystem, umfasst.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei die Attributdaten Daten umfassen, die ein Muster repräsentieren, das mit dem bekannten Angriff, einer Komprimierbarkeit von Daten, die in das Zielsystem geschrieben werden, oder einem Format von Daten, die in das Zielsystem geschrieben werden, verbunden ist.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Überwachen des einen oder der mehreren Attribute der Speicheroperationsanforderungen, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen, das Bestimmen umfasst, dass das eine oder die mehreren Attribute der Speicheroperationsanforderungen einen Ähnlichkeitsschwellenwert in Bezug auf das eine oder die mehreren Attribute des bekannten Angriffs erfüllen.
14. 14. Das Verfahren nach einer der vorhergehenden Aussagen, ferner folgendes umfassend: Aufrechterhalten historischer Attributdaten durch das Speichersystem, die repräsentativ für ein oder mehrere Attribute der Speicheroperationsanforderungen über einen Zeitraum sind, der einem Angriff gegen die vom Speichersystem gespeicherten Daten vorausgeht, der während der Überwachung nicht erfasst wurde; und Übertragen der historischen Attributdaten durch das Speichersystem an ein entferntes System zur Analyse durch das entfernte System.
15. 15. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der bekannte Angriff einen Verschlüsselungsangriff auf die vom Zielspeichersystem gespeicherten Daten umfasst.
16. 16. Das Verfahren, umfassend: Empfangen von Attributdaten durch ein Speichersystem, die ein oder mehrere Attribute eines bekannten Angriffs gegen Daten darstellen, die von einem anderen System als dem Speichersystem gespeichert sind; Verwenden der Attributdaten durch das Speichersystem, um ein oder mehrere Attribute von Speicheroperationsanforderungen bezüglich des Speichersystems zu erfassen, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen; und Bestimmen, durch das Speichersystem auf der Grundlage des Erfassens, dass das eine oder die mehreren Attribute der Speicheroperationsanforderungen mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von einem Angriff betroffen sind.
17. 17. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Verwenden der Attributdaten das Aktualisierung eines vom Speichersystem ausgeführten erweiterbaren Angriffsüberwachungsprozesses durch das Speichersystem mit den Attributdaten umfasst.
18. 18. System, folgendes umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Empfangen von Attributdaten, die für ein oder mehrere Attribute eines bekannten Angriffs gegen Daten repräsentativ sind, die von einem Zielsystem gespeichert werden, das nicht das Speichersystem ist; Aktualisieren eines erweiterbaren Angriffsüberwachungsprozesses, der von dem Speichersystem ausgeführt wird, mit den Attributdaten; und Überwachen, unter Verwendung des erweiterbaren Angriffsüberwachungsprozesses, der mit den Attributdaten aktualisiert wird, den Ein-/Ausgabe-Verkehr (E/A-Verkehr) des Speichersystems für ein oder mehrere Attribute, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Erfassen, während des Überwachend, des einen oder der mehreren Attribute der Speicheroperationsanforderungen, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen; und Bestimmen, durch das Speichersystem, auf der Grundlage des Erfassens des einen oder der mehreren Attribute der Speicheroperationsanforderungen, die mit dem einen oder den mehreren Attributen des bekannten Angriffs übereinstimmen, dass vom Speichersystem gespeicherte Daten möglicherweise von einem Angriff betroffen sind.
20. 20. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum Durchführen, als Reaktion auf das Bestimmen, dass das Speichersystem möglicherweise von der Sicherheitsbedrohung betroffen ist, einer Abhilfemaßnahme.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising the steps of: receiving, by a storage system, attribute data representing one or more attributes of a known attack carried out against data stored by a target system other than the storage system; The storage system updating an extensible intrusion monitoring process executed by the storage system with the attribute data; and monitoring, by the storage system, of storage operation requests to the storage system for one or more attributes that match the one or more attributes of the known attack using the extensible attack monitoring process updated with the attribute data.
2. 2. The method of any preceding claim, further comprising: detecting, while monitoring, the memory system's one or more attributes of memory operation requests that match the one or more attributes of the known attack; and determining, by the storage system, based on the detection of the one or more attributes of the storage operation request that match the one or more attributes of the known attack, that data stored by the storage system may become a target of an attack.
3. 3. The method of any preceding statement, further comprising the storage system performing remedial action in response to determining that the storage system may be affected by the security threat.
4. 4. The method according to any of the preceding statements, wherein performing the remedial action comprises one or more of the following methods: generating a recovery record for the data stored by the storage system, throttling one or more of the storage operation requests, providing a notification or preventing the performance of one or more several of the storage operation requests.
5. 5. The method of any preceding claim, further comprising allowing, by the storage system, based on determining that the data stored by the storage system may be the target of the attack, that the remote system analyze the storage operation requirements with respect to the storage system.
6. 6. The method of any preceding claim, wherein allowing comprises transmitting attribute data to the remote system, the attribute data being representative of the one or more of the attributes of the memory operation requests of the memory system.
7. 7. The method of any preceding claim, further comprising: the storage system receiving an acknowledgment from the remote system indicating that the remote system has determined, based on the analysis of the storage operation requirements of the storage system, that the data stored by the storage system is the target of the Are attacking; and in response to receiving the acknowledgment, the storage system taking additional remedial action.
8. 8. The method according to any of the preceding statements, wherein receiving the attribute data comprises receiving the attribute data from a remote system via a network.
9. 9. The method of any preceding claim, wherein the remote system communicates with a plurality of storage systems and is configured to generate the attribute data based on an analysis of storage operation requirements with respect to the plurality of storage systems.
10. 10. The method according to one of the preceding statements, wherein receiving the attribute data comprises receiving the attribute data directly from the target system via a network.
11. 11. The method of one of the preceding statements, wherein updating the extensible attack monitoring process comprises dynamically updating the extensible attack monitoring process while the storage system is executing the extensible attack monitoring process.
12. 12. The method according to any one of the preceding statements, wherein the attribute data comprise data representing a pattern associated with the known attack, a Compressibility of data that is written to the target system or a format of data that is written to the target system.
13. 13. The method of any preceding claim, wherein monitoring the one or more attributes of the memory operation request that match the one or more attributes of the known attack comprises determining that the one or more attributes of the memory operation request have a similarity threshold with respect to the one or more attributes of the known attack.
14. 14. The method of any preceding statement, further comprising: maintaining, by the storage system, historical attribute data representative of one or more attributes of the storage operation requests over a period of time preceding an attack on the data stored by the storage system that is during the monitoring was not recorded; and transmitting, by the storage system, the historical attribute data to a remote system for analysis by the remote system.
15. 15. The method according to one of the preceding statements, wherein the known attack comprises an encryption attack on the data stored by the target storage system.
16. 16. The method comprising: receiving, by a storage system, attribute data representing one or more attributes of a known attack against data stored by a system other than the storage system; The storage system using the attribute data to detect one or more attributes of storage operation requests related to the storage system that match the one or more attributes of the known attack; and determining, by the storage system based on the sensing that the one or more attributes of the storage operation request match the one or more attributes of the known attack, that the data stored on the storage system may be affected by an attack.
17. 17. The method according to one of the preceding statements, wherein the use of the attribute data comprises the updating of an expandable attack monitoring process carried out by the storage system by the storage system with the attribute data.
18. 18. A system comprising: a memory storing instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: receive attribute data representative of one or more attributes of a known attack on data stored by a target system other than the memory system is; Updating an extensible intrusion monitoring process executed by the storage system with the attribute data; and monitoring, using the extensible intrusion monitoring process updated with the attribute data, input / output (I / O) traffic of the storage system for one or more attributes that match the one or more attributes of the known attack .
19. 19. The system of any preceding claim, wherein the processor is further configured to execute the instructions to: acquire, while monitoring, the one or more attributes of the memory operation requests associated with the one or more attributes of the known Attack match; and determining, by the storage system, based on the detection of the one or more attributes of the storage operation request that match the one or more attributes of the known attack, that data stored on the storage system may be affected by an attack.
20. 20. The system of any preceding claim, wherein the processor is further configured to execute the instructions to perform a remedial action in response to determining that the storage system may be affected by the security threat.

1. 1. Ein Verfahren, umfassend: Ermitteln, durch ein Datenschutzsystem, eines ersten Attributsatzes, der einer ersten Datei zugeordnet ist, die in einem Speichersystem gespeichert ist; Bestimmen, durch das Datenschutzsystem, dass die erste Datei in dem Speichersystem durch eine zweite Datei ersetzt wird; Ermitteln, durch das Datenschutzsystem, eines zweiten Attributsatzes, der der zweiten Datei zugeordnet ist; und Bestimmen, durch das Datenschutzsystem, auf der Grundlage des Bestimmens, dass die erste Datei in dem Speichersystem durch die zweite Datei ersetzt wird, und auf der Grundlage eines oder mehrerer Attribute in mindestens einem des ersten Attributsatzes oder des zweiten Attributsatzes, dass die durch das Speichersystem gespeicherten Daten möglicherweise von einer Sicherheitsbedrohung betroffen sind.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, das Bestimmen einschließt, dass ein Attribut im zweiten Attributsatz, der der zweiten Datei zugeordnet ist, einen Attribut-Schwellenwert erfüllt.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die durch das Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, folgendes einschließt: Bestimmen einer Differenz zwischen einem ersten Attribut in dem ersten Attributsatz, der der ersten Datei zugeordnet ist, und einem zweiten Attribut in dem zweiten Attributsatz, der der zweiten Datei zugeordnet ist; und Bestimmen, dass die Differenz zwischen dem ersten Attribut und dem zweiten Attribut einen Differenzschwellenwert erfüllt.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das eine oder die mehreren Attribute in mindestens einem der ersten Attributsätze oder der zweiten Attributsätze eines oder mehreres von einer Dateigröße, eines Dateiformats, eines Komprimierbarkeitsverhältnisses oder eines Bitmusters der ersten Datei oder der zweiten Datei enthalten.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die erste Datei durch die zweite Datei ersetzt wird, das Bestimmen einschließt, dass die zweite Datei von einem temporären Namen der zweiten Datei in einen Namen der ersten Datei umbenannt wird; und das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, auf mindestens einem von dem temporären Namen der zweiten Datei und einer Differenz zwischen dem temporären Namen der zweiten Datei und dem Namen der ersten Datei basiert.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der erste Attributsatz, der der ersten Datei zugeordnet ist, eine Quelle der ersten Datei einschließt; der zweite Attributsatz, der der zweiten Datei zugeordnet ist, eine Quelle der zweiten Datei einschließt; und das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, das Bestimmen einschließt, dass die Quelle der zweiten Datei sich von der Quelle der ersten Datei unterscheidet.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, wobei der zweite Attributsatz, der der zweiten Datei zugeordnet ist, eine Quelle der zweiten Datei enthält; und das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, eines oder mehrere der folgenden Verfahren umfasst: Bestimmen, dass die Quelle der zweiten Datei mit einem nicht normalen Muster verbunden ist; oder Bestimmen, dass die Quelle der zweiten Datei zuvor mit einer oder mehreren Sicherheitsbedrohungen gegen das Speichersystem verbunden war.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die Quelle der zweiten Datei mit dem nicht normalen Muster verbunden ist, das Bestimmen einschließt, dass die Quelle der zweiten Datei eine Quelle für mehr als einen vorbestimmten Schwellenwert von Anforderungen für einen Datei-Ersatz in Bezug auf das Speichersystem während einer vorbestimmten Zeitperiode ist.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner das Durchführen einer Abhilfemaßnahme in Bezug auf das Speichersystem umfasst, durchgeführt durch das Datenschutzsystem, als Reaktion auf das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf das Speichersystem das Anweisen des Speichersystems einschließt, einen Wiederherstellungs-Datensatz für die vom Speichersystem gespeicherten Daten zu erzeugen.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die erste Datei durch die zweite Datei ersetzt wird, umfasst: Bestimmen, dass die erste Datei in einem ersten Satz von Dateien enthalten ist, die von einem ersten Ort innerhalb des Speichersystems gelöscht wurden, nachdem der erste Satz von Dateien an dem ersten Ort länger als eine vorbestimmte Zeitdauer gespeichert wurde; Bestimmen, dass die zweite Datei in einem zweiten Satz von Dateien enthalten ist, die an einen zweiten Ort innerhalb des Speichersystems geschrieben wurden; und Bestimmen, dass der zweite Satz von Dateien mit dem ersten Satz von Dateien in Beziehung steht.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass der zweite Satz von Dateien mit dem ersten Satz von Dateien in Beziehung steht, das Bestimmen einschließt, dass der zweite Satz von Dateien eine Gesamtzahl von Dateien aufweist, die innerhalb einer vorbestimmten Menge einer Gesamtzahl von Dateien liegt, die in dem ersten Satz von Dateien enthalten ist.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass der zweite Satz von Dateien mit dem ersten Satz von Dateien in Beziehung steht, das Bestimmen einschließt, dass der zweite Satz von Dateien eine Gesamtkomprimierbarkeit aufweist, die geringer ist als die Gesamtkomprimierbarkeit des ersten Satzes von Dateien.
14. 14. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass der zweite Satz von Dateien mit dem ersten Satz von Dateien in Beziehung steht, umfasst: Bestimmen, dass eine Leseoperation, die den ersten Satz von Dateien aus dem Speichersystem liest, zu einem ersten Zeitpunkt durchgeführt wird; und Bestimmen, dass eine Schreiboperation, die den zweiten Satz von Dateien in das Speichersystem schreibt, zu einem zweiten Zeitpunkt nach dem ersten Zeitpunkt durchgeführt wird.
15. 15. System, folgendes umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Ermitteln eines ersten Attributsatzes, der einer in einem Speichersystem gespeicherten ersten Datei zugeordnet ist; Bestimmen, dass die erste Datei im Speichersystem durch eine zweite Datei ersetzt wird; Ermitteln eines zweiten Attributsatzes, der der zweiten Datei zugeordnet ist; und Bestimmen, auf der Grundlage des Bestimmens, dass die erste Datei im Speichersystem durch die zweite Datei ersetzt wird, und auf der Grundlage eines oder mehrerer Attribute in mindestens einem von dem ersten Attributsatz und dem zweiten Attributsatz, dass vom Speichersystem gespeicherte Daten möglicherweise von einer Sicherheitsbedrohung betroffen sind.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, das Bestimmen einschließt, dass ein Attribut in dem zweiten Attributsatz, der der zweiten Datei zugeordnet ist, einen Attribut-Schwellenwert erfüllt.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, folgendes einschließt: Bestimmen einer Differenz zwischen einem ersten Attribut in dem ersten Attributsatz, die der ersten Datei zugeordnet ist, und einem zweiten Attribut in dem zweiten Attributsatz, die der zweiten Datei zugeordnet ist; und Bestimmen, dass die Differenz zwischen dem ersten Attribut und dem zweiten Attribut einen Differenzschwellenwert erfüllt.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei der erste Attributsatz, der der ersten Datei zugeordnet ist, eine Quelle der ersten Datei enthält; der zweite Attributsatz, der der zweiten Datei zugeordnet ist, eine Quelle der zweiten Datei enthält; und das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, das Bestimmen einschließt, dass die Quelle der zweiten Datei sich von der Quelle der ersten Datei unterscheidet.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei der zweite Attributsatz, der der zweiten Datei zugeordnet ist, eine Quelle der zweiten Datei enthält; und das Bestimmen, dass die vom Speichersystem gespeicherten Daten möglicherweise von der Sicherheitsbedrohung betroffen sind, eine oder mehrere der folgenden Maßnahmen umfasst: Bestimmen, dass die Quelle der zweiten Datei mit einem nicht normalen Muster verbunden ist; oder Bestimmen, dass die Quelle der zweiten Datei zuvor mit einer oder mehreren Sicherheitsbedrohungen gegen das Speichersystem verbunden war.
20. 20. Ein nicht-transitorisches computerlesbares Medium, das Befehle speichert, die bei ihrer Ausführung einen Prozessor einer Rechenvorrichtung anweisen zum: Ermitteln eines ersten Attributsatzes, der einer ersten in einem Speichersystem gespeicherten Datei zugeordnet ist; Bestimmen, dass die erste Datei in dem Speichersystem durch eine zweite Datei ersetzt wird; Ermitteln eines zweiten Attributsatzes, der der zweiten Datei zugeordnet ist; und Bestimmen, auf der Grundlage des Bestimmens, dass die erste Datei in dem Speichersystem durch die zweite Datei ersetzt wird, und auf der Grundlage eines oder mehrerer Attribute in mindestens einem von dem ersten Attributsatz und dem zweiten Attributsatz, dass von dem Speichersystem gespeicherte Daten möglicherweise von einer Sicherheitsbedrohung betroffen sind.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: determining, by a data protection system, a first set of attributes associated with a first file stored in a storage system; Determining, by the data protection system, that the first file in the storage system is replaced with a second file; Determining, by the data protection system, a second set of attributes associated with the second file; and determining, by the data protection system, based on the determining that the first file in the storage system will be replaced by the second file and based on one or more attributes in at least one of the first attribute set or the second attribute set that the data stored by the storage system may be affected by a security threat.
2. 2. The method of any preceding claim, wherein determining that the data stored by the storage system may be affected by the security threat includes determining that an attribute in the second attribute set associated with the second file meets an attribute threshold .
3. 3. The method of any preceding statement, wherein determining that the data stored by the storage system may be affected by the security threat includes: determining a difference between a first attribute in the first attribute set associated with the first file, and a second attribute in the second attribute set associated with the second file; and determining that the difference between the first attribute and the second attribute meets a difference threshold.
4. 4. The method according to one of the preceding statements, wherein the one or more attributes in at least one of the first attribute sets or the second attribute sets contain one or more of a file size, a file format, a compressibility ratio or a bit pattern of the first file or the second file .
5. 5. The method of any preceding statement, wherein determining that the first file is replaced with the second file includes determining that the second file is renamed from a temporary name of the second file to a name of the first file; and determining that the data stored by the storage system may be affected by the security threat is based on at least one of the temporary name of the second file and a difference between the temporary name of the second file and the name of the first file.
6. 6. The method of any preceding claim, wherein the first set of attributes associated with the first file includes a source of the first file; the second set of attributes associated with the second file includes a source of the second file; and determining that the data stored on the storage system may be affected by the security threat includes determining that the source of the second file is different from the source of the first file.
7. 7. The method of any preceding claim, wherein the second attribute set associated with the second file includes a source of the second file; and determining that the data stored by the storage system may be affected by the security threat comprises one or more of the following methods: determining that the source of the second file is associated with an abnormal pattern; or determining that the source of the second file was previously associated with one or more security threats to the storage system.
8. 8. The method of any preceding statement, wherein determining that the source of the second file is associated with the abnormal pattern includes determining that the source of the second file is a source for more than a predetermined threshold of requests for one File replacement with respect to the storage system during a predetermined period of time.
9. 9. The method of any preceding claim, further comprising taking remedial action on the storage system performed by the data protection system in response to determining that the data stored on the storage system may be affected by the security threat.
10. 10. The method of any preceding claim, wherein performing the remedial action on the storage system includes instructing the storage system to generate a recovery record for the data stored by the storage system.
11. 11. The method of any preceding statement, wherein determining that the first file is replaced with the second file comprises: determining that the first file is included in a first set of files that are from a first location within the storage system deleted after the first set of files have been stored in the first location for more than a predetermined length of time; Determining that the second file is included in a second set of files written to a second location within the storage system; and determining that the second set of files is related to the first set of files.
12. 12. The method of any preceding statement, wherein determining that the second set of files is related to the first set of files includes determining that the second set of files has a total number of files that is within a predetermined amount of a total number of files contained in the first set of files.
13. 13. The method of any preceding statement, wherein determining that the second set of files is related to the first set of files includes determining that the second set of files has an overall compressibility that is less than the overall compressibility of the first set of files.
14. 14. The method of any preceding statement, wherein determining that the second set of files is related to the first set of files comprises: determining that a read operation reading the first set of files from the storage system is to be is performed at a first point in time; and determining that a write operation that writes the second set of files to the storage system is performed a second time after the first time.
15. 15. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: determine a first set of attributes associated with a first file stored in a storage system; Determining to replace the first file in the storage system with a second file; Determining a second set of attributes associated with the second file; and determining, based on the determining that the first file in the storage system will be replaced by the second file, and based on one or more attributes in at least one of the first attribute set and the second attribute set, that data stored by the storage system may be from one Security threat are affected.
16. 16. The system of any preceding statement, wherein determining that the data stored by the storage system may be affected by the security threat includes determining that an attribute in the second attribute set associated with the second file is an attribute threshold Fulfills.
17. 17. The system of any preceding statement, wherein determining that the data stored by the storage system may be affected by the security threat includes: determining a difference between a first attribute in the first attribute set associated with the first file and a second attribute in the second attribute set associated with the second file; and determining that the difference between the first attribute and the second attribute meets a difference threshold.
18. 18. The system of any preceding claim, wherein the first set of attributes associated with the first file includes a source of the first file; the second set of attributes associated with the second file includes a source of the second file; and determining that the data stored on the storage system may be affected by the security threat includes determining that the source of the second file is different from the source of the first file.
19. 19. The system of any preceding claim, wherein the second set of attributes associated with the second file includes a source of the second file; and determining that the data stored by the storage system may be affected by the security threat comprises one or more of the following measures: determining that the source of the second file is associated with an abnormal pattern; or determining that the source of the second file was previously associated with one or more security threats to the storage system.
20. 20. A non-transitory computer readable medium that stores instructions that, when executed, direct a processor of a computing device to: determine a first set of attributes associated with a first file stored in a storage system; Determining to replace the first file in the storage system with a second file; Determining a second set of attributes associated with the second file; and determining, based on the determining that the first file in the storage system will be replaced by the second file and based on one or more attributes in at least one of the first attribute set and the second attribute set, that data possibly stored by the storage system are affected by a security threat.

