WO2022215783A1

WO2022215783A1 - Method and controller for detecting ransomware in ssd

Info

Publication number: WO2022215783A1
Application number: PCT/KR2021/004614
Authority: WO
Inventors: 김영재; 박지윤; 박성순; 민동현; 김경표
Original assignee: (주)글루시스; 서강대학교산학협력단
Priority date: 2021-04-09
Filing date: 2021-04-13
Publication date: 2022-10-13
Also published as: KR20220140305A; KR102459879B1

Abstract

Disclosed are a ransomware detection method and SSD controller, which can reduce delay time of foreground input and output. The disclosed method for detecting ransomware in an SSD comprises the steps of: performing ransomware detection on a file for which a first overwrite is requested; checking whether there is an I/O request at one or more preset pre-occupied points while performing the ransomware detection; and processing the I/O request according to the checking result.

Description

Ransomware detection method and controller on SSD

The present invention relates to a method and a controller for detecting ransomware, and more particularly, to a method for detecting ransomware performed on an SSD and a controller of an SSD for detecting the ransomware.

Ransomware is a type of malware that encrypts a user's data and then threatens to force the user to pay for data recovery. Since the amount of damage caused by ransomware is continuously increasing, the need for a solution is increasing, and as one of the solutions, a backup technology for preventing an attack of the ransomware has been actively studied. Traditionally, backups have been performed at the host end. However, performing an explicit backup for the copy requires additional space in the storage as a result and has the disadvantage that the copy may also be destroyed if the operating system (OS) is damaged.

In contrast, the backup technology at the SSD (Solid State Drive) storage stage is space-efficient and safe even if the OS is damaged. Backup technology on SSDs does not require explicit space for backups, as it basically keeps data pages that are invalidated due to overwriting elsewhere on the SSD, rather than as a backup. Also, SSD firmware is separate from the OS. Therefore, even if the host OS is compromised by privileged ransomware, the copy can be kept safe.

To defend against ransomware attacks, the SSD performs ransomware detection, which detects whether or not ransomware is included in the data requested to be overwritten whenever a page overwrite request occurs. Because ransomware detection is performed every time an input/output (I/O) request occurs, which increases I/O latency, SSDs equipped with DMA (Direct Memory Access) hardware accelerators are being studied. However, since new hardware called DMA requires additional DMA technology and cost, it is necessary to develop a ransomware detection method that can reduce I/O latency while being performed at the firmware level.

An object of the present invention is to provide a ransomware detection method and an SSD controller capable of reducing a delay time of foreground input/output.

According to an embodiment of the present invention for achieving the above object, performing a first overwrite-requested file ransomware detection; checking whether an I/O request exists at at least one preset preemption point while the ransomware detection is being performed; and processing the I/O request according to the check result.

In addition, according to another embodiment of the present invention for achieving the above object, the method comprising: performing ransomware detection for a file requested to be overwritten; storing ransomware detection information indicating a state of ransomware detection performed from at least one preemption point preset to the preemption point, and processing an I/O request; and resuming the ransomware detection by using the ransomware detection information after the I/O request is processed.

In addition, according to another embodiment of the present invention for achieving the above object, the ransomware detection unit for detecting the ransomware on the overwrite requested file; and an I/O request processing unit configured to process the I/O request by checking whether an I/O request exists at at least one preemption point set in advance while the ransomware detection is being performed, wherein the ransomware detection unit comprises the An SSD controller for resuming the ransomware detection after an I/O request is performed is provided.

According to an embodiment of the present invention, an input/output delay time may be reduced by preferentially processing an input/output request at each preset preemption point during ransomware detection.

Also, according to an embodiment of the present invention, even if a new overwrite request occurs during the detection of ransomware, the delay in detecting ransomware according to the existing overwrite request can be prevented, and garbage collection is not performed. Problems that cannot be solved can be solved.

1 is a diagram for explaining a controller of an SSD according to an embodiment of the present invention.

2 is a diagram for explaining a ransomware detection method according to an embodiment of the present invention.

3 is a diagram for explaining a specific embodiment of ransomware detection.

4 is a diagram for explaining a ransomware detection method according to another embodiment of the present invention.

5 is a diagram illustrating an example of a ransomware detection process performed in an SSD according to an embodiment of the present invention.

6 is a diagram for explaining the effect of a ransomware detection method according to an embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention. In describing each figure, like reference numerals have been used for like elements.

As described above, the detection of ransomware, which is performed whenever a page overwrite request occurs, delays the processing time for the input/output request. This is because the input/output request including the overwrite request is processed after the ransomware detection of the file for which the overwrite request has occurred is completed. In order to solve this problem, the present invention proposes a ransomware detection method of an SSD that performs an input/output request while performing ransomware detection.

According to an embodiment of the present invention, an input/output request is preferentially processed at each preset preemption point during ransomware detection. Here, preemption means stopping ransomware detection and preferentially processing input/output requests, and preemption point means a point at which ransomware detection is stopped and input/output requests are performed.

Therefore, according to an embodiment of the present invention, since an input/output request can be processed before the end of the ransomware detection, the delay of the input/output processing according to the ransomware detection can be improved.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

Referring to FIG. 1 , the controller 110 of the SSD according to an embodiment of the present invention includes a ransomware detection unit 111 and an I/O request processing unit 