1. 1. Verfahren, umfassend: Bestimmen durch ein Datenschutzsystem, dass von einem Speichersystem gespeicherte Daten einem möglichen Angriff ausgesetzt sind; Erfassen einer Änderungsanforderung in Bezug auf das Speichersystem durch das Datenschutzsystem, während die vom Speichersystem gespeicherten Daten dem möglichen Angriff ausgesetzt sind; Bestimmen durch das Datenschutzsystem, dass die Änderungsanforderung mit dem möglichen Angriff in Beziehung stehen kann; und Durchführen einer Abhilfemaßnahme in Bezug auf die Änderungsanforderung durch das Datenschutzsystem als Reaktion auf das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Beziehung stehen kann.
2. 2. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Zusammenhang stehen kann, folgendes umfasst: Ermitteln eines oder mehrerer Attribute, die mit der Änderungsanforderung in Zusammenhang stehen; und Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff auf der Grundlage des einen oder der mehreren Attribute in Zusammenhang stehen kann.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das eine oder die mehreren Attribute, die mit der Änderungsanforderung verbunden sind, eines oder mehreres von Folgendem einschließen: Namen eines Datenelements, das mit der Änderungsanforderung verbunden ist, eine Größe des Datenelements, ein Format des Datenelements, ein Komprimierbarkeitsverhältnis des Datenelements, ein Bitmuster des Datenelements oder eine Quelle der Änderungsanforderung.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff auf der Grundlage des einen oder der mehreren Attribute in Beziehung stehen kann, das Bestimmen einschließt, dass ein mit der Änderungsanforderung verbundenes Attribut einen Attribut-Schwellenwert erfüllt.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff auf der Grundlage des einen oder der mehreren Attribute in Zusammenhang stehen kann, eines oder mehrere der folgenden Verfahren einschließt: Bestimmen, dass eine Quelle der Änderungsanforderung mit einem nicht normalen Muster verbunden ist; oder Bestimmen, dass die Quelle der Änderungsanforderung zuvor mit einer oder mehreren Sicherheitsbedrohungen gegen das Speichersystem verbunden war.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung eine oder mehrere der folgenden Maßnahmen umfasst: Blockieren der Änderungsanforderung; oder Anweisen des Speichersystems, die Änderungsanforderung zu blockieren.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung folgendes umfasst: Ermitteln einer Quelle der Änderungsanforderung; und Anweisen des Speichersystems, den Änderungszugriff durch die Quelle auf das Speichersystem zu blockieren.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, ferner umfassend: Bestimmen durch das Datenschutzsystem, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind; und Ausführen einer Aktion durch das Datenschutzsystem als Reaktion auf das Bestimmen, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung Folgendes umfasst: Anweisen des Speichersystems, die Änderungsanforderung in eine separate Speicherstruktur umzuleiten, die von einer oder mehreren aktiven Speicherstrukturen des Speichersystems getrennt ist, wobei sich die separate Speicherstruktur innerhalb des Speichersystems oder innerhalb eines anderen Speichersystems befindet.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung ferner umfasst: Ermitteln einer Quelle der Änderungsanforderung; und Anweisen des Speichersystems, Leseanforderungen von der Quelle in die separate Speicherstruktur umzuleiten.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner folgendes umfasst: Bestimmen durch das Datenschutzsystem, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind; und Ausführen einer Aktion in Bezug auf die in der getrennten Speicherstruktur gespeicherten Daten durch das Datenschutzsystem als Reaktion auf das Bestimmen, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind.
12. 12. System, umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Bestimmen, dass von einem Speichersystem gespeicherte Daten einem möglichen Angriff ausgesetzt sind; Erfassen einer Änderungsanforderung bezüglich des Speichersystems, während die vom Speichersystem gespeicherten Daten dem möglichen Angriff ausgesetzt sind; Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Beziehung stehen kann; und Durchführen, als Reaktion auf das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Beziehung stehen kann, einer Abhilfemaßnahme bezüglich der Änderungsanforderung.
13. 13. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Zusammenhang stehen kann, folgendes umfasst: Ermitteln eines oder mehrerer Attribute, die mit der Änderungsanforderung verbunden sind; und Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff auf der Grundlage des einen oder der mehreren Attribute in Zusammenhang stehen kann.
14. 14. Das System nach einer der vorhergehenden Aussagen, wobei das eine oder die mehreren Attribute, die mit der Änderungsanforderung verbunden sind, Folgendes einschließt: einen oder mehrere Namen eines Datenelements, das mit der Änderungsanforderung verbunden ist, eine Größe des Datenelements, ein Format des Datenelements, ein Komprimierbarkeitsverhältnis des Datenelements, ein Bitmuster des Datenelements oder eine Quelle der Änderungsanforderung.
15. 15. Das System nach einer der vorhergehenden Aussagen, wobei das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff auf der Grundlage eines oder mehrerer Attribute in Zusammenhang stehen kann, das Bestimmen einschließt, dass ein mit der Änderungsanforderung verbundenes Attribut einen Attribut-Schwellenwert erfüllt.
16. 16. Das System nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung eine oder mehrere der folgenden Maßnahmen umfasst: Blockieren der Änderungsanforderung; oder Anweisen des Speichersystems, die Änderungsanforderung zu blockieren.
17. 17. Das System nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung folgendes umfasst: Ermitteln einer Quelle der Änderungsanforderung; und Anweisen des Speichersystems, den Änderungszugriff durch die Quelle auf das Speichersystem zu blockieren.
18. 18. Das System nach einer der vorhergehenden Aussagen, wobei der Prozessor ferner so konfiguriert ist, dass er die Befehle ausführt zum: Bestimmen, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind; und Durchführen einer Aktion als Reaktion auf das Bestimmen, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind.
19. 19. Das System nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme in Bezug auf die Änderungsanforderung folgendes umfasst: Anweisen des Speichersystems, die Änderungsanforderung zu einer separaten Speicherstruktur umzuleiten, die von einer oder mehreren aktiven Speicherstrukturen des Speichersystems getrennt ist, wobei sich die separate Speicherstruktur innerhalb des Speichersystems oder innerhalb eines anderen Speichersystems befindet; Bestimmen, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind; und als Reaktion auf das Bestimmen, dass die vom Speichersystem gespeicherten Daten nicht mehr dem möglichen Angriff ausgesetzt sind, Durchführen einer Aktion in Bezug auf die in der separaten Speicherstruktur gespeicherten Daten.
20. 20. Ein nicht-transitorisches computerlesbares Medium, das Befehle speichert, die, wenn sie ausgeführt werden, einen Prozessor eines Datenverarbeitungsgerätes anweisen zum: Bestimmen, dass von einem Speichersystem gespeicherte Daten einem möglichen Angriff ausgesetzt sind; Erkennen einer Änderungsanforderung in Bezug auf das Speichersystem, während die vom Speichersystem gespeicherten Daten dem möglichen Angriff ausgesetzt sind; Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Zusammenhang stehen kann; und Durchführen, als Antwort auf das Bestimmen, dass die Änderungsanforderung mit dem möglichen Angriff in Zusammenhang stehen kann, einer Abhilfemaßnahme in Bezug auf die Änderungsanforderung.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: determining, by a data protection system, that data stored by a storage system is subject to possible attack; Capture by the data protection system of a change request relating to the storage system while the data is being stored by the storage system are exposed to the possible attack; Determining, by the data protection system, that the change request may be related to the potential attack; and in response to determining that the change request may be related to the possible attack, the data protection system performing remedial action on the change request.
2. 2. The method of one of the preceding statements, wherein determining that the change request may be associated with the possible attack comprises: determining one or more attributes that are associated with the change request; and determining that the change request may be related to the potential attack based on the one or more attributes.
3. 3. The method of any preceding statement, wherein the one or more attributes associated with the change request include one or more of the following: name of a data item associated with the change request, a size of the data item, a format of the data item, a compressibility ratio of the data item, a bit pattern of the data item, or a source of the change request.
4. 4. The method of any preceding statement, wherein determining that the change request may be related to the possible attack based on the one or more attributes includes determining that an attribute associated with the change request has an attribute threshold Fulfills.
5. 5. The method of any preceding statement, wherein determining that the change request may be related to the possible attack based on the one or more attributes includes one or more of the following methods: determining that a source of the change request is is associated with an abnormal pattern; or determining that the source of the change request was previously associated with one or more security threats to the storage system.
6. 6. The method of one of the preceding statements, wherein performing the remedial action on the change request comprises one or more of the following actions: blocking the change request; or instruct the storage system to block the change request.
7. 7. The method of any preceding claim, wherein performing the remedial action on the change request comprises: determining a source of the change request; and instructing the storage system to block the source from changing access to the storage system.
8. 8. The method according to one of the preceding statements, further comprising: determining by the data protection system that the data stored by the storage system are no longer exposed to the possible attack; and taking action by the data protection system in response to determining that the data stored by the storage system is no longer subject to the potential attack.
9. 9. The method of one of the preceding statements, wherein performing the remedial action on the change request comprises: instructing the storage system to redirect the change request to a separate storage structure that is separate from one or more active storage structures of the storage system, wherein the separate storage structure is located within the storage system or within another storage system.
10. 10. The method of any preceding claim, wherein performing the remedial action on the change request further comprises: determining a source of the change request; and instructing the storage system to redirect read requests from the source to the separate storage structure.
11. 11. The method according to one of the preceding statements, further comprising: determining by the data protection system that the data stored by the storage system are no longer exposed to the possible attack; and in response to determining that the data stored by the storage system is no longer subject to the potential attack, the data protection system taking action on the data stored in the separate storage structure.
12. 12. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: determine that data stored by a storage system is subject to possible attack; Capturing a change request to the storage system while the data is being stored by the storage system are exposed to the possible attack; Determining that the change request may be related to the potential attack; and in response to determining that the change request may be related to the possible attack, performing remedial action on the change request.
13. 13. The system of any preceding statement, wherein determining that the change request may be related to the possible attack comprises: determining one or more attributes associated with the change request; and determining that the change request may be related to the potential attack based on the one or more attributes.
14. 14. The system of any preceding claim, wherein the one or more attributes associated with the change request includes: one or more names of a data item associated with the change request, a size of the data item, a format of the Data item, a compressibility ratio of the data item, a bit pattern of the data item, or a source of the change request.
15. 15. The system of any preceding statement, wherein determining that the change request may be related to the possible attack based on one or more attributes includes determining that an attribute associated with the change request meets an attribute threshold.
16. 16. The system of any of the preceding statements, wherein performing the remedial action on the change request comprises one or more of the following actions: blocking the change request; or instruct the storage system to block the change request.
17. 17. The system of any preceding claim, wherein performing remedial action on the change request comprises: determining a source of the change request; and instructing the storage system to block the source from changing access to the storage system.
18. 18. The system of any preceding statement, wherein the processor is further configured to execute the instructions to: determine that the data stored by the storage system is no longer subject to the potential attack; and taking action in response to determining that the data stored by the storage system is no longer subject to the potential attack.
19. 19. The system of any of the preceding statements, wherein performing the remedial action on the change request comprises: instructing the storage system to redirect the change request to a separate storage structure that is separate from one or more active storage structures of the storage system, the separate storage structure resides within the storage system or within another storage system; Determining that the data stored by the storage system is no longer exposed to the potential attack; and in response to determining that the data stored by the storage system is no longer subject to the potential attack, taking action on the data stored in the separate storage structure.
20. 20. A non-transitory computer readable medium that stores instructions that, when executed, instruct a processor of a computing device to: determine that data stored by a storage system is subject to possible attack; Detecting a change request to the storage system while the data stored by the storage system is exposed to the possible attack; Determining that the change request may be related to the potential attack; and in response to determining that the change request may be related to the possible attack, performing remedial action on the change request.

1. 1. Ein Verfahren, umfassend: Erfassen durch ein Überwachungssystem, dass ein Speichersystem eine Anforderung zum Durchführen einer Operation empfängt, die eine Kapazität einer Speicherstruktur innerhalb des Speichersystems beeinflusst; Ermitteln durch das Überwachungssystem eines Attributs der Anforderung und/oder des Speichersystems; Bestimmen, durch das Überwachungssystem und basierend auf dem Attribut, dass die Anforderung auf eine schädliche Aktion hinweist; und Durchführen, durch das Überwachungssystem, einer Abhilfemaßnahme in Bezug auf die angeforderte Operation, als Reaktion auf das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist.
2. 2. Das Verfahren nach Aussage 1, wobei: das Ermitteln des Attributs das Bestimmen umfasst, dass die Anforderung in einer Vielzahl von Anforderungen eines ähnlichen Typs enthalten ist, die von dem Speichersystem während einer Zeitperiode empfangen werden; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass die Vielzahl von Anforderungen einen Schwellenwert überschreitet.
3. 3. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen umfasst, dass die Anforderung in einer Vielzahl von Anforderungen enthalten ist, die vom Speichersystem während einer Zeitperiode empfangen werden, wobei die Anforderungen eine Anzahl von Speicherstrukturen innerhalb des Speichersystems betreffen; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass die Anzahl der Speicherstrukturen im Vergleich zu einer Gesamtzahl von Speicherstrukturen innerhalb des Speichersystems ein vorbestimmtes Verhältnis überschreitet.
4. 4. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen einer Quelle der Anforderung umfasst; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass die Quelle eine schädliche Quelle ist.
5. 5. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen umfasst, dass die Anforderung eine Schreibanforderung umfasst; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass die Schreibanforderung einen Versuch umfasst, komprimierbare Daten in der Speicherstruktur mit unkomprimierbaren Daten zu überschreiben.
6. 6. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen umfasst, dass das Speichersystem eine Anforderung zum Ändern einer Operationszeitverzögerung empfängt, die mit Speicherstrukturen innerhalb des Speichersystems verbunden ist; und das Bestimmen, dass die Anforderung auf die schädliche Handlung hinweist, das Bestimmen umfasst, dass die Anforderung zum Ändern der Operationszeitverzögerung vom Speichersystem innerhalb einer vorbestimmten Zeitspanne nach der Anforderung empfangen wird.
7. 7. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Erfassen eines nicht normalen Musters der Interaktion mit dem Speichersystem während einer Zeitperiode umfasst; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass die Anforderung vom Speichersystem während der Zeitperiode empfangen wird.
8. 8. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Erfassen des nicht normalen Musters der Interaktion mit dem Speichersystem das Bestimmen umfasst, dass sich die während der Zeitperiode in Bezug auf das Speichersystem durchgeführten Operationen um mehr als einen Schwellenwert von den historischen Operationen unterscheiden, die in Bezug auf das Speichersystem durchgeführt wurden.
9. 9. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen eines Alters anderer Speicherstrukturen innerhalb des Speichersystems umfasst; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass das Alter älter als ein vorbestimmtes Alter ist.
10. 10. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen eines Umfangs ungestörter Kapazität des Speichersystems umfasst, wobei die ungestörte Kapazität nicht durch eine Vielzahl von Anforderungen, die die Anforderung einschließt, beeinträchtigt wird; und das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, das Bestimmen umfasst, dass die ungestörte Kapazität kleiner als ein Schwellenwert ist.
11. 11. Das Verfahren nach einer der vorhergehenden Aussagen, wobei: das Ermitteln des Attributs das Bestimmen umfasst, dass die Speicherstruktur als eine Ransomware-Wiederherstellungsstruktur gekennzeichnet ist; und das Bestimmen, dass die Anforderung auf die schädliche Handlung hinweist, das Bestimmen umfasst, dass die Anforderung eine bestimmte Speicherstruktur betrifft, die als die Ransomware-Wiederherstellungsstruktur gekennzeichnet ist.
12. 12. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Erfordern von Daten aus mehreren Quellen für die durchzuführende Operation umfasst.
13. 13. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Bereitstellen einer Benachrichtigung umfasst, die angibt, dass die Anforderung auf die schädliche Handlung hinweist.
14. 14. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme das Anweisen des Speichersystems umfasst, die Operation für eine vorbestimmte Zeitspanne nach dem Empfangen der Anforderung durch das Speichersystem nicht durchzuführen.
15. 15. Das Verfahren nach einer der vorhergehenden Aussagen, das ferner umfasst, dass durch das Überwachungssystem das Speichersystem angewiesen wird, Daten in der Speicherstruktur zu verschlüsseln, so dass die Daten während der vorgegebenen Zeitspanne verschlüsselt werden.
16. 16. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme umfasst, das Speichersystem anzuweisen, die Operation nicht auszuführen, bis ein Garbage Collection Prozess in Bezug auf die Speicherstruktur durchgeführt werden soll.
17. 17. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Durchführen der Abhilfemaßnahme mindestens eines der folgenden Verfahren umfasst: Blockieren der Anforderung, Drosseln der Durchführung der Operation und Deaktivieren des Speichersystems.
18. 18. Das Verfahren nach einer der vorhergehenden Aussagen, wobei das Erkennen, dass das Speichersystem die Anforderung empfängt, umfasst: Empfangen von Telefon-Haus-Logs aus dem Speichersystem über ein Netzwerk; und Extrahieren von Daten, die für die Anforderung repräsentativ sind, aus den Telefon-Haus-Logs.
19. 19. System, folgendes umfassend: einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher gekoppelt und so konfiguriert ist, dass er die Befehle ausführt zum: Erkennen, dass ein Speichersystem eine Anforderung zum Durchführen einer Operation empfängt, die eine Kapazität einer Speicherstruktur innerhalb des Speichersystems beeinflusst; Ermitteln eines Attributs der Anforderung und/oder des Speichersystems; Bestimmen, auf der Grundlage des Attributs, dass die Anforderung auf eine schädliche Aktion hinweist; und Durchführen, als Reaktion auf das Bestimmen, dass die Anforderung auf die schädliche Aktion hinweist, einer Abhilfemaßnahme bezüglich der angeforderten Operation.
20. 20. Ein Speichersystem, umfassend: eine Vielzahl von Speicherelementen, die so konfiguriert sind, dass sie Daten in einer Vielzahl von Speicherstrukturen pfegen; einen Speicher, der Befehle speichert; einen Prozessor, der kommunikativ mit dem Speicher und der Vielzahl von Speicherelementen gekoppelt ist, wobei der Prozessor so konfiguriert ist, dass er die Befehle ausführt, um eine Anforderung zum Ausführen einer Operation zu empfangen, die eine Kapazität einer in der Vielzahl von Speicherstrukturen enthaltenen Speicherstruktur beeinflusst; Ermitteln eines Attributs von mindestens einer der Anforderung und der Vielzahl von Speicherstrukturen; Bestimmen, auf der Grundlage des Attributs, dass die Anforderung auf eine schädliche Handlung hinweist; und Durchführen, als Reaktion auf das Bestimmen, dass die Anforderung auf die schädliche Handlung hinweist, einer Abhilfemaßnahme in Bezug auf die angeforderte Operation.

Further advantages and features of the present disclosure can be described in more detail by the following statements.

1. A method comprising: detecting, by a monitoring system, that a storage system receives a request to perform an operation that affects a capacity of a storage structure within the storage system; Determining, by the monitoring system, an attribute of the request and / or of the storage system; Determining, by the monitoring system and based on the attribute, that the request is indicative of malicious action; and taking, by the monitoring system, remedial action on the requested operation in response to determining that the request indicates the malicious action.
2. 2. The method of claim 1, wherein: determining the attribute comprises determining that the request is included in a plurality of requests of a similar type received from the storage system during a period of time; and determining that the request is indicative of the malicious action comprises determining that the plurality of requests exceeds a threshold.
3. 3. The method of any preceding claim, wherein: determining the attribute comprises determining that the request is included in a plurality of requests received from the storage system during a period of time, the requests a number of storage structures within the storage system affect; and determining that the request is indicative of the malicious action comprises determining that the number of storage structures compared to a total number of storage structures within the storage system exceeds a predetermined ratio.
4. 4. The method of one of the preceding statements, wherein: determining the attribute comprises determining a source of the request; and determining that the request is indicative of the malicious action comprises determining that the source is a malicious source.
5. 5. The method of any preceding claim, wherein: determining the attribute comprises determining that the request includes a write request; and determining that the request is indicative of the malicious action comprises determining that the write request includes an attempt to overwrite compressible data in the storage structure with uncompressible data.
6. 6. The method of any preceding claim, wherein: determining the attribute comprises determining that the storage system is receiving a request to change an operation time delay associated with storage structures within the storage system; and determining that the request is indicative of the malicious act comprises determining that the request to change the operation time delay is received from the storage system within a predetermined time period after the request.
7. 7. The method of any preceding claim, wherein: determining the attribute comprises detecting an abnormal pattern of interaction with the storage system during a period of time; and determining that the request is indicative of the malicious action comprises determining that the request is received by the storage system during the period of time.
8. 8. The method of any preceding statement, wherein detecting the abnormal pattern of interaction with the storage system comprises determining that the operations performed during the time period with respect to the storage system differ from the historical operations by more than a threshold, performed in relation to the storage system.
9. 9. The method of one of the preceding statements, wherein: determining the attribute comprises determining an age of other memory structures within the memory system; and determining that the request is indicative of the harmful action comprises determining that the age is older than a predetermined age.
10. 10. The method of one of the preceding statements, wherein: determining the attribute comprises determining an amount of undisturbed capacity of the storage system, the undisturbed capacity not being affected by a plurality of requests including the request; and determining that the request is indicative of the malicious action comprises determining that the undisturbed capacity is less than a threshold.
11. 11. The method of any preceding claim, wherein: determining the attribute comprises determining that the storage structure is identified as a ransomware recovery structure; and determining that the request is indicative of the malicious act comprises determining that the request is for a particular storage structure identified as the ransomware recovery structure.
12. 12. The method of any preceding claim, wherein performing the remedial action comprises requesting data from multiple sources for the operation to be performed.
13. 13. The method according to any one of the preceding statements, wherein performing the remedial action is providing a Includes notification indicating that the request is indicative of the malicious act.
14. 14. The method of any preceding claim, wherein performing the remedial action comprises instructing the storage system not to perform the operation for a predetermined period of time after the storage system received the request.
15. 15. The method according to one of the preceding statements, which further comprises that the monitoring system instructs the storage system to encrypt data in the storage structure, so that the data is encrypted during the predetermined period of time.
16. 16. The method of any preceding claim, wherein performing the remedial action comprises instructing the memory system not to perform the operation until a garbage collection process is to be performed on the memory structure.
17. 17. The method according to one of the preceding statements, wherein performing the remedial action comprises at least one of the following methods: blocking the request, throttling the performance of the operation and deactivating the memory system.
18. 18. The method of any preceding claim, wherein recognizing that the storage system is receiving the request comprises: receiving telephony house logs from the storage system over a network; and extracting data representative of the request from the telephone house logs.
19. 19. A system comprising: a memory that stores instructions; a processor communicatively coupled to the memory and configured to execute the instructions to: detect that a memory system is receiving a request to perform an operation that affects a capacity of a memory structure within the memory system; Determining an attribute of the request and / or the storage system; Determining, based on the attribute, that the request is indicative of malicious action; and in response to determining that the request is indicative of the harmful action, taking remedial action on the requested operation.
20. 20. A storage system comprising: a plurality of storage elements configured to maintain data in a plurality of storage structures; a memory that stores instructions; a processor communicatively coupled to the memory and the plurality of storage elements, the processor configured to execute the instructions to receive a request to perform an operation that represents a capacity of a memory structure included in the plurality of storage structures influenced; Determining an attribute of at least one of the request and the plurality of storage structures; Determining, based on the attribute, that the request is indicative of a harmful act; and in response to determining that the request is indicative of the harmful act, performing remedial action on the requested operation.

One or more embodiments may be described herein in terms of method steps that illustrate the performance of certain functions and their relationships. The delimitations and the order of these function modules and process steps have been arbitrarily set here for the sake of simplicity of the description. Alternative boundaries and sequences can be defined as long as the specified functions and relationships are adequately performed. All such alternative boundaries or sequences are thus within the scope and spirit of the claims. In addition, the delimitations of these function blocks were arbitrarily determined for the sake of simplicity of the description. Alternative boundaries could be defined so long as the specific key functions are adequately performed. Similarly, flowchart blocks may have been arbitrarily defined here to illustrate certain significant functions.

To the extent used, the boundaries and sequences of flowchart blocks could have been defined differently and still serve the particular significant functionality. Such alternative definitions of both function blocks and flowchart blocks and sequences are thus within the scope and spirit of the claims. One of ordinary skill in the art will also recognize that the functional building blocks and other illustrative blocks, modules, and components contained herein can be implemented as shown or by discrete components, application specific integrated circuits, processors executing appropriate software, and the like, or any combination thereof.

While certain combinations of various functions and features of the one or more embodiments are expressly described herein, other combinations thereof are possible Features and functions also possible. The present disclosure is not limited by the particular examples disclosed herein and expressly includes these other combinations.

Malicious entities (e.g. hackers, malware and / or other entities) can gain unauthorized access to a storage system, such as B. provide one of the storage systems described here. With such access, the malicious entities can attack the storage system with a security threat, such as B. a ransomware attack, a malware attack and / or another operation that is configured to destroy, modify, render unusable or otherwise adversely affect the storage system and / or the data managed by the storage system.

The methods and systems described herein can be configured to detect that a storage system may be affected by a security threat and take various remedial actions in response to detecting that the storage system may be affected by the security threat.

The methods and systems described here can additionally or alternatively be configured in such a way that unintentional falsification and / or deletion of data stored in a storage system, e.g. due to administrative or application errors, are detected. For example, the methods and systems described herein can implement monitoring for unexpected behavior and controls over the deletion of certain types of data.

Various advantages and benefits can be realized in accordance with the methods and systems described herein. For example, the methods and systems described herein can, by identifying and performing one or more remedial actions related to a security threat that targets a storage system, minimize or eliminate data corruption, structural damage, and / or performance degradation that may arise as a result of the security threat. In addition, by implementing a data protection system at the storage tier, the methods and systems described herein can provide a final measure of defense against security threats or other forms of corrupting actions in the event that other data security measures that are at levels above the storage tier (e.g., client, server, application or network layer) that fail to detect and / or thwart security threats or other forms of corrupting action. As a result, the operation of data processing devices can be improved both on the storage level and on other levels above the storage level.

4th shows an exemplary data protection system 400 ("System 400 "). As shown, the system can 400 including a storage device 402 and a processing device 404 that are selectively and communicatively coupled to one another. The devices 402 and 404 can each contain hardware and / or software components or be implemented by them (eg processors, memories, communication interfaces, instructions stored in the memory for execution by the processors, etc.). In some examples, the devices 402 and 404 be distributed across multiple devices and / or multiple locations, which can serve a specific implementation.

The storage device 402 can maintain (e.g. store) executable data provided by the processing device 404 can be used to perform any of the operations described here. For example, the storage device 402 Commands 406 store that by the processing device 404 can be performed to perform any of the operations described herein. The commands 406 can be implemented by any suitable application, software, code, and / or other executable data instance. The storage device 402 can also store all data received by the processing device 404 received, generated, managed, used and / or transmitted. The storage device 402 can also maintain any other suitable data type that serves a specific implementation.

The processing device 404 can be configured to perform various processing operations described herein (e.g., those on the storage device 402 stored commands 406 executes). References in this document to operations performed by the system 400 can be understood to be performed by the processing device 404 be performed.

5 illustrates an exemplary configuration 500 in which a storage system 502 Read and write traffic processed. The read traffic represents data received from the storage system 502 read, and the write traffic represents data going into the storage system 502 to be written.

The storage system 502 can by any of the storage systems, devices described here and / or components are implemented. For example, the storage system 502 can be implemented by a local storage system (e.g. a storage system located on site at a customer) and / or by a remote storage system (e.g. a storage system located in the cloud).

As shown, the storage system includes 502 a variety of storage structures 504 (e.g. the memory structures 504-1 to 504-N ) and a controller 506 . The storage structures 504 can each contain any logical structure within which data can be stored and / or organized. The storage structures 504 For example, they can include one or more snapshots, volumes, file systems, object stores, object spaces, key values, or relational or other databases, backup records, objects that manage a group of volumes, container objects, blocks, and so on. In some examples the memory structures 504 managed in one or more storage elements (e.g. storage arrays, storage, etc.).

One controller 506 can be configured to allow the operation of the storage system 502 and can be implemented by any suitable combination of processors, operating systems, and / or other components as described herein. In particular, the controller can 506 be configured to have control data 508 generated that are configured to use the memory structures 504 Taxes. For example, the tax data 508 representative of one or more commands for creating, changing, writing, reading, removing, deleting and / or otherwise interacting with the memory structures 504 be.

Read traffic can represent data arriving from a source (e.g., a host connected to the storage system 502 communicated) from the storage system 502 can be read, and the write traffic may represent data going from the source to the storage system 502 to be written. Read and write traffic can occur in response to the source making one or more requests to the storage system 502 transmits. These requirements can be commands for the controller 506 include performing one or more operations. Such operations can include writing data to a memory structure 504 , reading data from a memory structure 504 , the deletion of data from a memory structure 504 , the overwriting of data within a memory structure 504 and / or the deletion of a memory structure 504 include yourself.

In some examples, the read and write traffic and / or one or more requirements for the interface to the storage system 502 come from a malicious source and representative of a ransomware attack on one of the components and / or data within the storage system 502 and / or some other harmful operation involving any of the components and / or data within the storage system 502 destroyed, modified, rendered unusable or otherwise impaired.

Accordingly, the system can 400 , as described here, can be configured in some examples to use the storage system 502 processed read and write traffic is monitored (e.g. by monitoring one or more requests from one or more sources to the storage system 502 to see if the storage system 502 may be affected by a security threat.

In some examples, a system 400 through the storage system 502 implemented. For example, the system 400 at least in part by the controller 506 be implemented. Additionally or alternatively, System 400 implemented at least in part by one or more data processing devices or systems used by the storage system 502 are separated and communicate with them.

Illustrative shows 6th an example configuration 600 where a cloud-based surveillance system 602 with the storage system 502 over a network 604 is communicatively coupled. The cloud-based surveillance system 602 can at least partially the system 400 to implement.

The network 604 may include the Internet, a wide area network, a local area network, a provider-specific wired or wireless network (e.g., a cable or satellite carrier network or a cellular network), a content delivery network, and / or any other suitable network. Data can move between the storage system 502 and the cloud-based data monitoring system 602 flow using any communication technology, device, media, and protocol suitable for any particular implementation.

The cloud-based surveillance system 602 can be implemented by one or more server-side computing devices configured to operate over the network 604 with the storage system 502 communicate. For example, the cloud-based surveillance system 602 through one or more servers or others physical computing devices are implemented.

The cloud-based surveillance system 602 can be configured to have one or more remote monitoring operations related to the storage system 502 performs. For example, the cloud-based monitoring system 602 configured to match the storage system 502 processed read and write traffic and / or from the storage system 502 processed requests are monitored remotely. For this purpose, the cloud-based monitoring system 602 as shown over the network 604 Phone home data 606 from the controller 506 of the storage system 502 receive. The phone home data 606 may contain different types of data collected from the cloud-based surveillance system 602 to monitor various types of operations performed by the storage system 502 can be used. In particular, you can use phone home data 606 Contains data representative of one or more metrics and / or attributes associated with read and write traffic, one or more metrics and / or attributes associated with components within the storage system 502 , one or more requests from a source to the storage system 502 and / or any other data that may serve a particular implementation.

As shown, the cloud-based surveillance system 602 a processor 608 included, which is used for processing telephone home data 606 is configured. The processor 608 can phone home data 606 process in any suitable manner. For example, the processor 608 based on the phone's home data 606 Determine that the storage system 502 may be affected by a security threat and the commands 610 to the controller 506 broadcast to perform one or more remedial action configured to counter the security threat.

Various procedures used by the system 400 and / or any implementation thereof are described in connection with various flowcharts shown in the figures. While the flowcharts depicted in the figures illustrate example operations according to one embodiment, other embodiments may omit, add, reorder, and / or modify any of the operations depicted in the flowcharts depicted in the figures. In addition, any of the operations shown in the flow charts illustrated in the figures can be performed in any of the ways described herein.

7th illustrates an exemplary process 700 for dealing with a possible attack on a storage system (e.g. storage system 502 ). During surgery 702 identifies the system 400 an anomaly associated with a storage system. During surgery 704 represents the system 400 determines that the storage system may have been compromised by a security threat based on the anomaly found. During surgery 706 runs the system 400 taking a remedial action (e.g., in response to determining that the storage system may be affected by the security threat). Examples of each of these operations are described here.

In connection with the 8th to 23 different possibilities are described how the system 400 determine an anomaly associated with a storage system and determine that the storage system may be affected by a security threat. Each of the processes described in connection with these figures can be performed independently of one another in order to determine that a storage system may have been affected by a security threat. Alternatively, any number of the processes described in relation to these numbers can be performed simultaneously and / or sequentially in any order to determine that a storage system may be the target of a security threat.

8th shows an example of a security threat detection method based on data traffic (method 800 ) created by the system 400 and / or any implementation thereof. The procedure 800 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 802 monitors the system 400 the read and write traffic processed by a storage system during a specified period of time. The read traffic represents data that was read from the storage system during the period and the write traffic represents data that was written to the storage system during the same period. In some examples the system is 400 configured to use a non-manipulable clock source in the storage system to keep track of time.

The system 400 can monitor read and write traffic in any suitable manner. For example, the system can 400 Analyze metrics generated by the storage system and / or a cloud-based monitoring system (e.g. the cloud-based monitoring system 602 ) and which are representative of the amount of read and write traffic, the type of data contained in the read and write traffic, a source of the read and / or write traffic, timestamp data indicating a date and / or time that the read and write traffic takes place, and / or any other attribute of the read and write traffic that may be used for a particular implementation.

The period during which the system 400 monitors read and write traffic can be of any suitable duration. In some examples, the time period can be set in response to user input (e.g., by an administrator). Additionally or alternatively, the time period can be determined by the system 400 automatically set and / or adjusted based on the occurrence of one or more events and / or based on one or more attributes associated with the read and / or write traffic.

With decision 804 determines the system 400 Whether the total amount of read and write traffic exceeds a threshold. With decision 806 represents the system 400 determines whether the write traffic is less compressible than the read traffic. If the total amount of read and write traffic exceeds the threshold (yes if so 804 ) and the write traffic is less compressible or has a much higher number of uncompressible blocks than the read traffic (“Yes” if the decision is made 806 ), the system provides 400 during surgery 808 determines that the storage system may have been compromised by a security threat. This is because rewriting data as encrypted data is typical of a ransomware attack, and encrypted data is generally not very compressible (in some cases, encrypted data is completely uncompressible). Otherwise the system monitors 400 also read and write traffic ("No" if the decision is made 804 and / or decision 806 ).

The threshold at which the system 400 comparing the total amount of read and write traffic can be any suitable value and type. The threshold value can be, for example, a certain amount of data in bytes that is contained in read and write traffic during the period. Additionally or alternatively, the threshold value can be representative of a rate (for example a specific amount of data per second, minute, hour or some other time increment). Additionally or alternatively, the threshold value can be representative of a total amount (for example a total number of bytes). Additionally or alternatively, the threshold value can be representative of a deviation from historical trends. To illustrate: If the system 400 detects a spike in the total amount of read and write traffic during a given time period compared to a similar time period on another day, it may be an indication of a potential security threat to the storage system.

In some examples, the threshold at which the system 400 compares the total amount of read and write traffic in response to user input (e.g. by an administrator). Additionally or alternatively, the threshold value can be determined by the system 400 automatically set and / or adjusted based on the occurrence of one or more events and / or based on one or more attributes associated with the read and / or write traffic. For example, the threshold may be increased during periods when the total amount of read and write traffic is typically higher than average. Likewise, the threshold can be lowered during periods when the total amount of read and write traffic is typically below average.

In some examples, the System 400 Manage data representative of multiple thresholds each corresponding to different types of data in read and write traffic and / or any other attribute of read and write traffic. In these examples the system 400 simultaneously compare different segments of the read and write traffic with the different threshold values. If one or more of the thresholds are met, the system can 400 the decision 804 meet (e.g. by adding the “yes” branch of the decision 804 follows).

The system 400 can appropriately determine whether the write traffic is less compressible than the read traffic. For example, the system can 400 determine an overall compressibility (eg in the form of a percentage and / or a total amount of the storage space saved by the compression) of the write traffic and the read traffic during the period. If the total compressibility of the write traffic is less than the total compressibility of the read traffic (e.g., by more than a certain threshold), it may indicate that the write traffic contains encrypted data (which has relatively low compressibility), suggesting a ransomware attack and / or some other type of security threat. It will be appreciated that overall compressibility is just one metric that can be used to determine whether the write traffic is less compressible than the read traffic. Other metrics may include file-by-file compressibility comparisons, peak compressibility metrics, and so on.

As with surgery 808 specified, the system can 400 based on the total amount of read and write traffic that exceeds the threshold and the fact that the write traffic is less compressible than the read traffic, determine that the storage system may be exposed to a security threat. The system 400 may consider one or more other factors in determining whether the storage system may be the target of a security threat.

For example illustrated 9 Another exemplary traffic-based security threat detection method 900 that is from the system 400 and / or any implementation thereof. The procedure 900 can be used alone or in combination with any of the other security threat detection methods described herein.

The procedure 900 is similar to the procedure 800 except that the procedure 900 includes one more condition that must be met before the system 400 determines that the storage system may be affected by the security threat. Especially when making a decision 902 determines the system 400 Whether the read traffic is within a threshold of write traffic during the period. This threshold can be relatively small, so this condition is met if the total amount of read traffic during the period is approximately equal to the total amount of write traffic during the period. This can be an indication of a ransomware attack or another security threat against the storage system in which data managed by the storage system is read out, encrypted and written back to the storage system.

So if the system 400 determines that read traffic is within the threshold of write traffic during the period (Yes in decision 902 ), and when the results of the decisions 804 and 806 both are “yes” as related to 8th described, the system can 400 Determine that the storage system might be affected by a security threat.

10 illustrates an exemplary attribute-based security threat detection method (method 1000 ) by the system 400 and / or any implementation thereof. The procedure 1000 can be used alone or in combination with any of the other security threat detection methods described herein. For example, the method 1000 in combination with the procedure 800 and / or the procedure 900 can be used to detect partial streams of data within the entire read and write traffic to a storage system that may indicate a methodical attempt by a malicious entity to corrupt the data managed by the storage system (e.g. by encrypting data and / or overwriting a collection of unencrypted data ).

During surgery 1002 identifies the system 400 an attribute associated with read and / or write traffic processed by a storage system. This identifying can be done while the system is running 400 monitors the read and / or write traffic processed by the storage system as described herein. During surgery 1004 represents the system 400 determines that the storage system may be exposed to a security threat based on the identified attribute.

That in operation 1002 The identified attribute can be any suitable attribute that serves a particular implementation. For example, the attribute can contain a host attribute that identifies a particular host connected to the storage system. In this implementation, the system 400 Monitor host-specific data that is read from the storage system and / or host-specific data that is written to the storage system in order to detect a possible security threat to the storage system. This can be beneficial when multiple hosts are connected to a particular storage system. In this scenario, the host-specific data associated with each host can be monitored according to a different host-specific rule set.

To illustrate, a particular host may be associated with highly sensitive data (e.g. financial data or other types of personal data) maintained by a storage system that may be more susceptible to a ransomware attack and / or a different type of security threat than other data who are not that sensitive. In this example, a relatively strict set of rules (e.g. a relatively low threshold for the decision 804 ) should be used when monitoring read and / or write traffic related to this host. For example, a relatively strict set of rules can be used for a host that normally does not put out any traffic on a particular record.

As another example, this can be seen in Operation 1002 identified attribute an attribute of a memory structure (e.g. memory structure 504 ) contained within the storage system. For example, the attribute can be an identifier of a certain volume and / or another type of storage structure within the storage system into which data is written and / or from which data is read, a storage capacity of a storage structure into which data is written and / or from which data and / or any other suitable attribute associated with a particular memory structure.

To illustrate: the system 400 can monitor the read and write traffic associated with a certain volume within a storage system to determine whether the total amount of read and write traffic exceeds a threshold value (decision 804 ) and / or whether the write traffic is less compressible than the read traffic (decision 806 ). In this way, a security threat that targets a particular storage structure within a storage system can be more effectively detected.

Another example is surgery 1002 The identified attribute may contain a storage format attribute that identifies and / or is otherwise associated with a storage format used by the storage system. For example, the storage format attribute may indicate that the storage system is using an object storage format, a block storage format, and / or a file storage format. This data can be used in any way to further specify a rule set that is used to monitor possible security threats to the storage system.

In some examples, e.g. B. in a file and / or object-based storage system, stored data (z. B. files and / or objects) can be identified as of a certain type (z. B. an image file, a video file, a ZIP archive, a Text file, a machine code binary file, a log file, a database table space, etc.). However, the content of the data can instead look like encrypted data (e.g. randomized and uncompressible content) that does not correspond to what one would expect of the respective type. The system 400 can be configured to detect these types of content for format type inconsistencies and based on one or more of these inconsistencies to determine that the storage system may have been affected by a security threat.

Illustrative shows 11 an exemplary format type based security threat detection method 1100 that is from the system 400 and / or any implementation thereof. The procedure 1100 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1102 monitors the system 400 the write traffic processed by a storage system. This can be done in one of the ways described here.

During surgery 1104 identifies the system 400 a format type of a data instance (eg a file and / or an object) that is contained in the write traffic. The format type can indicate a certain type of data (e.g. an image file, a database tablespace, etc.). The system 400 can determine the format type based on metadata associated with the data instance, a file extension of the data instance, and / or in any other suitable manner.

With decision 1106 determines the system 400 Whether the content of the data instance matches what is expected for the determined format type. If the content of the data instance does not match what is expected for the determined format type ("No" if the decision is made 1106 ), the system can 400 during surgery 1108 Determine that the storage system might be affected by a security threat. If the content of the data instance does not match what is expected for the determined format type (“Yes” if the decision is made 1106 ), the system also monitors the write traffic processed by the storage system. In some examples, a certain number of discrepancies between data instances and detected format types can be detected before the system 400 determines that the storage system may have been compromised by a security threat.

12th illustrates an example of a pattern-based security threat detection method (method 1200 ) by the system 400 and / or any implementation thereof. The procedure 1200 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1202 identifies the system 400 a pattern associated with read and / or write traffic processed by a storage system. This identifying can be done while the system is running 400 the read and / or Write traffic monitored as described here. During surgery 1204 determines the system 400 based on the identified pattern that the storage system may be exposed to a security threat.

The system 400 can the pattern at surgery 1202 identify in any suitable manner. For example, a ransomware attack can repeatedly read data and write the same data in encrypted form in an identifiable pattern of read / write operations. This pattern can be used by the system 400 Identified by one or more metrics related to read and write traffic that are used to determine that the storage system may be exposed to a security threat. Such metrics can be contained in data that is managed by a controller of a storage system and / or in telephone call data that is transmitted from the storage system to a cloud-based monitoring system.

As another example, the system 400 determine a pattern that involves reading a block volume in a pattern with direct overwriting of compressible data with uncompressible data (e.g. without identifiable data format headers or with uncompressible content compared to previous content that was compressible) a short time later, particularly in a sequential pattern of reads and a subsequent pattern of sequential overwrites. To illustrate, such a pattern might involve reading the first few blocks of a block volume or partition or other recognizable structure stored on a block volume, which can be the beginning of a file system or host-based block device (e.g., a logical volume in a volume manager), followed by overwriting this data with relatively uncompressible data. In some examples, such a pattern may start at logical block address (LBA) zero.

As another example, the system 400 identify any pattern of reading unmapped blocks and rewriting the same blocks of relatively uncompressible data or writing a corresponding amount of relatively uncompressible data elsewhere in the storage system.

These patterns as well as others created by the system 400 are not common I / O patterns for a storage system and can therefore be recognized by the system 400 flagged as an indication of a potential security threat to the storage system.

The system 400 can detect a pattern that indicates a potential security threat to a storage system over any period of time. For example, some patterns may be relatively subtle and therefore out of the system 400 are recognized over a relatively long period of time using one or more metrics, machine learning algorithms and / or other recognition algorithms. Other patterns may be used by the system 400 can be recognized relatively quickly.

In some examples, the confidence level may differ from that provided by the system 400 Determination made that the storage system may be compromised by a security threat will change over time if one or more patterns from the system 400 recognized and / or tracked. For example, a recognized pattern can cause the system 400 determines, with an initial confidence level, that the storage system may have been affected by a security threat. Over time, as the pattern persists or becomes more prevalent, the level of confidence in determining that the storage system may be affected by the security threat may increase.

13th Figure 3 shows an exemplary security threat detection method based on header information 1300 that is from the system 400 and / or any implementation thereof. The procedure 1300 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1302 monitors the system 400 the read and write traffic processed by a storage system. This can be done in one of the ways described here.

With decision 1304 determines the system 400 whether the write traffic contains identifiable header information. If the write traffic does not contain any identifiable header information ("No" if the decision is made 1304 ), the system can 400 during surgery 1308 Determine that Storage system may be affected by a security threat.

If the write traffic contains identifiable header information (“Yes” if decided 1304 ), determines the system 400 upon decision 1306 whether the header information matches the content contained in the data written to the storage system. If the header information does not match the contents of the data written to the storage system, the system may 400 during surgery 1308 Determine that the storage system might be affected by a security threat. If the header information does not match the content of the data written to the storage system, the system may 400 during surgery 1302 return to monitoring write traffic.

As used here, header information can refer to supplementary data contained in a data block (e.g. at the beginning of a) transferred to the storage system. The header information can determine a format, a type and / or another attribute of data which are contained in a useful data part of the data block transmitted to the storage system. Additionally or alternatively, the header information can contain a checksum and / or other data that can be used to test for damaged data.

In some examples, legitimate data (e.g., data not related to a security threat) written to a storage system includes identifiable header information that matches the content (e.g., the content of the payload), contained in the data that is written to the storage system. For example, if the identifiable header information of legitimate data indicates that the payload is in a particular format, the payload should be in that format.

However, data associated with a security threat (e.g., a ransomware attack and / or an attempt to write corrupt data to the storage system) may either not contain identifiable header information or contain identifiable header information that does not match the content of the data being written to the storage system. For example, data written to a storage system as part of a security threat to the storage system may contain header information relating to known image, video, audio, or archive files, but payload data included in the data written to the storage system may not be one of these file types. Another example is the renaming of files as part of a re-encryption performed by a malicious entity. For example, if a collection of JPEG files is rewritten to new files with new names, those names may not indicate that they are JPEG files. To recognize this, the system can 400 Determine that e.g. For example, a preponderance of files in a directory tree consisted of a certain group of file types according to file name pattern, and that these files are replaced by new files that no longer have this file name pattern.

If data written to the storage system does not contain identifiable header information, the system can 400 Mark the data accordingly as possibly representative of a security threat to the storage system. Additionally or alternatively, the system 400 identify the data as possibly representative of a security threat to the storage system if the data written to the storage system contains identifiable header information, but the header information does not match the content of the data written to the memory.

In some examples, the System 400 Determine the file formats from the header data when reading files. This can be done when writing out files with a pattern of names (e.g. with a .JPG suffix) by dividing the contents of configuration files (e.g. a database configuration file, which contains certain files or block devices as specific parts of a database (logs, tablespaces, etc.) ) identified) and / or recognized in any other suitable manner. Consequently, the system can 400 Detect a change in the filename pattern by determining when reads are in a certain recognizable format but writes are not in the same format, or when writes to files with known filename formats (such as JPG suffixes or the many other suffixes associated with file types ) will not result in files with a recognizable format. In response, the system can 400 Flag data involved in these writes as potentially representative of a security threat to the storage system.

In some examples, the System 400 Determine whether a storage system is affected by a security threat based on a comparison of the header information contained in the read traffic with the header information contained in the write traffic. If, for example, data read from the storage system is at least partially compressed (e.g. already compressed image, video or sound files or even compressed archives) and contains identifiable header information, but no similar identifiable header information is found in the data that can be written to the storage system, this may indicate that the read data is being replaced with encrypted data. Hence, the system can 400 In this scenario, determine that the storage system may be affected by a security threat.

14th shows an example of a security threat detection method based on cryptography 1400 that is from the system 400 and / or any implementation thereof. The procedure 1400 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1402 monitors the system 400 the write traffic processed by a storage system. This can be done in one of the ways described here.

With decision 1404 determines the system 400 whether the data contained in the write traffic is encrypted. If the data is not encrypted ("No" if the decision is made 1404 ), monitors the system 1402 write traffic (operation 1402 ).

However, if the data is encrypted (“Yes” if the decision is made 1404 ), determines the system 400 upon decision 1406 whether the encrypted data can be decrypted with a key that is managed by an authorized key management system. If the data can be decrypted with a key that is managed by an authorized key management system (“Yes” if the decision is made 1406 ), monitors the system 1402 write traffic (operation 1402 ).

However, if the data cannot be decrypted with a key that is managed by the authorized key management system (“No” if the decision is made 1406 ), the system can 400 during surgery 1408 Determine that the storage system might be affected by a security threat.

In this example, the authorized key management system can be implemented by any suitable entity and / or system outside and in communication with the storage system. For example, the authorized key management system can use the Key Management Interoperability Protocol (KMIP) to encrypt legitimate data before the legitimate data is written to the storage system. In some examples, an authorized key management system external to the storage system can facilitate the security of data in motion before the data is written to the storage system. In some examples, such security in motion may not prevent the system from being exposed 400 the underlying data (e.g. the encrypted data) are profiled with regard to their compressibility.

The system 400 can determine whether data contained in the write traffic can be decrypted into recognizable unencrypted data with the aid of a key which is appropriately managed by an authorized key management system. For example, the system can 400 route the write traffic through the authorized key management system before the write traffic can be written to the storage system. The authorized key management system can determine whether the write traffic is decryptable in any suitable manner. Another example: the system 400 may keep a copy of the key maintained by the authorized key management system and perform any suitable process configured to determine whether the data contained in the write traffic can be decrypted using the key. As another example, there could be several keys that can be used to encrypt data, where the key used to encrypt a particular data item is not obvious from the item itself. Thus, several candidate decryption keys could be tried to see if any of them could decrypt the data into a form that could be recognized as unencrypted.

If the data contained in the write traffic cannot be decrypted by one of several candidate keys managed by the authorized key management system, the system can 400 Determine that the data may pose a security threat to the storage system.

15th shows another exemplary method based on cryptography 1500 to detect security threats posed by the system 400 and / or any implementation thereof. The procedure 1500 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1502 monitors the system 400 the write traffic processed by a storage system. This can be done in one of the ways described here.

With decision 1504 determines the system 400 whether the data contained in the write traffic is encrypted. If the data is not encrypted ("No" if the decision is made 1504 ), monitors the system 1502 also write traffic (operation 1502 ).

However, if the data is encrypted (“Yes” if the decision is made 1504 ), determines the system 400 upon decision 1506 whether the encrypted data contains a correct cryptographic signature. As used herein, a cryptographic signature can refer to any sequence of data (e.g., a digital signature) that indicates that the data has been encrypted with a key that is managed by an authorized key management system.

If the encrypted data contains a correct cryptographic signature (“Yes” if the decision is made 1506 ), the system runs 1502 continue writing traffic (operation 1502 ) to monitor.

However, if the encrypted data does not contain a correct cryptographic signature ("No" if the decision is made 1506 ), the system can 400 during surgery 1508 Determine that the storage system might be affected by a security threat.

In some examples, the procedure 1400 and / or the procedure 1500 can be used to provide end-to-end authentication heuristics of applications through the storage stack to prevent an unauthenticated process from entering data associated with a security threat (e.g. ransomware blocks) in the first place Storage system writes.

16 shows an example of a method based on stored data 1600 to detect security threats posed by the system 400 and / or any implementation thereof. The procedure 1600 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1602 monitors the system 400 the write traffic processed by a storage system. This can be done in one of the ways described here.

When making a decision 1604 determines the system 400 whether data already stored on the storage system is deleted or overwritten by the write traffic. If data is not deleted or overwritten ("No" if the decision is made 1604 ), monitors the system 400 also write traffic during operation 1602 .

However, if data is deleted or overwritten by the write traffic ("Yes" if the decision is made 1604 ), the system can 400 during surgery 1606 Determine that the storage system might be affected by a security threat.

The system 400 can determine that data already stored in the storage system is deleted or appropriately overwritten by write traffic. For example, deletions and overwrites can be recognized directly in a file or object-based storage system. In the case of an object-based storage system used by a host to store file systems or databases, the system can 400 inferring deletions by detecting a combination of previously read data immediately or at some point later (e.g. because blocks added to a free list were eventually reused) by not assigning them or overwriting them with zeros. Such deletions or overwrites can in and of themselves be an indication of a possible security threat to a storage system. Additionally or alternatively, such deletions or overwrites in combination with one of the other security threat detection methods described here can indicate a possible security threat to a storage system.

17th shows a remote security threat detection method 1700 that is from the system 400 and / or any implementation thereof. The procedure 1700 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1702 the system intervenes 400 to telephone home data (e.g. telephone home data 606 ) that are transferred from a storage system. This can be done in one of the ways described here.

During surgery 1704 recognizes the system 400 an anomaly associated with the storage system based on the home phone data. The anomaly can include any of the anomalies described herein.

During surgery 1706 represents the system 400 determines that the storage system may have been compromised by a security threat based on the anomaly detected.

To illustrate: A cloud-based surveillance system implementation of the system 400 may use the home phone data transferred to it from a storage system to determine a pattern and / or attribute of read and / or write traffic that could indicate a potential security threat to the storage system. For example, the system can 400 recognize that the overall compressibility of the data stored by the storage system is below a historical norm associated with the storage system or to another storage system (e.g., another storage system that has one or more similar attributes to the storage system). On this basis the system can 400 Determine that the storage system might be affected by a security threat.

In some examples, the System 400 be provided with user input that identifies certain metrics that the system relies on 400 When monitoring, focus on anomalies that could indicate a security threat to the storage system (e.g. in the phone home data and / or in the metrics data managed by the storage system). For example, a customer of a storage system can provide user input representative of the expected types of data for the write traffic so that the system 400 can take this information into account when analyzing the write traffic.

18th shows an exemplary rate-based security threat detection method 1800 that is from the system 400 and / or any implementation thereof. The procedure 1800 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1802 recognizes the system 400 a rate at which data is read from a storage system and written back to the storage system in encrypted form. During surgery 1804 represents the system 400 determines that the storage system may be exposed to a security threat based on the detected rate.

To illustrate, some relatively slow writing patterns can indicate that a malicious entity is actually doing something that a normal program that encrypts a record for legitimate purposes would not. For example, a sequential process that reads data and writes back the same data in uncompressible form, but does so at a rate much slower than a legitimate process would, itself may be indicative of a security threat to the storage system is affected. The system 400 can be configured to detect this difference in speed and, in response, to determine that the storage system may have been compromised by a security threat.

Another example, a process that slowly rewrites a series of files that were originally in a recognizable format to an unrecognizable format could be an indication that the storage system has been compromised by a security threat. Based on this relatively slow rewrite, the system can 400 Determine that the storage system might be affected by a security threat.

Another example: A read / write operation that is relatively faster than expected within a certain period of time may indicate that the storage system has been affected by a security threat. For example, if on a weekend when read / write traffic has historically been relatively slow, the system 400 detects a read / write speed above a certain threshold value, the system can 400 Determine that the storage system might be affected by a security threat.

The rate-based detection of security threats can be carried out over any length of time. For example, to detect relatively slow rates, the system can 400 Monitor one or more metrics related to read / write traffic over a relatively long period of time. In these cases the system can 400 lock and / or otherwise maintain one or more recovery data sets (eg temporary ransomware recovery structures, as described here) for a relatively long period of time if they are required to recover from data corruption caused by the security threat.

19th shows an example of a model-based method based on machine learning 1900 to detect security threats posed by the system 400 and / or any implementation thereof. The procedure 1900 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 1902 a machine learning model is learned (e.g. from the system 400 and / or another system) to detect anomalies related to the read / write traffic processed by a storage system. The machine learning model can be supervised and / or unsupervised as it serves a particular implementation, and can be configured so that there are one or more algorithms for learning decision structures, algorithms for learning association rules, algorithms for learning artificial neural networks, algorithms for deep learning, bitmap algorithms and / or any other suitable data analysis method implemented as one specific implementation. In some examples, the machine learning model is trained with actual ransomware payloads.

In some examples, the machine learning model is trained using honeypot files, block sectors, and / or any other data structure configured to act as a decoy to ransomware and other security threats. These honeypot data structures can be used by the system 400 be maintained at any suitable location (e.g. within the storage system or remotely from the storage system). Depending on how attackers interact with the honeypot data structures, the system can 400 learned the machine learning model. The honeypot outputs can additionally or alternatively be used in combination with any of the other security threat detection methods described herein.

During surgery 1904 gives the system 400 Attribute data for read traffic, write traffic and / or the storage system into the machine learning model. The machine learning model can process this attribute data in any suitable manner. For example, the machine learning model can be trained to consider deduplication checksums / hashes in a data-reducing storage array that uses an out-of-band cloud service that cannot be compromised. In this way, the machine learning model can recognize when the write traffic is different from a historical trend. Another example: The machine learning model can be configured to detect actual ransomware payloads in write traffic.

During surgery 1906 represents the system 400 determines, based on an output from the machine learning model, that the storage system may have been affected by a security threat. This can be done in any suitable manner. For example, the machine learning output may contain a trust score. If the confidence level is above a certain threshold, the system can 400 Determine that the storage system might be affected by a security threat.

20th Figure 12 shows an exemplary garbage collection based security threat detection method 2000 from the system 400 and / or any implementation thereof. The procedure 2000 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 2002 monitors the system 400 a garbage collection process performed by a storage system. The garbage collection process may include any process configured to reclaim space from the storage system as described herein.

When making a decision 2004 represents the system 400 Determines whether there is an anomaly in the garbage collection process performed by the storage system. When the system 400 does not determine that there is an anomaly in the garbage collection process performed by the storage system (“No” in the decision 2004 ), the system runs 400 with the monitoring of the garbage collection process during operation 2002 away. When the system 400 however, determines that there is an anomaly in the garbage collection process performed by the storage system ("yes" to the decision 2004 ), the system can 400 during surgery 2006 Determine that the storage system might be affected by a security threat.

The system 400 can detect an anomaly in a garbage collection process performed by a storage system in any suitable manner. For example, if data on a segment becomes invalid due to a ransomware attack or other security threat, the data becomes more attractive to garbage collector. This can cause the storage system to perform an excessive amount of garbage collection. This change in garbage collection can be made by the system 400 can be detected by analyzing metrics related to the garbage collection process and can be used to determine that the storage system may be affected by a security threat.

The system 400 may additionally or alternatively monitor one or more other internal processes executed by a storage system to determine whether the storage system may be affected by a security threat. For example, the system 400 monitor a deep compression process performed by one or more libraries within a storage system. In this example the system 400 Look for block patterns that match one or more rootkits and / or other structures that are put in place throughout the life cycle of a malicious attack. Such block patterns can be an indication of an upcoming encryption process that will take place at the end of the malicious attack. If such block patterns are recognized, the system can 400 Determine that the storage system might be affected by a security threat.

In some configurations, the first and second storage systems are configured to act as mutually replicating storage systems. For example, all of the data stored in the first storage system can be replicated in the second storage system. This can provide various data redundancy and security features. In these configurations the system can 400 be configured to identify attributes of both storage systems (for example, by monitoring read / write traffic on both storage systems) to determine whether one or both storage systems may be exposed to a security threat.

Illustrative shows 21 an exemplary replication of the storage system based method for detecting security threats 2100 that is from the system 400 and / or any implementation thereof. The procedure 2100 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 2102 monitors the system 400 the read and / or write traffic processed by a storage system. This can be done in one of the ways described here.

With decision 2104 determines the system 400 Whether there is an anomaly associated with the storage system (for example, with the read and / or write traffic processed by the storage system). This can be done in any of the ways described here. When the system 400 no anomaly is detected (“No” if decided 2104 ), the system continues 400 the monitoring of read and / or write traffic during operation 2102 away.

When the system 400 but detects an anomaly (“Yes” if decided 2104 ), the system can 400 Determine whether a similar (e.g., the same) anomaly exists in a replicating storage system that is configured to replicate data stored by the storage system (decision 2106 ).

When the system 400 does not detect an anomaly in the replicating storage system (“No” if decided 2106 ), monitors the system 400 also read and / or write traffic during operation 2102 .

When the system 400 however, detects an anomaly in the replicating storage system ("Yes" if the decision is made 2106 ), the system can 400 during surgery 2108 based on the anomaly found in both storage systems, determine that the storage system (and in some cases the replicating storage system) might be affected by a security threat.

For example, analyzers that run the system 400 implement, are executed on both storage systems when a data set is replicated between a first and a second storage system, the results being compared so that the two storage systems can be used to check each other. For example, metrics can be exchanged that the system 400 Promptly determine that the first storage system may be exposed to a security threat, to ensure that both storage systems see the same information.

Because many read and write requests (or file system, database, or object requests) might only be received by one of the storage systems, the other storage system might only have some metrics. For example, the second storage system, e.g. For example, one that is the target of an asymmetric form of replication for a data set, only have information about the general compressibility of writes for that data set. The two storage systems can still exchange the metrics known to them with one another, each system comparing the metrics known to it with those that originate from the other storage system and using the metrics obtained from the other storage system.

For example, a combination of actual profiles of read, write, and overwrite operations, the compressibility of data in actual read and write requests, and metrics organized by hosts can be exchanged with the storage systems that affect the general compressibility of written data Compare anomalies between the two storage systems and the additional information from a first storage system used to duplicate the analysis of the first storage system on the second storage system.

In a symmetrically replicated storage system with symmetric access to replicated records, metrics can be exchanged to ensure that both storage systems have the relevant data necessary for either storage system to detect certain types of anomalies, such as: B. because some read, write or other requests are directed to one of the two storage systems, while others read, write or other requests are directed to the other of the two storage systems.

This type of exchange can also be used to identify some examples in which one or the other storage system has been compromised. For example, secure hashes of metrics that both storage systems should know can be exchanged instead of exchanging these metrics directly, so that a compromised storage system cannot use trends in a common metric that it has received from the other storage system to calculate future values for them Guess metric to fool the paired storage system. Since metrics can have some natural differences between two storage systems, such as: For example, due to other activities, differences in snapshots or delays in receiving and processing updates, hashed metrics can enable approximations. This can be done in a number of ways, e.g. B. by providing a small set of secure hashes that correspond to discrete ranges of values. If z. A compressibility factor or compressibility factors within time ranges can be provided for recent updates to a data set, e.g. B. on a percentage basis if a first storage system had an overall compressibility of the most recent updates of 20% with 100MB updates in the previous 30-second interval and another had a compressibility of the most recent updates of 18% with 99MB updates in the previous 30-second interval. Seconds interval, the first storage system can safely combine hash values that represent two compressibility ranges from 18% to 20% and 20% to 22%, each with two update amount ranges from 98 MB to 100 MB and 100 MB to 102 MB ( Formation of four secure hashes of each compressibility range with each update amount range), and the second storage system can safely hash values representing two compressibility ranges from 16% to 18% and 18% to 20%, each with three update amount ranges from 96MB to 98MB, 98MB to Combine 100MB and 100MB to 102MB (forming six secure hashes each Compressibility range with each update amount range). Since one of the areas of the first storage system coincides with one of the areas of the second storage system, it can be assumed that the storage systems coincide closely enough without having exchanged too much data about their actual metrics.

In some examples, metrics can be passed to a third party system or a cloud service or a service provided by a provider for comparison purposes, in addition to or instead of the two storage systems themselves that exchange these metric data with one another to detect anomalies. If the two storage systems do not exchange these metrics, an external system or service can be more certain that the metrics it receives from each system will not be guessed by a compromised storage system based on data that it did not compromise with one Replaces storage system.

22nd shows an example of a security threat detection method based on user input 2200 that is from the system 400 and / or any implementation thereof. The procedure 2200 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 2202 identifies the system 400 an attribute which is assigned to the data read from the storage system and / or written into the storage system. The attribute can contain one or more of the attributes described here.

During surgery 2204 shows the system 400 in a graphical user interface that is displayed by a display device, graphical information on the attribute. For example, the system 400 display one or more graphics, analysis information, etc. associated with the attribute.

During surgery 2206 receives the system 400 User input via the graphical user interface (and / or via any other means of receiving user input, e.g. via an API). For example, a user (eg an administrator) can use the graphical information to provide user input that indicates that the attribute indicates a possible security threat to the storage system.

During surgery 2208 represents the system 400 determines, based on user input, that the storage system may be exposed to a security threat.

The system 400 provide a graph over time of various metrics that can be useful in determining when an attack might have started over time. Based on this diagram, a user can provide user input indicating that the storage system may have been compromised by a security threat.

In some examples, the System 400 Be configured to perform multiple security threat detection processes to determine if a storage system has been exposed to a security threat. For example, the system can 400 two or more of the in connection with the 8th to 22nd perform the security threat detection procedures described. These methods for detecting threats can be carried out in parallel and / or serially, as can serve a particular implementation.

Some security threat detection techniques are more reliable than others in detecting threats. In other words, some security threat detection methods can identify a potential security threat with greater accuracy than others. However, a method of detecting threats with relatively high reliability may in some cases be more resource-intensive and / or take more time than methods of detecting threats with relatively low reliability. Hence, the system can 400 In some examples, it can be configured to first use an initial security threat detection process to tentatively determine that a storage system is the target of a security threat. The system 400 may then use a second security threat detection process that is more reliable in detecting threats than the first security threat detection process to verify the preliminary determination that the storage system is a target of the security threat.

Illustrative shows 23 an exemplary multilevel security threat detection method 2300 that is from the system 400 and / or any implementation thereof. The procedure 2300 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 2302 runs the system 400 perform a first security threat detection process on a storage system. The first security threat detection process can include any of the processes described herein for detecting security threats.

With decision 2304 determines the system 400 based on the first security threat detection process, whether the storage system is a potential target of a security threat. When the system 400 based on the initial security threat detection process (“No” if decided 2304 ) determines that the storage system is not a possible target of a security threat, the system executes 400 the first security threat detection process in operation 2302 continue through.

However, if the system 400 determines, based on the initial security threat detection process, that the storage system is a possible target of a security threat (“yes” to decision 2304 ), the system can 400 perform a second security threat detection process related to the storage system (operation 2306 ). The second security threat detection process is configured so that the detection of threats is more reliable than the first security threat detection process. Based on the results of the second security threat detection process, the system can 400 either confirm that the storage system is affected by the security threat or determine that the storage system is not affected by the security threat.

In some examples, the second security threat detection process is performed in response to determining that the storage system may be affected by the security threat. Alternatively, the second security threat detection process can be performed in parallel with the first security threat detection process.

In the process 2300 For example, the first and second security threat detection processes may be different in some examples. For example, the first security threat detection process may require fewer resources than the second security threat detection process. In alternative examples, the first and second security threat detection processes are similar processes. In these examples, the second security threat detection process can be carried out, for example, over a longer period of time and / or with other parameters in order to enable threats to be identified with greater reliability. In alternative examples, the first and second security threat detection processes are the same, they are only performed over different time periods in order to enable determination with different degrees of accuracy.

Various remedial actions taken by the system 400 can be performed in response to determining that a storage system may be affected by a security threat related to 24 to 30th described. Any of the processes described in connection with these figures can be performed independently or in combination (e.g., sequentially or concurrently) with other processes used to perform a remedial action. In addition, any of the remedial actions described in connection with these figures can be performed in conjunction with one or more of the security threat detection methods described herein.

24 Figure 12 shows an exemplary recovery record based remedial action method 2400 that is from the system 400 and / or any implementation thereof. The procedure 2400 can be used alone or in combination with any of the other remedial measures described here.

During surgery 2402 represents the system 400 determines that a storage system may be exposed to a security threat. This can be done in one of the ways described here.

During surgery 2404 instructs the system 400 in response to determining that the storage system may be affected by the security threat, the storage system generates a recovery record for data stored by the storage system. The recovery record can contain a snapshot, a backup record, an ordered log of metadata that describes an orderly application of updates to the data managed by the storage system, and / or any other suitable data structure that can be used to restore data to an undamaged state. The recovery record 400 can apply to all data stored by the storage system, for data stored on a specific storage structure (e.g. a data carrier), for data connected to a specific host, and / or for any other subset of data stored by the storage system , be used.

By instructing the storage system to immediately generate a recovery record in response to determining that the storage system may be affected by the security threat, the system can 400 use the recovery record (or instruct the storage system to use the recovery record) to restore at least some of the data managed by the storage system to an intact state in the event that the potential security threat turns out to be an actual security threat. In some examples, the recovery record is used in combination with one or more previously generated recovery records and / or other data sources (e.g., data residing on a host) to recover data that is already corrupted before the recovery record in response to the determination it is generated that the storage system may be affected by the security threat.

In some examples, the System 400 instruct the storage system to transfer the recovery record to a remote storage system for storage by the remote storage system. The remote storage system may include any combination of computing devices remote from and communicatively connected to the storage system (e.g., over a network). In this way, the recovery record itself can be protected from the security threat. In some examples, the recovery record is transferred to the remote storage system using an NFS protocol, an object storage protocol, an SMB storage protocol, an S3 storage protocol, and / or any other storage protocol suitable for a particular implementation. In some examples, the remote storage system is implemented using write-only media with restrictions on erasure.

In some examples, the System 400 notify the remote storage system of the security threat so that the remote storage system cannot delete the recovery record until one or more conditions are met. Such conditions can include input from one or more authenticated entities, a notification from the system 400 that it is safe to delete the recovery record, and so on. For example, the system 400 Determine that the storage system is, in fact, not the target of the security threat. In response, the system can 400 Send a command to the remote storage system to have the remote storage system delete the recovery record.

In embodiments where the recovery record is stored within the storage system, the system can 400 prevent the deletion or modification of the recovery record until the system 400 determines that the recovery record is not needed to recover data within the storage system. For example, the system 400 instruct the storage system to lock the recovery record, make the recovery record read-only, hide the recovery record, and / or the To otherwise protect the recovery data set. If one or more conditions are met (e.g. entry of one or more authenticated entities, expiry of a certain period of time, etc.), the system can 400 allow the storage system to delete the recovery record.

25th shows an exemplary ongoing privacy-based remedial action process 2500 that is from the system 400 and / or any implementation thereof. The procedure 2500 can be used alone or in combination with any of the other remedial measures described herein.

During surgery 2502 instructs the system 400 suggests a storage system to create recovery records over time (e.g., as a rolling set of snapshots) in accordance with a data protection parameter set. As described herein, these recovery records can be used to recover data maintained by the storage system to a state that corresponds to a selectable point in time. The data protection parameter set may define one or more parameters associated with the generation of the recovery data sets over time as described herein.

During surgery 2504 represents the system 400 determines that the storage system may have been compromised by a security threat. This can be done in one of the ways described here. In some examples, one or more of the at surgery 2502 generated recovery records generated before the system 400 determines that the storage system may be affected by the security threat. One or more of the at operation 2502 generated recovery records can also be generated after the system 400 has determined that the storage system may be targeted by the security threat.

During surgery 2506 modified the system 400 in response to determining that the storage system may be affected by the security threat, the data protection parameter set for one or more of the recovery data sets.

To illustrate: The data protection parameter set can specify a retention period for one or more of the recovery data sets. The retention period defines a length of time that each recovery data record is saved before it is deleted (e.g. 24 or 48 hours, or longer in the case of e.g. a weekend or a longer break). Unless a security threat is detected, each recovery record can only be retained for a relatively short period of time before it is deleted. Based on determining that the storage system may have been affected by a security threat, the system can 400 however, either extend the retention period or suspend the retention period so that at least some of the recovery records are not deleted without a specific command from a source managing the storage system. In this way, one or more of the recovery records can be used to recover data on the storage system to an undamaged state when the system is in use 400 determines that the storage system is in fact affected by the security threat.

As a further example, the data protection parameter set can additionally or alternatively specify a generation frequency of recovery data records which defines a frequency with which the recovery data records are generated. In this example the system 400 Based on a determination that the storage system may have been compromised by a security threat, increase the frequency of recovery records so that more recovery records are available for use in restoring data on the storage system to an undamaged state when the system is in use 400 determines that the storage system is actually affected by the security threat.

As a further example, the data protection parameter set can additionally or alternatively specify a remote storage frequency that defines a frequency with which a subset of recovery data sets in the recovery data sets are transmitted to a remote storage system that is connected to the storage system via a network (e.g. using a network file system, streaming backup, or object storage protocol). In this example the system 400 based on determining that the storage system may be affected by a security threat, change the remote storage frequency. For example, the system 400 Increase the remote storage frequency so that more recovery records are stored in a read-only format on the remote storage system and are available for restoring data on the storage system to an undamaged state when the system is in use 400 determines that the storage system is in fact affected by the security threat.

The system 400 can additionally or alternatively instruct the storage system (e.g. periodically and / or in response to the occurrence of certain events) to generate one or more preliminary ransomware recovery structures (e.g. snapshots). These ransomware temporary recovery structures can be configured so that they can only be deleted or modified in accordance with one or more ransomware recovery parameters. For example, the one or more ransomware recovery structures may indicate a number or collection of types of authenticated entities that must approve deletion or modification of a ransomware provisional recovery structure before the ransomware provisional recovery structure can be deleted or modified. As another example, the one or more ransomware recovery parameters may specify a minimum retention period before which the ransomware temporary recovery structure can be deleted or modified.

In some examples, any of the recovery records generated here can be converted to a locked snapshot set (or other suitable type of recovery record), possibly as a combination of discretionary snapshots that are created at the beginning of a possible attack and can be deleted from the storage system itself if the system 400 determines that the detection was a false positive that does not stand up to scrutiny. Additionally or alternatively, instead of formalizing the creation and retention of discretionary snapshots, garbage collection, merging, deletions and / or other data maintenance on continuous data storage media or frequent snapshots can be postponed until further analysis. For example, as soon as there is an increase in uncompressible writes beyond historical norms, the system can 400 Initiate lockdowns at our discretion to avoid deleting the most recent recoverable images on the storage system that preceded the surge in uncompressible writes. If the increase in uncompressible writes drops back to the historical norm or is insufficient to indicate a plausible ransomware attack, the discretionary snapshots or locks can be released during maintenance work. If they actually hold up, they can be turned into ransomware / anti-corruption snapshots that need reinforced scrutiny to be deleted (or with no option to delete them within a specified or scheduled timeframe). In the case of continuous backup storage, the cleanup or merging of consistency points within the continuous backup storage itself, instead of taking a ransomware / anti-corruption snapshot, can be blocked or greatly reduced when a plausible, persistent attack is detected, using the same types of Duration models and change permission models described for ransomware / anti-corruption snapshots.

Continuous data protection storage is a feature of a storage system that records updates to a data set in such a way that consistent images of previous contents of the data set have been made with a low granularity of time (often on the order of seconds or even less) and over a reasonable period of time (often hours or days) can be accessed. These allow access to very current, consistent points in time for the data record and also allow access to points in time for a data record that could have just preceded an event that, for example, led to parts of the data record being damaged or otherwise lost, keeping close to the maximum number of updates that preceded this event. Conceptually, they are like a series of snapshots of a data set that are taken very frequently and retained over a long period of time, although continuous data backup stores are often implemented very differently than snapshots. A storage system that implements continuous data backup storage can also offer the option of accessing these points in time, accessing one or more of these points in time as snapshots or as cloned copies, or rolling back the data set to one of these recorded points in time.

Over time, to reduce overhead, some points in time in continuous data protection storage can be merged with other nearby points in time, with some of those points in time being essentially erased from storage. This can reduce the capacity required to store updates. It may also be possible to convert a limited number of these points in time into snapshots of longer duration. Such a memory could, for example, maintain a sequence of points in time with low granularity going back a few hours from the present, with some points in time being merged or deleted in order to reduce the effort for up to an additional day. If some of these points in time go back further into the past, some of these points in time could be converted into snapshots that represent consistent point-in-time images from just a few hours.

26th shows an exemplary data recovery process 2600 that is from the system 400 and / or any implementation thereof. The procedure 2600 can be used alone or in combination with any of the other remedial measures described herein.

During surgery 2602 represents the system 400 determines that a storage system has been exposed to a security threat. In this context, the system can 400 Identify data on storage that has been corrupted by the security threat.

During surgery 2604 represents the system 400 (e.g. by instructing the storage system to recover), based on one or more recovery records generated by the storage system, to restore data stored by the storage system to an undamaged state.

The one or more recovery data sets that are used to restore the data to the undamaged state during operation 2604 used may contain one or more recovery records that were prior to the system 400 that determines that the storage system may be affected by the security threat (for example, a recovery record that has been created according to the ongoing privacy-based remedial action 2500 and / or a ransomware temporary recovery structure). Additionally or alternatively, the one or more recovery data records can be used to restore the data to the undamaged state during operation 2604 used to contain one or more recovery records that will be generated after the system 400 has determined that the storage system may be affected by the security threat (e.g., a recovery record that was processed according to the recovery record-based remedial action process 2400 generated).

In some examples, the System 400 also perform data recovery based on a version of the data that is on a system other than the storage system. This other system may include a replicating storage system, host computing device, and / or any other suitable system suitable for a particular implementation. For example, host data residing on a host computing device can be used in combination with one or more of the recovery records described herein to restore data residing on the storage system to an undamaged state.

In some examples, the System 400 select a recovery record for use in restoring data to the storage system by first determining a corruption-free recovery point for the storage system. This corruption-free restore point corresponds to a point in time prior to any data corruption caused by the security threat. The system 400 can then select a recovery record corresponding to the corruption free recovery point for use in a data recovery process.

The system 400 can determine a corruption-free recovery point for a storage system in any suitable manner. For example shows 27 an exemplary data recovery method 2700 that is from the system 400 and / or any implementation thereof. The procedure 2700 can be used alone or in combination with any of the other restoration methods described herein.

During surgery 2702 recognizes the system 400 a potential data corruption in a storage system. The potential data corruption can be caused by any of the security threats described here. The system 400 Detect the potential data corruption based on one or more metrics managed or generated by the storage system, an analysis of the data stored by the storage system, and one or more attributes of a security threat that is causing the potential data corruption.

During surgery 2704 analyzes the system 400 one or more metrics of the storage system in response to the detection of potential data corruption. These metrics can be any of the metrics described here.

During surgery 2706 determines the system 400 A corruption-free recovery point, based on analysis of the one or more metrics of the storage system, for potential use in recovering data that may be corrupted. The corruption-free restore point can be used by the system 400 automatically determined based on one or more metrics of the storage system and / or the data managed by the storage system. Additionally or alternatively, the system 400 the corruption-free restore point based on user input provided by a user.

To illustrate some examples, the system 400 present one or more visualizations (e.g. within a graphical user interface) that can help a user to determine a corruption-free restore point. For example, the system 400 Visualize changes and / or types of changes either in a continuous data backup store or in a time-ordered set of snapshots. For example, the system 400 Provide a graph over time with various metrics that can be useful in determining when an attack might have started over time, where changes are related to differences between snapshots or between continuous data protection consistency points, presented in chronological order. These metrics can include reads and writes, read compressibility, writes compressibility, and hosts issuing requests, including possibly a visualization of unusual compressibility ratios for particular records and from particular hosts.

When file, object, or database information is available for a set of changes (for example, but not limited to, because the storage system itself is a file, database, or object server, or because a storage system that hosts a block volume is supported by a Client host is used to store a file system, object store or database, has suitable format analyzers that can determine the file, object / bucket or database changes from the stored file system or database), the system can 400 In addition, add metrics relating to the number of files or objects or database elements or blobs read with their compressibility, even from different hosts, and the number of files or objects written, overwritten or created and then written, again including compressibility. A visualizer can provide the ability to zoom into directories, areas, files, tablespaces, or objects that show interesting activity, and then create charts or other visualizations to show the activities versus those over time, including the ability To delineate hosts or networks from which requests were received.

With the ability to focus on a specific update data stream that appears to be the source of intentional corruption or encryption, these visualizations can be used by a user to trace back in time when this activity might have started. Then a continuous backup consistency point or a snapshot from a previous point in time can be used as a corruption-free starting point for post-attack recovery. In addition, the system can 400 Visualize the activity of the hosts used in the attack to isolate which parts of the storage system may have been attacked and corrupted or encrypted, which should indicate that other stored data was not affected and is likely to be considered safe.

28 shows an exemplary reconstruction method for a spare storage system 2800 that is from the system 400 and / or any implementation thereof. The procedure 2800 can be used alone or in combination with any of the other remedial measures described herein.

During surgery 2802 manages the system 400 Configuration data for a storage system. The configuration data may include data representative of one or more host connections and identities, storage system destination endpoint addresses, and / or other types of configuration information for a storage system.

During surgery 2804 represents the system 400 found that the storage system has been corrupted due to a security threat. This determination can be made in any suitable manner.

During surgery 2806 uses the system 400 the configuration data to reconstruct a replacement storage system for the storage system. The replacement storage system can be separate from the storage system and / or within the same storage system that can serve a particular implementation.

29 shows an exemplary notification-based remedial action 2900 taken from the system 400 and / or any implementation thereof. The measure 2900 can be used alone or in combination with any of the other remedial measures described herein.

During surgery 2902 represents the system 400 determines that a storage system may be exposed to a security threat. This can be done in one of the ways described here.

During surgery 2904 represents the system 400 provides a notification in response to determining that the storage system may be exposed to a security threat. The notification can be in any suitable format. The notification can, for example, be a message (e.g. a text message and / or an e-mail), a notification within a user interface that is used by a user (e.g. an administrator) to manage the storage system, a telephone call and / or any other suitable type of notification that may serve a particular implementation.

30th shows an exemplary multi-step remedial action 3000 taken from the system 400 and / or any implementation thereof. The measure 3000 can be used alone or in combination with any of the other remedial measures described herein.

During surgery 3002 runs the system 400 perform a first security threat detection process on a storage system. The first security threat detection process can include any of the processes described herein for detecting security threats.

With decision 3004 determines the system 400 based on the first security threat detection process, whether the storage system is a potential target of a security threat. When the system 400 based on the initial security threat detection process (“No” if decided 3004 ) determines that the storage system is not a possible target of a security threat, the system shuts down 400 with performing the first security threat detection process in operation 3002 away.

When the system 400 however, determines, based on the initial security threat detection process, that the storage system is a possible target of a security threat (“yes” to decision 3004 ), the system can 400 perform an initial remedial action (operation 3006 ). The first remedial action can include any of the remedial actions described herein.

The system 400 can also perform a second security threat detection process related to the storage system (Operation 3008 ). The second security threat detection process can be configured to be more reliable in detecting threats than the first security threat detection process. The operations 3006 and 3008 can be done simultaneously or sequentially, as appropriate for a particular implementation.

Based on the results of the second security threat detection process, the system can 400 either confirm that the storage system may be affected by the security threat ("Yes" in decision 3010 ), or determining that the storage system is not affected by the security threat (“No” in decision 3010 ). When the system 400 determines that the storage system is not affected by the security threat ("No" in decision 3010 ), the system can 400 resort to performing the first security threat detection process (which may require fewer resources than the second security threat detection process). When the system 400 however confirms that the storage system may be affected by the security threat ("Yes" in decision 3010 ), the system can 400 during surgery 3012 take a second corrective action. The second remedial action can include any of the remedial actions described herein.

In some examples, the second workaround is different from the first workaround. For example, the first remedial action can include a notification to an administrator of the storage system that the storage system may be affected by a security threat. If the second security threat detection process confirms this, the system can 400 perform a broader corrective action (the second corrective action), such as: B. the creation and / or locking of one or more recovery data sets that can be used to restore damaged data to an undamaged state (e.g. with the authorization models for ransomware protection snapshots described here).

Various types of methods and systems for identifying a potential security threat to a storage system and taking one or more remedial action in response to the security threat will now be described.

In some examples, an implementation of a cloud-based surveillance system can be supported by the system 400 Provide health checks for a storage system or host that can be used to confirm that the storage system or host is operating normally and has not been compromised. This can be done in any suitable manner.

Additionally or alternatively, the system 400 Use write and erasure-protected storage mechanisms to ensure the availability of a certain number of snapshots, copies or backups to protect against ransomware / corruption. These are also useful to support legal stocks or other related operational purposes.

Additionally or alternatively, the system can 400 Provide minimum authorization requirements for policy changes (and possibly set limits on how already blocked data can be affected by an authorized change to the policy) that can be applied to the facility or configuration of any of the policies, models and / or processes described here. A minimum authorization can, for example, require different combinations of authorizations by authenticated operators, administrators, administrators, the storage system vendor, the distribution partner of a storage system, an AI unit that evaluates requirements, and so on. A policy can also specify a number of combinations that are allowed to change the policy. Permitted combinations can, for example, require at least a minimum number of administrators and either several entities within the storage system provider or several entities within the sales partner of a storage system as well as certification by at least two of several CI entities that evaluate the change. Additionally or alternatively, an additional set of administrators (and one or more users authenticated at the CxO level) can override one or more authoritative entities (e.g. a storage system vendor or an AI engine) that may make a change with fewer administrators or without a CxCO- Level authorization from an authenticated CxO level user.

In some examples, recovery record duration times or other time-related models described herein are generally not based on clocks that are subject to external modifications, such as clocks. B. Time of day clocks. For example, time interval clocks (or clocks for the time since switching on) (which are often built into CPUs or other hardware) can be provided by the system 400 The interval information is periodically updated so that a reboot or failover within a storage system can use previously known intervals to ensure that a minimum absolute time has elapsed since a time or event related to a protection snapshot or other aspect of a particular model described here has passed. In this way it can be ensured that an external manipulation of the time (e.g. by hijacking an NTP server in a network) cannot be used to accelerate automatic deletion activities. When the system 400 In addition, the system can detect unusual discrepancies between the interval-based time measurement and the time of day 400 Flag this as a potential indicator that the storage system has been affected by a security threat.

In some examples, the System 400 facilitate the replication of data (e.g. rule set data) between administrative authorities. This can provide additional protection against unintentional or harmful changes to such data.

In some examples, the System 400 instruct a first storage system to store the replication data in a second storage system with a separate implementation, e.g. by the first storage system storing the replicated data as files or objects in a second storage system or otherwise using the regular storage operations of the second storage system instead of using a protocol connection between identically implemented storage systems. In this way, errors that can be used to attack one of the storage systems cannot effectively attack the other storage system.

In some examples, the protection methods and systems described here can be layered in various ways in order to increase the robustness of the overall system and to ensure that unadulterated data is available somewhere. For example, the system 400 provide for the storage of data in a separately implemented storage system under a separate administration domain, which itself saves a series of snapshots or includes continuous data backup and which is monitored for corruption by a monitoring service. In this scenario, the primary storage system also contains snapshots or continuous data backup (or both) and is also monitored by the monitoring service.

Some cases of potential corruption or ransomware or other attacks may not be detected by automated software but can be noticed or foreseen by humans. For example, an administrator or human resources person may have concerns about a disgruntled employee, or someone in information technology may notice behaviors that make no sense. In such cases, a user can provide user input to the system 400 to instruct a storage system to create temporary or suspended ransomware / anti-corruption snapshots that contain otherwise it could have been created by guidelines or software. In a continuous backup store, this can result in a series of reverse, locked snapshots and recovery points. This can also result in a temporary change with lower authorization requirements to increase the rate at which protection snapshots are taken or to extend the time limits in policies before they can be deleted.

In addition to supporting human operators, the system can 400 also provide an API for creating ransomware / anti-corruption snapshots or for locking current snapshots or for managing the creation of snapshots for temporary protection (or any other type of temporary ransomware recovery structure) and converting them to fully protected snapshots. Then, for example, additional security software such as network or server traffic monitors or software that interacts with software threat analysis services can also create and manage combinations of creating ransomware / anti-corruption snapshots, snapshots for temporary protection and conversion from snapshots for interim protection to snapshots for full protection. Such an API can also trigger an extension of the time limits before protection snapshots can be deleted.

In some examples, a storage system may require a certain number of monitoring services or monitoring service endpoints (such as at least two or a majority of more such services or endpoints) to be certified for the storage system in order to delete discretionary ransomware protection snapshots and checkpoints or their policy to reduce the length of time they are retained or to change the length of time or the amount of activity required to determine whether or not the preliminary detection goes so far as to automatically release the discretionary snapshots or automatically converted to full ransomware protection snapshots.

In some examples, the System 400 Configured to selectively throttle operations that are potentially related to a security threat to a storage system and not to throttle operations that are unrelated (or unlikely to be related to) the security threat. In this way, the storage system can continue to function as intended with respect to operations that appear to be potentially related to a security threat but are in fact legitimate operations.

Such operations may include legitimate requests from hosts, such as writing uncompressible data or a certain amount of encrypted data that only appears to be related to a ransomware attack. By throttling such operations (e.g. instead of blocking them), the system can 400 ensure that legitimate operations are being performed on the storage system. In addition, by throttling operations that are actually related to a security threat, the security threat (e.g. a ransomware attack) can be slowed down enough to prevent the recovery data set (e.g. snapshots) and / or the lack of garbage collection The storage space contained in it consumes too much capacity too quickly for one or more other remedial measures to be taken (e.g. intervention by employees connected to the storage system).

31 shows an exemplary selective throttling method 3100 that is from the system 400 and / or any implementation thereof. The procedure 3100 can be used alone or in combination with any of the other methods described herein.

During surgery 3102 recognizes the system 400 a request to perform an operation on a storage system. The operation can be a write operation in which data is to be written to the memory system, a read operation in which data is to be read from the memory, a restricted operation (e.g. an operation to delete, change or otherwise perform an operation that may require authorization) and / or any other suitable operation that may serve a particular implementation.

During surgery 3104 identifies the system 400 one or more attributes of the requirement. The attribute can be the compressibility, format, size, type, bit pattern, file name, etc. of data to be written to the storage system, one or more attributes of a source of the request, a context in which the request was made (e.g. whether the request is in a batch of similar types of requests initiated by a particular source), one or more attributes of metadata associated with the request and / or with data that is the subject of the request , and / or any other attribute that serves a particular implementation.

With decision 3106 determines the system 400 whether one or more during the operation 3104 The attributes determined indicate that the request may be related to a security threat to the storage system. When the system 400 determines that the one or more attributes indicate that the request may be related to the security threat (“yes” if decided 3106 ), the system throttles 400 performing the operation (operation 3108 ). When the system 400 determines that the one or more attributes indicate that the request is not related to the security threat (“No” if decided 3106 ), the system does without 400 alternatively, throttling the performance of the operation (Operation 3110 ).

The system 400 may determine whether the one or more attributes indicate that a request may be related in any suitable manner to a security threat to the storage system. For example, the one or more attributes can be weighted in any suitable manner so that the system 400 based on the weighting of the one or more attributes, determines a total score for a requirement that represents a likelihood that the requirement may be related to a security threat. If the rating is above a threshold, the system can 400 Determine that the requirement might be related to the security threat. If the rating is below the threshold, the system can 400 alternatively, determining that the request is unrelated to the security threat (or at least likely unrelated to the security threat). The threshold can be set to be any suitable value that serves a particular implementation. In some examples, the threshold may be adjustable so that the system 400 Can be selectively set by a user to be more or less appropriate to flag an operation as potentially associated with a security threat, depending on how sensitive the system is to the user 400 wishes.

In some examples, the System 400 Only throttle the performance of an operation on a storage system if the system 400 First, it determines that a data set stored by the storage system is in a compromised state in which the data set may be affected by a security threat.

For example, the system 400 determine one or more of the anomalies described herein and, based on the one or more determined anomalies, determine that the data set stored by the storage system is in a vulnerable state in which the data set may be affected by a security threat. While the record is in a compromised state, the system can 400 Determine that a request to perform an operation might be related to the security threat. In response, the system can 400 throttle the performance of the operation.

The system can then 400 Determine that the data set stored by the storage system is no longer in a compromised state. While the data record is no longer in the endangered state, the system 400 may have an additional requirement to perform an additional operation on the storage system. If the data set is no longer in a compromised state, the system can 400 refrain from throttling the performance of the additional operation.

The system 400 may additionally or alternatively determine whether the performance of an operation relating to a storage system should be throttled based on a current storage or workload state of the storage system itself. For example, if the storage system has a relatively large amount of available storage space (for example, if the current storage status of the storage system indicates that the storage system is only 20% full), the system can 400 Do not (or only minimally) throttle operations. In contrast, if the storage system has a relatively small amount of available storage space (e.g., the current storage state of the storage system indicates that the storage system is more than 80% full), the system may 400 throttle operation. Another example: The throttling can take place at the overall workload level of the storage system (e.g. throttling can only take place if the current workload state of the storage system is greater than a threshold value) and / or on another attribute of the Storage system based.

The system 400 can throttle the performance of an operation in any suitable manner. For example, the system can 400 delay performing the operation for a predetermined amount of time. This predetermined period of time can be of any suitable duration (for example between 10 and 500 milliseconds). In some examples, the predetermined amount of time may vary from operation to operation, depending on how likely the system is 400 determines that every single operation is related to a security threat to the storage system. For example, this can system 400 Determine that a first operation has a high probability of being related to a security threat to the storage system (e.g., the system may 400 Determine that the first operation has a 90 percent probability of being related to the security threat) and that a second operation is less likely to be related to the security threat (e.g., the system may 400 Determine that there is a 50 percent chance that the second operation is related to the security threat). In this example the system 400 throttle the first operation more than the second operation. For example, the system 400 delay performing the first operation by 200 milliseconds, while it only delays performing the second operation by 50 milliseconds.

As another example, the system 400 Reduce the performance of the operation by limiting the write speed to a certain number of writes (e.g. a few megabytes of writes) per second. This limitation may take into account the capacity available to store recovery records because such records can fill the storage system relatively quickly if the rate at which a recovery record is accumulating overwritten data grows too fast for remedial action to be taken (e.g. E.g. the knowledge that it is a legitimate encryption task or the knowledge that the storage system or a network connection or a host must be taken offline). Therefore, the write speed can be limited to ensure that the combination of regular (e.g. unmarked) activity and unusual (e.g. marked) activity does not result in a recovery record being saved to a storage system within a certain period of time (e.g. 24 hours, 48 hours or before the end of a weekend).

The following describes various examples of how one or more attributes of a requirement can be identified and, based on the one or more attributes, it can be determined that the requirement may be related to a security threat.

In one example, the system 400 recognize a write request provided by a source to perform a write to a storage system (ie, to write data to the storage system). In response to this, the system can 400 determine one or more attributes of the write request to determine whether the write request may be related to a security threat to the storage system.

For example, the system 400 determine a compressibility of the data associated with the write operation and determining whether the compressibility is below a threshold value. If the compressibility is below the threshold (e.g. relatively uncompressible), the system can 400 Determine that the requirement may be related to a security threat to the storage system. In response, the system can 400 write performance slows down.

Additionally or alternatively, the system 400 determine a format of the data associated with the write operation. The system 400 can determine whether the format corresponds to an expected format of the data. If the format does not match the expected format, the system can 400 Determine that the write request may be related to the security threat to the storage system and, accordingly, throttle the performance of the write.

The system 400 can appropriately determine whether a data format matches an expected format for the data. For example, the system 400 recognize a file extension and / or the file name of a data instance and determine on the basis of this information that the data instance should be formatted as an image file. On the basis of an analysis of the data instance, the system can 400 however, determining that the data instance is not actually formatted as an image file. The system 400 can accordingly mark the data instance as possibly related to the security threat.

Additionally or alternatively, the system 400 determine a source of the write request. Based on one or more attributes of the source can the system 400 Determine that the source may be involved in the security threat (e.g., is a source) and therefore determine that the write operation is also related to the security threat. For example, the system 400 Determining that the source was previously associated with one or more security threats to the storage system, determining that the source is the source for more than a predetermined threshold of requests to perform operations on the storage system for a predetermined period of time, and / or determine that there is an anomaly in a request pattern provided by the source. Based on one or more of these factors, the system may 400 Determine that the write request may be related to the security threat to the storage system and, accordingly, throttle the performance of the write. Alternatively, the system 400 Refrain from throttling the write performance based on one or more of these factors. When the system 400 For example, if the source determines that the source is not the source for more than a threshold of requests in a given period, the system may 400 Refrain from throttling (or minimally throttling) operations associated with source-supplied requests.

Another example: the system 400 can recognize a source-provided request to delete or modify data stored in the storage system. In response to this, the system can 400 determine an attribute of the data. For example, the system 400 Determine that the data contains a recovery record (such as a snapshot) and / or any other type of data that most external sources would not normally delete or modify. As another example, the system 400 Determine that the storage system has held the data for longer than a threshold and / or that the data resides in a specific storage structure (such as a folder) where multiple instances of data from the same source are deleted or modified. Based on one of these attributes, the system can 400 Determine that the request may be related to a security threat to the storage system and, accordingly, throttle the performance of the deletion or modification.

32 Figure 12 shows another exemplary selective throttling method 3200 from the system 400 and / or any implementation thereof. The procedure 3200 can be used alone or in combination with any of the other methods described herein.

During surgery 3202 recognizes the system 400 a variety of requests for performing a variety of operations on a storage system while a data set stored by the storage system is in a vulnerable state where the data set stored by the storage system may be exposed to a security threat.

During surgery 3204 identifies the system 400 one or more attributes of the requirements.

On the basis of the determined one or more attributes, the system can 400 selectively throttle some of the operations but not others.

During the operation 3206 determines the system, for example 400 based on one or more attributes that a first subset of requirements within the plurality of requirements may be related to the security threat. The system throttles accordingly 400 during surgery 3208 Operations related to the first subset of requirements.

During the operation 3210 represents the system 400 however, based on one or more attributes, determines that a second subset of requirements within the plurality of requirements is unrelated to the security threat. Accordingly, the system dispenses with it 400 during surgery 3212 on the throttling of operations associated with the second subset of requests.

In some examples, the System 400 analyze one or more intra I / O relationships to identify a security threat to a storage system. As used herein, an intra-I / O relationship refers to any discernible relationship (e.g., pattern, timing, etc.) between one or more input operations relating to a storage system (e.g., write operations that write data to the storage system) and an or multiple output operations related to the storage system (e.g. read operations that read data from the storage system). An anomaly in an intra-I / O relationship can indicate a potential security threat to a storage system. For example, an anomaly in an intra-I / O relationship could indicate that a source is reading unencrypted data and writing encrypted data.

33 Figure 12 shows an exemplary intra-I / O relationship based security threat detection method 3300 that is from the system 400 and / or any implementation thereof. The procedure 3300 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 3302 identifies the system 400 one or more input operations and one or more output operations performed between a source and a storage system. The source may include a host and / or any other entity that requests the storage system to read data for Write data and / or transfer to perform any other suitable type of operation with respect to the storage system.

During surgery 3304 identifies the system 400 an anomaly in a relationship between one or more input operations and one or more output operations. Various examples of this are given here.

During surgery 3306 represents the system 400 determines that the storage system may have been compromised by a security threat based on the anomaly.

Various examples will now be given of detecting an anomaly in a relationship between one or more input operations and one or more output operations. These are merely illustrative of the many different anomalies that can be identified in relation to a relationship between one or more input operations and one or more output operations in order to determine that a storage system may be exposed to a security threat.

In some examples, the System 400 detect an anomaly in a relationship between one or more input operations and one or more output operations by setting a timing (also known as intra-I / O timing) between the one or more input operations and the one or more identifies the plurality of output operations and, based on the timing, determines that the one or more input operations and the one or more output operations are correlated.

For example, the system 400 specify that every output operation performed on a source is followed by an input operation on the source within a certain period of time. This may indicate that a source is systematically reading unencrypted data and writing encrypted data that is relatively uncompressible. Accordingly, the system can 400 mark such activity as an indicator that the storage system has been affected by a security threat.

Additionally or alternatively, the system 400 detect an anomaly in a relationship between one or more input operations and one or more output operations by determining that the one or more input operations and the one or more output operations according to an identifiable pattern (also referred to as an intra-I / O pattern ) be performed. This non-randomness can be an indicator that the storage system has been affected by a security threat.

For example, the system 400 Determining that the one or more input operations and the one or more output operations proceed through sequentially numbered addresses (e.g., sectors) of a memory structure (e.g., a flash-based storage drive) within the storage system. To illustrate: An alternating pattern of output and input operations can be carried out with a sector (e.g. sector 0 ) and progress through sequentially numbered sectors (e.g. Sector 1, Sector 2, etc.). In response to the detection of such a pattern, the system can 400 Determine that the storage system might be affected by a security threat.

As another example of detecting an abnormal intra-I / O pattern, the 400 Determining that the one or more input operations and the one or more output operations are continuous from the beginning of a partition within a storage structure of the storage system. In response to the detection of such a pattern, the system can 400 Determine that the storage system might be affected by a security threat.

Additionally or alternatively, the system 400 determine an anomaly in a relationship between one or more input operations and one or more output operations by determining that the one or more output operations include read operations that cause data stored by the storage system for more than a predetermined amount of time to be removed from the storage system being transferred to the source, determining a total amount of the data transferred from the storage system to the source, determining that the one or more input operations include write operations that write new data to the source, and determining that a total of the new data is within a threshold of the Total amount of data transferred from the storage system to the source.

To illustrate: the system 400 can recognize that relatively old data (e.g. data that has been stored by the storage system for longer than a specified period of time, e.g. longer than a year) is being read from a source and that shortly afterwards approximately the same amount of data is being written back from the source to the storage system . In response, the system can 400 Determine that the storage system might be affected by a security threat.

The system 400 may also consider one or more other factors to determine whether the storage system may be exposed to a security threat when reading relatively old data from the storage system.

For example, the system 400 determine whether the writes take place within a certain time interval after the occurrence of another read process. This can indicate whether the timing of the read and write operations is correlated. Accordingly, if the writes each take place within a certain time interval after the occurrence of another read, this can be a further indication that the storage system may have been affected by a security threat.

Additionally or alternatively, the system 400 Determining whether the data read from the storage system by the source has not been read from the storage system for more than a specified amount of time prior to performing the read operations. If the data has not been read from the storage system by any source for more than a threshold amount of time prior to performing the read operations, this may be another indication that the storage system may have been exposed to a security threat.

Additionally or alternatively, the system 400 determine whether each data instance (e.g. file) contained in the data read by the source from the storage system is transmitted to the source only once (e.g. during a certain period of time). If each data instance is only submitted once to the source, this can be another indicator that the storage system may have been affected by a security threat.

In response to determining that a storage system may have been affected by a security threat in any of the intra-I / O relationship-based detection methods described herein, the system may 400 perform any of the corrective actions described here.

In some examples, the System 400 use an authorization scheme with respect to a logical address included in a request to perform an operation with respect to a storage system. This ensures that a source of the request is authorized to initiate operations with respect to the storage system. As described here, the authorization scheme based on the logical address can, for example, result in unauthorized operations (eg operations associated with security threats against the storage system) failing at least for a large part of the time.

As used herein, a logical address includes information (referred to herein as a logical element) representative of a virtual or physical storage location (e.g., a particular block, file location, volume, partition, storage location, etc.) within a storage system are. For example, an exemplary logical address can include a block address that relates to a particular volume block of a storage structure.

A logical address may be included in a request to perform an operation to determine a storage location associated with the operation. For example, a read access request from a source may contain a logical address that identifies a storage location from which the source is requesting reading of data. As another example, a write access request from a source may include a logical address that identifies a memory location to which the source is requesting data to be written. Another example: a request to delete or change data from a source may contain a logical address that identifies a location of data that the source wishes to delete or change.

In accordance with the principles described herein, a logical address based authorization scheme implemented by the System 400 requires that an authorization element be included in a logical address (in addition to the logical element representing a storage location) of a request in order for an operation associated with the request to be performed. The authorization element can contain a security token, a digital signature of the data associated with the operation, a digital signature of the logical element and / or any other bit sequence which is generated in accordance with the authorization scheme. When the system 400 requires the inclusion of such an authorization element in a logical address, it can lead to unauthorized operations (eg operations that are associated with security threats to the storage system) fail at least for a large part of the time. This is because it may be very unlikely (or at least it may take many tries) that an unauthorized source will put a valid token into a logical address.

34 shows an exemplary logical address 3400 included in a request for Performing an operation on a storage system may be included. As shown, contains the logical address 3400 a logical element 3402 and an authorization element 3404 . The logical element 3402 and the authorization element 3404 can each be of any suitable length (e.g. in the form of bits). For example, the logical element 3402 twenty or more bits long and the token element can be eight to twenty bits long. The authorization element 3404 can, as shown, be at the beginning of the logical address 3400 or at any other suitable place within the logical address 3400 .

As described here, the system can 400 the logical address 3400 analyze to see if the logical address 3400 the authorization element 3404 contains and whether the authorization element 3404 is valid. On the basis of these findings, the system can 400 take appropriate action in relation to the operation associated with the request.

Illustrative shows 35 an exemplary logical address-based method 3500 for authorizing operations relating to a storage system. The procedure 3500 can from the system 400 and / or any implementation thereof and used alone or in combination with any of the other methods described herein.

During surgery 3502 recognizes the system 400 a source provided request to perform an operation on a storage system. The request may include a logical address that includes a logical element representative of a storage location within the storage system.

With decision 3504 determines the system 400 Whether the logical address also contains a token indicating that the source is authorized to initiate operations with respect to the storage system. This determination can be made in any suitable manner.

For example, the system 400 analyze a predetermined bit sequence that is contained in the logical address for the authorization element. As described herein, the predetermined bit sequence can be in any suitable location within the logical address. For example, the predetermined bit sequence can be at the beginning of the logical address.

In some examples, the System 400 Maintain data that is representative of the authorization element and compare this data with the data in the logical address. Based on this comparison, the system can 400 Determine whether the logical address contains a valid authorization element.

The system 400 may alternatively determine in some other suitable manner whether a token is valid. For example, if the token contains a digital signature of the data associated with an operation, the system can 400 generate a second digital signature of the data and then compare the second digital signature with the digital signature contained in the authorization element. If the two digital signatures are the same, the system can 400 Determine that the token is valid. It will be seen that a digital signature can contain other elements in addition to data, such as the logical element and / or secret information which the source previously provided to the system 400 made available.

When the system 400 determines that the logical address does not contain the authorization element or that the logical address contains an invalid authorization element (“No” if the decision is made 3504 ), the system prevents 400 that surgery at surgery 3506 is performed. This can be done in any suitable manner. For example, the system 400 block the request (or instruct the storage system to block the request).

When the system 400 determines that the logical address contains a valid authorization element ("Yes" if the decision is made 3504 ), the system allows 400 alternatively, performing the operation 3508 . This can be done in any suitable manner. For example, the system 400 perform the operation (or instruct the storage system to perform the operation).

The system 400 may take any other appropriate action in relation to the operation for a particular implementation. When the system 400 for example, determines that the logical address does not contain the authorization element or that the logical address contains an invalid authorization element (“No” if the decision is made 3504 ), the system can 400 alternatively, allow the operation to be performed, but in a restricted manner. For example, the system 400 throttle (e.g. slow down) and / or otherwise restrict the operation in order to minimize possible data corruption that could be caused by the operation.

A source of a request can be made aware of the requirements for the inclusion of an authorization element in a logical address in a suitable manner. For example can the system 400 (or any other entity) provide the source with data specifying the authorization element. In some examples, this may be done in response to the system 400 receives an authorization request from the source and authenticates the source based on the request. The data indicating the authorization element can indicate the actual bit sequence that is to be contained in the logical address as authorization element and / or parameters that are to be used by the source for generating the authorization element. For example, the data indicating the authorization element may include parameters instructing the source to generate a digital signature of the data associated with the operation and / or a digital signature of the logical element.

As an example of the foregoing, a storage system client may provide a storage system with a logical address (associated with a volume) to access (e.g., read, write, deallocate, or virtually copy) certain blocks of the volume. If this address 64 Bits is long, but only 40 bits are required to address a block, then the remaining 24 bits (e.g. the upper, most significant bits) can be used to code something. This allows the storage system client to communicate a block address in the lower 40 bits and something else in the upper 24 bits, using the normal addressing scheme provided by a block protocol (e.g. SCSI or NVMe) to include both a block address and a to provide some additional information that is ignored for addressing purposes but used for a different purpose. As described here, this additional information can be an authorization element (e.g. a digital signature that is calculated using an exchanged key (such as a symmetric key or part of a public / private key pair) that is used to digitally sign a block number and possibly a data carrier. Identifier is used). In the case of write transactions, it could even digitally sign the contents of the block.

When the storage system receives an I / O request with an address, it can split this address into the actual address part (e.g. the least significant 40 bits) and the validation part (e.g. the most significant 24 bits) and use this validation part to determine whether the client request was digitally signed correctly and then reject the request.

In some examples, a storage system may be configured to perform one or more extensible intrusion monitoring processes that are configured to monitor storage operation requests related to the storage system for one or more attributes that may indicate that data stored by the storage system may be targeted of an attack. As used herein, an attack can include any type of attack that can be performed on the data stored by a storage system. An attack can, for example, be an encryption attack on the data stored by the storage system (e.g. a ransomware attack or an attack in which data is encrypted with or without extortion of money from a unit connected to the data to be encrypted), an attempt that is carried out by the storage system corrupt stored data (e.g. a malware attack), an attempt to steal the data, coupled with one or more operations configured to hide the data theft, any of the security threats described here, and / or any other nefarious interaction with the data stored by the storage system. In some examples, an attack may include one or more operations identified by security researchers as an attack on data stored on a storage system.

The one or more extensible intrusion monitoring processes can be updated (e.g., in real time while they are running) with attribute data that the storage system receives from a remote source. The attribute data can be representative of one or more attributes of a known attack that was carried out against data stored by a target system other than the storage system. If the storage system determines that one or more attributes of the storage operation requirements match one or more attributes of the known attack, the storage system can determine that data stored by the storage system may be the target of an attack. In this way, the storage system can use the results of intrusion monitoring processes that are carried out by one or more systems remote from the storage system in order to more effectively detect and improve one or more attacks on data stored on the storage system (for example, to prevent the effects of one or more attacks or minimize).

Illustrative shows 36 an exemplary implementation 3600 in which a storage system 3602 configured so that it is over a network 3606 with a remote system 3604 communicates. The storage system 3602 can be implemented by any of the storage systems described here. The remote system 3604 can be represented by any suitable combination of Data processing devices (e.g. the system 400 ) or by any other suitable system. In some examples, the remote system 3604 be associated with (e.g., managed by) a managed services provider that supports various types of storage systems, including storage systems that implement block storage, file servers, object storage, key-value databases, and so on.

As shown, the storage system 3602 a processor 3608 that is configured to have an extensible intrusion monitoring process 3610 executes. The processor 3608 can through controller 506 or any other suitable storage system element can be implemented.

The extensible attack monitoring process 3610 can be implemented by any suitable executable application or process supported by the storage system 3602 Can be used to address storage operation requirements related to the storage system 3602 to monitor one or more attributes that indicate an attack against the storage system 3602 can indicate stored data. Based on the monitoring, the extensible intrusion monitoring process 3610 configured to give status information 3612 that indicate whether the storage system 3602 stored data may be affected by an attack. The status information 3612 may also indicate what type of attack has been detected and provide a means of learning more about that particular type of attack, including, but not limited to, providing such information as a link to or other means of locating online Information about the type of attack, its severity, what types of files it is attacking and / or how an attack tool (e.g. malware or ransomware) that carried out the attack can be found and eliminated.

The extensible attack monitoring process 3610 is extensible in that it can be dynamically updated and / or configured to provide additional functionality over time. For example, the Extensible Intrusion Monitoring Process 3610 dynamically updated in order to monitor additional or alternative attributes during runtime (e.g. in real time, during the extensible attack monitoring process 3610 is performed).

To illustrate: As shown, the storage system 3602 (e.g. the processor 3608 ) the attribute data 3614 from the remote system 3604 over the network 3606 receive. The storage system 3602 can the attribute data 3614 before and / or during the execution of the extensible attack monitoring process 3610 receive. The attribute data 3614 may be representative of one or more attributes of a known attack carried out against data received from a target system other than the storage system 3602 were saved. The target system can be another storage system and / or another type of system that can be the subject of an attack.

In some examples, the attribute data 3614 Contain data representative of a pattern associated with the known attack. For example, the pattern may contain a pattern of storage system requirements (e.g., alternating reading and writing of data, certain read and write sizes and orientations, etc.) used by the known attack. As another example, the pattern may indicate a file replacement pattern (e.g., a specific naming pattern for temporary files stored during a file replacement process) used by the known attack.

Additionally or alternatively, the pattern may indicate an intra-I / O relationship associated with the known attack (e.g., timing, etc.) between one or more input operations related to a storage system (e.g., write operations that write data to the storage system) and one or more output operations related to the storage system (e.g. read operations that read data from the storage system).

Additionally or alternatively, the pattern can contain a pattern that is linked to a history of directory, file, object and / or database operations. Additionally or alternatively, the pattern can itself be associated with damaged data. For example, there could be a common string of characters within the writes, or there could be a common method of interfering with previous pattern detectors, e.g. by writing a seemingly valid JPEG format that can still be recognized by an alternative pattern used in previous recognition configurations was configured.

The pattern may additionally or alternatively contain any other type of pattern described herein and / or any other type of pattern that can be identified by security researchers and / or systems.

Additionally or alternatively, the attribute data 3614 Contains data representative of compressibility of data provided by the known attack may be written to the target system, a format of data written to the target system by the known attack, and / or any other attribute described here.

The remote system 3604 can the attribute data 3614 obtained and / or generated in any suitable manner. For example, the remote system 3604 be in communication with a variety of storage systems and be configured to have attribute data 3614 generated based on an analysis of storage operation requirements with respect to the plurality of storage systems. This analysis can extend over a longer period of time, so that the remote system 3604 generated attribute data 3614 are always up to date. In some examples, the remote system 3604 Perform a forensic analysis of a known attack to determine how to identify a source of the attack or the files, volumes, objects and / or database items that were attacked. Based on this, the remote system can 3604 Analyze patterns from these sources rather than simply looking at all storage requirements as part of the same attack pattern.

Additionally or alternatively, the remote-controlled system 3604 be implemented by a target system that is the subject of the known attack. In this example, the storage system 3602 receive the attribute data directly from the target system itself.

The storage system 3602 can use the extensible intrusion monitoring process 3610 with the attribute data 3614 To update. This can be done in any suitable manner. For example, the storage system 3602 the attribute data 3614 store in a way that causes the extensible intrusion control process 3610 the attribute data 3614 used during runtime. In some examples, the storage system may 3602 the extensible attack monitoring process 3610 dynamic with the attribute data 3614 update during the extensible attack monitoring process 3610 from the storage system 3602 is performed.

The storage system 3602 can use the extensible intrusion monitoring process 3610 use it to address storage operation requirements related to the storage system 3602 monitor for one or more attributes of the storage operation requests that match one or more attributes of the known attack as identified by the attribute data 3614 being represented. When the storage system 3602 while monitoring one or more attributes of the storage operation requests that match one or more attributes of the known attack, the storage system may 3602 Determine that the storage system 3602 stored data may be the target of an attack (e.g., the known attack or an attack that has attributes that are similar to the known attack).

The storage system 3602 may determine whether one or more attributes of the memory operation requirements appropriately match the one or more attributes identified by the attribute data 3614 being represented. For example, the storage system 3602 determine whether one or more attributes of the memory operation requirements meet a similarity threshold with respect to the one or more attributes of the known attack. The similarity threshold can be set in any suitable manner.

To illustrate: the storage system 3602 may determine whether a pattern associated with the requirements of the store operation is substantially similar to a pattern associated with the known attack. Any suitable similarity metric can be used to determine a degree of similarity between the patterns. For example, if the pattern associated with the known attack alternately reads compressible data and writes relatively uncompressible data, and the pattern associated with memory operation requests has a similar pattern of reads and writes, the memory system may 3602 Determine that the storage system 3602 stored data may be affected by an attack.

In response to determining that the storage system 3602 The storage system can potentially be the target of an attack 3602 perform any of the corrective actions described here. For example, the storage system 3602 an interim or protected recovery record for those from the storage system 3602 generate stored data that throttles memory operation requests (eg, by slowing down reads and / or writes from a particular source), provide notification, and / or prevent one or more operations related to memory operation requests from being performed.

In some examples, it may be the storage system 3602 the remote system 3604 (and / or any other from the storage system 3602 remote system) enable the storage operation requirements of the storage system 3602 analyze. For example, if the storage system 3602 (e.g. in response to determining the storage system 3602 that the from the storage system 3602 The storage system can potentially be the target of an attack 3602 Attribute data representative of one or more attributes of the storage operation requirements to the remote system 3604 transferred so that the remote system 3604 can check whether the data is actually the target of the attack.

Illustrative shows 37 an exemplary implementation 3700 that the in 36 implementation shown 3600 is similar, but so is the storage system 3602 (e.g. the extensible attack monitoring process 3610 from the processor 3608 is executed) that contains the attribute data 3702 to the remote system 3604 transmits. The attribute data 3702 are representative of one or more attributes of the storage operation requirements of the storage system 3602 . These attributes can include any of the attributes described herein. In some examples, the System 3602 the attribute data 3702 anonymize the attribute data before it 3702 to the remote system 3604 transmits.

The remote system 3604 can the attribute data 3702 analyze in any suitable manner to determine one or more attributes of storage operation requests indicative of a possible attack on the storage system 3602 can indicate stored data. Based on the analysis, the remote system 3604 a confirmation to the storage system 3602 and / or to the one with the storage system 3602 Submit associated personnel indicating that the storage system 3602 stored data are affected by the attack. In response to receiving the confirmation, the storage system may 3602 perform any of the corrective actions described herein (e.g., a more aggressive corrective action than that taken in response to determining that the storage system is running 3602 possibly the target of the attack).

In some examples, the storage system 3602 an attack on the storage system 3602 stored data does not recognize while the storage system 3602 monitored the attack. This can be due to one or more reasons, e.g. if the attack was not the known attack related to the attribute data 3614 resembles. In these cases, the storage system 3602 Maintain historical attribute data representative of one or more attributes of the store operation request over a period of time prior to the attack that was not detected during monitoring but was realized at a later time. For example, if an attack is detected, the storage system 3602 analyze a profile of the attack on the attacked storage elements (e.g. files, data carriers, objects and / or databases). This can include the specific operations and the sizes or times of these operations, operation patterns (the order in which elements were attacked and the order of operations that were used against these elements), simultaneity, recognizable data patterns within these written blocks (which are contained in the damaged memory blocks could be examined and the extent of which was understood at the time the attack was carried out). It can also include an analysis of the damaged data itself. The results of this analysis can be saved as historical attribute data. In some examples, the historical attribute data can be used to identify underflows of memory operations that could be an attack and that are interspersed with regular memory operations that are not part of an attack.

The storage system 3602 can send the historical attribute data to the remote system 3604 (or any other from the storage system 3602 remote system) for analysis by the remote system 3604 transfer. For example, the remote system 3604 generate updated attribute data representative of one or more attributes represented by historical attribute data and the updated attribute data to the storage system 3602 and / or any other system for use with one or more extensible intrusion control processes.

38 shows an example intrusion monitoring process 3000 which can be performed by any of the storage systems described here. The process 3800 can be used alone or in combination with any of the other methods described herein.

During surgery 3802 a storage system receives attribute data representative of one or more attributes of a known attack carried out against data stored by a target system other than the storage system.

During surgery 3804 the storage system updates an extensible intrusion monitoring process executed by the storage system with the attribute data.

During surgery 3806 monitors the storage system using the extensible intrusion control process that is updated with the attribute data, storage operation requests of the storage system for one or more attributes of the storage operation requests associated with the one or match the multiple attributes of the known attack.

39 Figure 12 shows another exemplary intrusion monitoring process 3000 which can be performed by any of the storage systems described here. The process 3900 can be used alone or in combination with any of the other methods described herein.

During surgery 3902 a storage system receives attribute data representative of one or more attributes of a known attack carried out against data stored by a target system other than the storage system.

During surgery 3904 the storage system uses the attribute data to identify one or more attributes of storage operation requests of the storage system that match the one or more attributes of the known attack.

During surgery 3906 based on determining that one or more attributes of the storage operation requirements match one or more attributes of the known attack, the storage system determines that data stored on the storage system may be affected by an attack.

In some embodiments, the system can 400 analyze one or more file replacement operations to identify a security threat to data stored on a storage system. A file replacement operation may refer to an operation performed and / or requested by a source (e.g., a host communicating with the storage system) to replace a first file on the storage system with a second file. In some embodiments, the second file that replaced the first file may have the same file name as the first file and be stored in the same storage structure (e.g., a storage drive, directory, etc.) of the storage system in which the first file was previously stored was. However, the second file that replaced the first file may be different from the first file. For example, at least some of the data contained in the second file may differ from the data contained in the first file, and therefore one or more attributes (e.g. file size, compressibility ratio, bit pattern, file format, etc.) of the second file may differ from distinguish one or more corresponding attributes of the first file. As described herein, an anomaly in one or more file replacement operations could indicate a potential security threat to the data stored on the storage system.

40 Figure 12 shows an exemplary file replacement based method for detecting security threats 4000 that is from the system 400 and / or any implementation thereof. The procedure 4000 can be used alone or in combination with any of the other security threat detection methods described herein.

During surgery 4002 can the system 400 determine a first set of attributes associated with a first file stored in a storage system. The system 400 can determine the first set of attributes at any time before, during, and / or after the first file has been written to the storage system.

The first set of attributes may contain one or more attributes (also referred to herein as file attributes) that describe one or more aspects of the first file. The example attributes of the first file include, but are not limited to, a file name of the first file, a file size of the first file, a file format of the first file, a bit pattern of the first file, a compressibility ratio of the first file, a source of the first file, and so on.

As used herein, a bit pattern of a file can describe a pattern of a bit sequence that represents the file. A file format of a file can indicate a data type contained in the file and, in some examples, can be determined by recognizing one or more formatting bytes, byte sequences, byte patterns and / or bit patterns in the file that are specific for a certain format type (e.g. HTML, Unicode, UTF-8, archive files, audio files, video files, ZIP archives, Office documents, etc.). A compressibility ratio of a file can indicate a percentage and / or a total amount of storage space that is saved when the file is compressed (e.g. 15%). A source of a file can identify a source that wrote the file to the storage system. For example, the source of a file may indicate a source identifier (ID) and / or a source address (e.g. Internet Protocol (IP) address, MAC (Media Access Control) address, etc.) of the source that wrote the file to the storage system and / or requested the first file written to the storage system. Other attributes of a file that can be used in accordance with the methods and systems described herein are also possible and are contemplated.

During surgery 4004 can the system 400 Determine to replace the first file on the storage system with a second file. In some embodiments, the first file in the storage system may be replaced with the second file in response to one or more requests received from a source. The source can be a host and / or any other device that transmits requests to the storage system to read data, write data, erase data, and / or perform other operations applicable to the storage system. In some embodiments, in order to replace the first file in the storage system with the second file, the source may request the storage system to delete the first file from a storage structure (e.g. a file directory) of the storage system and then to write the second file to that storage structure, wherein the second file has the same file name as the first file. Alternatively, the source may request the storage system to write the second file with a temporary name that differs from a file name of the first file to a storage structure in which the first file is currently stored, to delete the first file from this storage structure, or and then rename the second file from its temporary name to the filename of the first file. In some embodiments, in order to replace the first file on the storage system with the second file, the source may request that the first file on the storage system be overwritten in place. If the first file is overwritten in place, at least some of the content in the first file is overwritten with different content (e.g., some or all of the content of the first file is zeroed). In this case, the first file may still have the same name, but due to the overwritten contents of the file, it can be considered a second file after it has been rewritten on the spot for the purposes of the examples described here. Other implementations for replacing the first file in the storage system with the second file are also possible and contemplated.

In some embodiments, the source may require the storage system to replace a first set of files with a second set of files. The first set of files may contain one or more files that are stored in a first location (e.g., a drive, directory, etc.) within the storage system for longer than a predetermined length of time (e.g., such that they are considered non-temporary files) . To replace the first set of files with the second set of files, the source can ask the storage system to delete the first set of files from the first location, and then move the second set of files to the first location or to a second location ( e.g. a drive, a file directory, etc.) in which the second storage location can be different from the first storage location within the storage system. Alternatively, the source can request the storage system to write the second set of files to the second location and then delete the first set of files from the first location. To determine that a first file on the storage system is to be replaced with a second file, the system can 400 therefore determine that the first file is included in the first set of files deleted from the first location within the storage system and determine that the second file is included in the second set of files written to the second location within the storage system . The system 400 may further determine that the second set of files is related to the first set of files, and thus determine that the second set of files written to the second location replaced the first set of files from the first location has been deleted.

In some embodiments, the system can 400 Determining that the second set of files has a total number of files that is within a predetermined amount of a total number of files contained in the first set of files. For example, the system 400 Determine that a difference between the total number of files in the second set of files and the total number of files in the first set of files is within a predetermined number of files (e.g. that a ratio between the total number of files in the first set and the Total number of files in the second set is below a certain percentage threshold). The system 400 can therefore determine that the second set of files written to the second location contains approximately the same number of files as the first set of files deleted from the first location. Accordingly, the system can 400 Determine that the second set of files written to the second location is relevant to or related to the first set of files deleted from the first location, and thus determine that the second set of files is the first set replaced by files in the storage system.

Additionally or alternatively, the system 400 determine that the second set of files has an overall compressibility that is less than the overall compressibility of the first set of files. A total compressibility of a set of files can indicate a percentage and / or a total amount of storage space, which is saved when one or more files in the set of files are compressed (e.g. 5%). For example, the system 400 Determine that the total compressibility of the second set of files is less than the total compressibility of the first set of files. The system 400 can also determine that the total file size of one or more files in the second set of files is approximately the same as the total file size of one or more files in the first set of files when the files in the first set of files are encrypted, or compressed and then encrypted (e.g. a percentage difference between these two total file sizes may meet a predetermined percentage difference threshold). The system 400 can therefore determine that the total file size of the second set of files is equal to the total file size of the first set of files when the first set of files is encrypted. Accordingly, the system can 400 Determine that the second set of files written to the second location is relevant to or related to the first set of files deleted from the first location, and thus determine that the second set of files is the first set replaced by files in the storage system.

Additionally or alternatively, the system 400 determine that a read that reads the first set of files from the storage system is performed for the first time. For example, the system 400 Determine that, prior to deleting the first set of files from the first location, the storage system performed the read on a source to read the first set of files from the first location for the first time. The system 400 may determine that a write that writes the second set of files to the storage system is performed at a second point in time after the first point in time. For example, the system 400 Determine that following such a read, the storage system has performed the write to the same source or to a different source in order to write the second set of files to the second storage location at the second point in time. In some embodiments, the system can 400 Determine that the first time the first set of files was read from the first storage location and the second time the second set of files were written to the second storage location, with a time pattern of IO operations (e.g. read operations, Write operations, erase operations, etc.) associated with a security threat that previously targeted the data stored by the storage system. Accordingly, the system can 400 Determine that the second set of files written to the second location is relevant to or related to the first set of files deleted from the first location, and thus determine that the second set of files is the first Has replaced set of files in the storage system.

In some embodiments, in order to replace the first file in the storage system with the second file, the source may transmit multiple requests, including delete request (s), write request (s), and / or rename request (s), each requesting the storage system, one or more perform a plurality of delete operation (s), write operation (s) and / or rename operation (s) described above, thereby replacing the first file in the storage system with the second file. Alternatively, the source may transmit a request to the storage system to replace the first file with the second file, and the storage system may automatically perform one or more delete, write, and / or rename operations in response to the request ) to replace the first file on the storage system with the second file. In some embodiments, one or more source-initiated requests that result in the second file replacing the first file in the storage system may be referred to as a file replacement request, and such a file replacement request may be associated with the source.

During surgery 4006 identifies the system 400 possibly a second set of attributes associated with the second file that replaced the first file on the storage system. The second set of attributes may contain one or more of the file attributes described herein for the second file. The system 400 can determine the second set of attributes at any time before, during, and / or after the second file has been written to the storage system.

In some embodiments, the attributes of the second file can include a file name of the second file. As described above, the file name of the second file may be the same as the file name of the first file that has been replaced by the second file. If, in some embodiments, replacing the first file with the second file includes writing the second file with a temporary name that is different from the file name of the first file into the storage structure in which the first file is currently stored, the attributes may of the second file also include the temporary name of the second file. Other attributes of the second file are also possible and are considered.

During surgery 4008 can the system 400 based on determining that the first File in the storage system is replaced by the second file, and based on one or more attributes in at least one of the first attribute set associated with the first file or the second attribute set associated with the second file, determining that the Data stored on the storage system may be affected by a security threat. This can be done in any suitable manner.

For example, the system 400 in some embodiments, determining that an attribute in the second attribute set of the second file meets an attribute threshold, and thus determining that the data stored on the storage system may have been affected by a security threat. For example, the system 400 Determine that the file size of the second file meets a file size threshold (e.g., greater than 300MB) and / or the compressibility ratio of the second file meets a compressibility ratio threshold (e.g., less than 5%), and so on 400 determining based on the file size and / or the compressibility ratio that the second file can contain encrypted data. In this example the system 400 accordingly, determining that the first file in the storage system has been replaced with the second file containing encrypted data, and thus determining that the data stored by the storage system may have been affected by a security threat.

Additionally or alternatively, the system 400 determine that the filename of the second file meets a filename threshold. For example, the system 400 Determine that the total number of characters in the file name of the second file exceeds a threshold value (e.g. 60 characters), that non-letter characters (e.g. special characters, numeric characters, etc.) in the file name of the second file exceed a certain percentage (e.g. 40% ) of the filename of the second file, and so on. If the filename of the second file meets the filename threshold, the system can use 400 Determining that the second file may be abnormal and, accordingly, determining that the data stored on the storage system may have been affected by a security threat.

Additionally or alternatively, the system 400 determine that the file format of the second file meets a file format threshold. For example, the system can 400 Determine that the file format of the second file is unidentifiable and / or not contained in a predetermined set of file formats, etc. If the file format of the second file meets the file format threshold, the system may 400 Determining that the second file may be abnormal and, accordingly, determining that the data stored on the storage system may have been affected by a security threat.

Additionally or alternatively, the system 400 determine that the bitmap of the second file meets a bitmap threshold. For example, the system 400 Determine that the total number of repeating groups of bits that repeat in a sequence of bits representing the second file is less than a threshold (e.g., 15 groups, etc.). If the bitmap of the second file meets the bitmap threshold, the system can 400 Determining that the second file may be abnormal and, accordingly, determining that the data stored on the storage system may have been affected by a security threat.

Additionally or alternatively, the system 400 determine that the file format of the second file meets a file format threshold. For example, the system 400 Determine that the byte pattern and / or the bit pattern indicating the file format of the second file does not match the data type of the second file. If the file format of the second file meets the file format threshold, the system can 400 Determining that the second file may be abnormal and, accordingly, determining that the data stored on the storage system may have been affected by a security threat.

In some embodiments, the system can 400 to determine whether the data stored by the storage system may be affected by a security threat, a difference between a first attribute in the first attribute group assigned to the first file and a corresponding second attribute in the second attribute group assigned to the second file , Determine. For example, the system 400 determine a difference between the first file and the second file in terms of file size, compressibility ratio and / or bit pattern, and so on.

In some embodiments, the system can 400 Determining whether the difference between the first attribute of the first file and the second attribute of the second file meets a difference threshold. For example, the system 400 Determine whether a file size difference between the first file and the second file meets a file size difference threshold (for example, greater than 150 MB). In another example, the system 400 determine if there is a difference in compressibility ratio between the first and second files a Compressibility mismatch threshold met (e.g., greater than 30%). In another example, the system 400 determine whether a difference in the file format of the first file and the file format of the second file meets a file format difference threshold. For example, the system 400 Determine that the file formats of the first file and the second file do not match. Additionally or alternatively, the system 400 perform a format validation for the first file and the second file (e.g. on the basis of checksums, compression blocks and / or encrypted areas of a ZIP file, on the basis of values of JPEG EXIF data and / or payload values of an MP4 Video stream file, etc.) and determining that the file format of the first file is valid while the file format of the second file is invalid. In some embodiments, the system can 400 if the difference between the first attribute of the first file and the second attribute of the second file meets the difference threshold, determining that the first file in the storage system has been replaced by the second file that is significantly different from the first file, and thus determining, that the data stored on the storage system may have been affected by a security threat.

As described above, to replace the first file in the storage system with the second file in response to a file replacement request from a source, the storage system may write the second file with a temporary name to a storage structure in which the first file is currently stored. The temporary name of the second file can be different from the file name of the first file, as different files may need to have different file names in order to be stored together in the same storage structure. Once the second file is written to the storage structure in which the first file is currently stored, the storage system can delete or remove the first file from the storage structure and then rename the second file from its temporary name to the filename of the first file.

In some embodiments, the system can 400 Determine that the second file has been renamed from the temporary name of the second file to the name of the first file and determine whether the data stored on the storage system may have been affected by a security threat based on the temporary name of the second file. In particular, the system 400 Determine whether the temporary name of the second file meets a file name threshold. For example, the system 400 determine whether the total number of characters in the temporary name of the second file exceeds a threshold value (e.g. 65 characters), whether non-letter characters in the temporary name of the second file exceed a certain percentage (e.g. 45%) of the temporary name of the second file , etc. If the temporary name of the second file meets the file name threshold, the system can 400 Determine by temporary name that the second file is abnormal. Accordingly, the system can 400 Determine that the first file on the storage system has been replaced with the second file that is abnormal, thereby determining that the data stored on the storage system may have been affected by a security threat.

In some embodiments, the system can 400 Determine that the second file was renamed from the temporary name of the second file to the name of the first file, and determine whether the data stored on the storage system may have been affected by a security threat based on a difference between the temporary name of the second file and the Name of the first file is based. For example, the system 400 determine a difference between the temporary name of the second file and the name of the first file and determine whether the difference meets a difference threshold.

To illustrate: the system 400 can determine whether a difference between a total number of characters in the temporary name of the second file and a total number of characters in the file name of the first file meets a length difference threshold value (e.g., more than 30 characters). Additionally or alternatively, the system 400 determine whether a difference between a character pattern of the temporary name of the second file and a character pattern of the name of the first file meets a pattern difference threshold value (eg, more than 35%). In some embodiments, the system can 400 If the difference between the temporary name of the first file and the name of the first file meets the difference threshold, determine that the first file on the storage system has been replaced by the second file with a temporary name that is significantly different from the name of the first file before renaming it to the name of the first file, thereby determining that the data stored on the storage system may have been compromised by a security threat.

To determine whether the data stored on the storage system may have been compromised by a security threat, the system can 400 in some embodiments, determine whether a source of the second file is different from a source of the first file. As described above, the source of the first file wrote the first file to the storage system and / or requested the first file to be written to the storage system. The source of the second file replaced the first file in the storage system with the second file and / or requested the first file in the storage system to be replaced with the second file. If the source of the second file is different from the source of the first file, the System 400 Determine that the first file has been replaced by the second file with a source that is different from a source that previously wrote the first file to the storage system, thereby determining that the data stored on the storage system may have been exposed to a security threat are.

To determine whether the data stored on the storage system may have been compromised by a security threat, the system can 400 in some embodiments, determine whether the source of the second file is associated with an abnormal pattern. An abnormal pattern can indicate an unusual aspect of one or more operations (e.g., reads, writes, file exchanges, etc.) performed and / or requested by a source on the storage system during a specified period of time. In some embodiments, the system can 400 Determine if the source of the second file is related to an abnormal pattern in the storage system that is currently being used by the system 400 is monitored.

For example, the system 400 determine a number of file replacement requests transmitted from the source of the second file to the storage system during a predetermined period of time (e.g., during a period immediately preceding a particular request) in order to replace one or more files in the storage systems by a or to replace several other files. The system 400 may determine whether the number of file replacement requests initiated by the source of the second file during the predetermined period of time meets a predetermined threshold of file replacement requests (eg, greater than 30 requests). If so, the system can 400 Determining that the source of the second file is a source of more than the predetermined threshold of file replacement requests with respect to the storage system during the predetermined time period, and thus determining that the source of the second file is associated with an abnormal pattern of file replacement in the storage system .

Other examples of detecting abnormal patterns that may indicate a potential security threat to the data stored by the storage system include detecting that the total amount of read and write traffic generated by the source of the second file during a given period of time , exceeds a threshold, recognizing that the write traffic generated by the source of the second file is less compressible than the read traffic generated by the source of the second file, and / or recognizing other unusual aspects of various operations relating to the storage system that are carried out in other security threat detection methods described herein.

In some embodiments, the system can 400 if it determines that the source of the second file is associated with an abnormal pattern, determining that the second file has replaced the first file in the storage system with a source associated with an abnormal pattern in the storage system, and thus determining that the data stored on the storage system may have been affected by a security threat.

In some embodiments, the system can 400 to determine whether the data stored on the storage system may be affected by a security threat, determine whether a source of the second file was previously associated with one or more security threats against the storage system. In particular, the system 400 Maintain a source directory that contains one or more sources that have historically been associated with one or more previous security threats to the storage system. These prior security threats can be identified using one or more of the security threat detection methods described herein. In some embodiments, the system can 400 Determine whether the source of the second file is in the source directory. If the source of the second file is in the source directory, the system can 400 Determine that the first file in the storage system has been replaced with a source associated with one or more previous security threats to the storage system, thereby determining that the data stored on the storage system may have been affected by a security threat.

In response to determining that the data stored on the storage system may have been affected by a security threat using any implementation of the file-replacement-based method for detecting security threats described herein, the system may 400 perform any of the corrective actions described here.

41 Figure 12 shows an example remedial action based on modification access 4100 by the system 400 and / or any implementation thereof. The procedure 4100 can be used alone or in combination with any of the other remedial measures described herein.

During surgery 4102 can the system 400 Determine that data stored on a storage system may be compromised. The terms “under possible attack” and “under possible attack” are used interchangeably here to refer to a situation in which data stored by a storage system may be the target of an attack. Such an attack can be an encryption attack on the data stored by the storage system (e.g. a ransomware attack or an attack in which data is encrypted with or without extortion from a unit connected to the data to be encrypted), an attempt carried out by the storage system corrupt stored data (e.g. a malware attack), an attempt to steal the data, coupled with one or more operations configured to hide the data theft, any of the security threats described herein, and / or any other harmful interaction with the data stored by the storage system.

After performing the operation 4102 can the system 400 consider the data stored by the storage system to be under possible attack until the system 400 determines that the data stored by the storage system is no longer exposed to a possible attack. The system 400 can determine that the data stored by the storage system is no longer subject to possible attack by determining that the data stored by the storage system was not in fact the target of an attack (a false positive) or by determining that the data stored by the storage system was not in fact the target of an attack Data was actually the target of an attack and that the attack has ended.

During surgery 4104 can the system 400 Detect a change request to the storage system while the data stored on the storage system may be compromised. As used herein, a change request can include any request to perform an operation that results in a change in the data stored by the storage system. For example, a change request can include a request to write data to the storage system, rename a data element (e.g., a disk, an object, a file, a directory with one or more files, a database table, a key-value store, etc.), truncate a data element to zero the content of a data element, delete a data element, encrypt a data element, overwrite an existing data element, move data to another location within the storage system, etc.

During surgery 4106 can the system 400 Determine that the change request could be related to the possible attack. The system 400 can determine that the change request can be linked to the potential attack in any suitable manner.

For example, the system 400 determine that a change request may be related to a possible attack by determining that the probability that the change request is related to the possible attack is above a predetermined confidence level. The likelihood can be represented by a confidence score or some other suitable metric. In some examples, the trust score can be compared to different levels of trust to determine a possible degree of relationship between the change request and the possible attack. That way the system can 400 Determine what corrective action (s) to take in response to determining that the change request may be related to the possible attack, as different corrective actions may be associated with different levels of confidence.

To determine whether the change request could be related to the possible attack, the system can 400 in some embodiments, determine one or more attributes associated with the change request. The change request attributes can include a source (e.g., a host or other entity) of the change request, a time stamp of the change request, one or more attributes that represent one or more aspects of a data element associated with the change request (e.g. a file, an object, a block or a region of a volume, a database, etc.), and / or include any other suitable attribute that serves a particular implementation.

The source of the change request can identify a source from which the change request was received. For example, the source of the change request can be a source identifier (ID) and / or a source address (e.g. Internet protocol address (IP address), MAC (Media Access Control) - The address, etc.) of the source who initiated the change request.

The change request timestamp can indicate a date and time the change request was received from a source (e.g. October 3, 2020 at 14:00:00 UTC).

An attribute that describes one or more aspects of a data element associated with the change request may include a name of the data element, a size of the data element, a format of the data element, a compressibility ratio of the data element, a bit pattern of the data element, and so on. As used herein, the compressibility ratio of the data item may indicate a percentage and / or a total amount of storage space that is saved when the data item is compressed (e.g., 15%). The bit pattern of the data element can describe a pattern of a bit sequence which represents the data element.

The system 400 can identify an attribute associated with a data item in any suitable manner. For example, the system can 400 write a data item associated with a change request to temporary storage (e.g., cache, buffer, RAM, etc.) and analyze the data item in temporary storage to determine its attributes. Other attributes of the modification request are also possible and are contemplated.

In some embodiments, the system can 400 determine whether the change request is related to the potential attack based on one or more attributes of the change request. This can be done in any suitable manner.

In some embodiments, the system can 400 for example, determining that an attribute associated with the change request meets an attribute threshold, and thus determining that the change request could be related to the possible attack. For example, the system 400 determine that the size of a data item associated with a change request to write the data item to the storage system meets a size threshold (e.g., more than a predetermined value, such as 300MB), determine that the compressibility ratio of the data item meets a compressibility ratio threshold satisfied (e.g., less than a predetermined percentage, such as 5%), and / or determine that any other attribute associated with the write request meets an attribute threshold. If these one or more attribute thresholds are met, the system can 400 Determine that the data element can contain encrypted data due to its size and / or its compressibility ratio. Accordingly, the system can 400 Determining that the data item associated with the change request contains encrypted data, thus determining that the change request may be related to the possible attack.

Additionally or alternatively, the system 400 Determine that the name of the data item associated with the change request meets a naming threshold; B. a file or object name. For example, the system 400 determine that the total number of characters in the name of a data item associated with a change request to write the data item to the storage system is greater than a threshold of characters (e.g., more than a predetermined number of characters, e.g. 60 characters), determine that non-letter characters (e.g., special characters, numeric characters, etc.) in the name of the data element must have more than a percentage threshold (e.g. more than a predetermined percentage, such as 40%) of the name of the data element and / or determine that every other aspect of the name of the data item meets a naming threshold. If these one or more naming thresholds are met, the system can 400 Determine that the data item is abnormal, and accordingly determine that the change request may be related to the possible attack.

Additionally or alternatively, the system 400 Determine that the format of the data item associated with the change request meets a format threshold. For example, the system 400 Determine that the format of the data item is unidentifiable and / or not in a predetermined set of formats, or does not match an expected format based on context (e.g., a file or object named .JPG matches not the format of a JPEG file), etc. Based on this, the system can 400 Determining that the data item is abnormal and, accordingly, determining that the change request may be related to the possible attack.

Additionally or alternatively, the system 400 determine that the bit pattern of the data item associated with the change request meets a bit pattern threshold. For example, the system 400 Determine that the total number of repeating bit groups that are in one representing the data element Repeat bit sequence, is lower than a threshold value of groups (e.g. 15 groups) etc. On this basis the system can 400 Determining that the data item is abnormal and, accordingly, determining that the change request could be related to the possible attack.

In some embodiments, the system can 400 to determine whether the change request could be related to the possible attack, determining whether the source of the change request is associated with an abnormal pattern. An anomalous pattern can indicate an unusual aspect of one or more operations (e.g., reads, writes, data element replacement operations, etc.) to be performed by a source on the storage system during a specified period of time. Examples of detecting abnormal patterns include recognizing that the total amount of read and write traffic generated by a source exceeds a traffic amount threshold during a given period of time, recognizing that the write traffic generated by a source is less compressible than the read traffic generated by the source; and / or the detection of other unusual aspects of various operations with respect to the storage system described in other security threat detection methods described herein. When the system 400 In some embodiments, if the source of the change request is determined to be associated with an abnormal pattern, the system may 400 in some embodiments, determining that the change request may be related to the potential attack.

In some embodiments, the system can 400 to determine whether the change request could be related to the possible attack, determine whether the source of the change request was previously associated with one or more attacks on the storage system. In particular, the system 400 Maintain a source directory that contains one or more sources in the past associated with one or more previous attacks on the storage system. These previous attacks can be identified using any of the methods described here. In some embodiments, the system can 400 Determine whether the source of the change request is in the source directory. If the source of the change request is in the source list, the system can 400 Determine that the source of the change request was related to previous attacks on the storage system, thus determining that the change request could be related to the possible attack.

During surgery 4108 can the system 400 In response to determining that the change request may be related to the possible attack, take remedial action on the change request.

In some embodiments, the system can 400 block the change request and / or instruct the storage system to block the change request to take remedial action on the change request. As a result, an operation associated with the change request (such as a write operation) may not be able to be performed.

Additionally or alternatively, the system 400 to take remedial action on the change request, block change access (eg, write access) of the source to the storage system and / or instruct the storage system to block change access of the source. If change access to the source is blocked, the storage system can refuse or reject change requests received from the source. As a result, the source may not be able to perform any operation to change data of the storage system. In some embodiments, the storage system may block the source from changing access for a predetermined period of time (eg, for 24 hours). Alternatively, the storage system can block write access to the source pending the system 400 determines that the data stored on the storage system can no longer be attacked.

In some examples, the System 400 perform remedial action on a change request that is determined to be related to the possible attack, but the system 400 may still allow other change requests to be made to the storage system. For example, the system 400 allow change requests to be made that are determined to be unrelated to the potential attack, even if the data stored on the storage system is still subject to a potential attack.

In some embodiments, the system can 400 after initially determining that the data stored on the storage system is under attack, later determining that the data stored on the storage system is no longer open to attack. In some embodiments, the system can 400 do so by monitoring one or more aspects of the storage system operations that the system 400 to determine that the data stored on the storage system may be compromised. The system 400 may determine whether the one or more aspects of these operations meet one or more corresponding thresholds. For example, the system 400 Determine that the total amount of read and write traffic processed by the storage system during a given period of time meets a first threshold for traffic amount (e.g., greater than 70 MB / s), but a second threshold for traffic amount (e.g., greater than 100 MB / s) not met. In another example, the system 400 Determine that a difference between an average compressibility ratio of read traffic and write traffic processed by the storage system meets a first compressibility difference threshold (e.g., greater than 20%) but does not meet a second compressibility difference threshold (e.g., greater than 35%). It will be seen that the system 400 monitor other aspects of other operations as described in the security threat detection methods described herein.

In some embodiments, when the one or more aspects of the operations that the system 400 to determine that the storage system is exposed to a possible attack, do not meet the corresponding thresholds (e.g. the second threshold value for the amount of traffic and / or the second threshold value for the compressibility difference in the examples above), the system can 400 in some embodiments, determining that the potential attack is not attaining an actual attack level, and thus determining that the potential attack is a false positive attack. Hence, the system can 400 update a current state of the storage system to a normal state, thereby determining that the data stored by the storage system has not actually been attacked.

On the other hand, if the one or more aspects of the operations that the System 400 to determine that the data stored by the storage system may be attacked meets the appropriate thresholds (e.g. the second threshold for the amount of traffic, the second threshold for the compressibility difference in the examples above), the system may 400 on the other hand, determining that the possible attack is, with a high degree of reliability, an attack against the data stored by the storage system that is in progress. In this case the system can 400 monitor a number of requests from one or more sources requesting these operations with respect to the storage system. If the storage system does not receive a request requesting these operations for at least a predetermined period of time (e.g. 3 hours), the system may 400 Determine that the actual attack has ended or has ended, and thus determine that the data stored by the storage system is no longer exposed to a possible attack.

In some embodiments, the system can 400 in response to determining that the storage system is no longer under possible attack, take any appropriate action. For example, personnel connected to the storage system can be notified so that they can decide whether to release change access to the source of the change request. Alternatively, the system 400 automatically unlock change access to the source and / or instruct the storage system to unlock change access to the source. Additionally or alternatively, the system 400 perform an analysis of the data stored by the storage system and / or one or more attributes of the possible attack after an attack.

In some embodiments, the system can 400 to perform remedial action on the change request, instruct the storage system to redirect the change request to a separate storage structure that is separate from one or more active storage structures of the storage system. The active storage structures of the storage system can be storage structures (e.g. disks, drives, file directories, etc.) in the storage system that the sources can access, and thus the sources can perform various operations (e.g. read, write, delete, etc.) ) and / or request the operations that are to be carried out in these memory structures of the memory system. In some embodiments, the separate storage structure (eg, a sandbox environment) may be separate or isolated from the active storage structures of the storage system so that operations performed in the separate storage structure may not affect the active storage structures of the storage system. The separate storage structure can reside within the storage system or within another storage system separate from the storage system and can contain a snapshot or other replica of the data in the active storage structure.

In some embodiments, when the storage system redirects a change request representative of a request to write data to the storage system to the separate storage structure, the storage system may write the data associated with the change request to the separate storage structure rather than an active storage structure (e.g. E.g. a storage structure identified by the source of the change request as the destination for the data). Thus, if data stored by the storage system is potentially attacked, the change request can only change the separate storage structure that is isolated in the storage system and cannot affect the active storage structures of the storage system.

In some embodiments, in the event of a possible attack on data stored on the storage system, the storage system may not only redirect change requests related to the possible attack, but also other types of requests (e.g., read, retrieve and / or query operations) to the separate Redirect storage structure. In this way, a source of the potential attack can perceive that it is achieving its attack targets, although its modifications and the requirements associated with the modifications are safely routed into a sandbox environment.

When the system 400 After redirecting change requests from a source to a separate storage structure, it determines that the data stored by the storage system is no longer subject to possible attacks, the system can 400 perform one or more appropriate operations. For example, the system 400 notify the personnel connected to the storage system so that the personnel can review the data in the separate storage structure and / or differences between the data in the separate storage structure and the data in the active structure. Based on this check, the personnel can merge some or all of the data in the separate memory structure back into the active memory structure and / or otherwise process the data.

42 illustrates an exemplary process 4200 . While 42 Illustrating example operations according to one embodiment, other embodiments may use any of the FIGS 42 omit, add, rearrange and / or modify operations shown. One or more of the in 42 operations can be performed by the system 400 , all components contained therein and / or their implementation.

During surgery 4202 A monitoring system determines that a storage system is receiving a request to perform an operation that affects the capacity of a storage structure within the storage system. The operation 4202 can be done in any of the ways described here. Such operations include deleting a memory structure, deleting the memory structure, replacing data in the memory structure with less compressible or uncompressible data, a ransomware attack on the memory structure and / or any other operation that the memory structure and / or original data is within the memory structure is destroyed, modified, rendered unusable or otherwise impaired.

During surgery 4204 the monitoring system identifies an attribute of at least one of the request and the storage system. The operation 4204 can be done in any of the ways described here.

During the operation 4206 the monitoring system uses the attribute to determine that the request indicates a harmful action. The operation 4206 can be done in any of the ways described here.

During the operation 4208 in response to determining that the request is indicative of the malicious action, the monitoring system takes remedial action on the requested operation. The operation 4208 can be done in any of the ways described here.

In the preceding description, various exemplary embodiments were described with reference to the accompanying figures. It will be understood, however, that various modifications and changes can be made and additional embodiments implemented without departing from the scope of the invention as set out in the following claims. For example, certain features of one embodiment described here can be combined with features of another embodiment described here or replaced by features of another embodiment described here. The description and the figures are therefore to be viewed in an illustrative rather than a restrictive sense.

Claims (12)

A method comprising: determining, by a backup system, that a total amount of read traffic and write traffic processed by a storage system during a time period exceeds a threshold, the read traffic representing data read from the storage system during the time period , and the write traffic data represents that were written to the storage system during the period of time; Determining, by the backup system, that the write traffic is less compressible than the read traffic; and determining, by the backup system, based on the total amount of read traffic and write traffic exceeding the threshold and that the write traffic is less compressible than the read traffic, that the storage system may be exposed to a security threat. Procedure according to Claim 1 further comprising: the data backup system identifying an attribute associated with one or more of the data read from the storage system or the data written to the storage system; wherein the determining that the storage system may be affected by the security threat is further based on the attribute. Procedure according to Claim 2 wherein the attribute comprises one or more of the following: a host attribute associated with a host that interacts with the storage system, wherein the data read from the storage system or the data written to the storage system is associated with the host; an attribute of a source of the read traffic and the write traffic; an attribute of a memory structure in the memory system from which the data is read from or to which the data is written; or a storage format attribute associated with a storage format used by the storage system. A method according to any one of the preceding claims, further comprising: Identifying, by the data backup system, a format type of a data instance contained in the data written in the storage system; and Determining by the data backup system that a content of the data instance does not match what would be expected from the storage system for the identified format type; wherein the determining that the storage system may be affected by the security threat is further based on determining that the content of the data instance does not match what would be expected of the storage system for the identified format type. A method according to any one of the preceding claims, further comprising: Determining by the backup system that the data written to the storage system contains data that cannot be decrypted with any of one or more keys managed by an authorized key management system external to the storage system; wherein the determining that the storage system may be affected by the security threat is further based on determining that the data written to the storage system contains data that cannot be decrypted with the key managed by the key management system. A method according to any one of the preceding claims, further comprising: Determining by the backup system that the data written to the storage system does not contain a correct cryptographic signature associated with an external data encryption service connected to the storage system; wherein the determining that the storage system may be affected by the security threat is further based on determining that the data written to the storage system does not contain the correct cryptographic signature. A method according to any one of the preceding claims, further comprising: The backup system accessing the telephony home data transferred from the storage system; and Detecting, by the backup system, an anomaly associated with the storage system based on the home phone data; wherein the determining that the storage system may be affected by the security threat is further based on the detected anomaly. The method of any one of the preceding claims, further comprising the backup system performing remedial action on the storage system in response to determining that the storage system may be affected by the security threat. Procedure according to Claim 8 , wherein performing the remedial action comprises instructing the storage system to generate a recovery record for the data stored by the storage system. Procedure according to Claim 8 , further comprising: the backup system controlling the storage system to generate recovery records over time in accordance with a backup parameter set, the recovery records being usable to recover data managed by the storage system to a state that corresponds to a selectable point in time ; wherein performing the remedial action comprises controlling the storage system, in response to determining that the storage system may be affected by the security threat, to use one or more of the recovery records to restore the data managed by the storage system to a state that is a point in time that precedes a point in time when the data protection system determines that the storage system may be affected by the security threat. System comprising: a memory that stores instructions; a processor communicatively coupled to memory and configured to execute the instructions to: Determine that a total of read and write traffic processed by a storage system during a period of time exceeds a threshold, where read traffic represents data that was read from the storage system during the period and write traffic represents data that was read during the period in the storage system were written; Determining that the write traffic is less compressible than the read traffic; and Determine, based on the total amount of read traffic and write traffic that exceeds the threshold, and that write traffic is less compressible than read traffic, that the storage system may be exposed to a security threat. Non-transitory computer readable medium that stores instructions that, when executed, instruct a processor of a computing device to: Determine that a total of read traffic and write traffic processed by a storage system during a period of time exceeds a threshold, where read traffic represents data read from the storage system during the period and write traffic represents data that is read during the period in the storage system is written; Determining that the write traffic is less compressible than the read traffic; and Determine, based on the total amount of read and write traffic that exceeds the threshold, and that the write traffic is less compressible than the read traffic, that the storage system may be exposed to a security threat.

Images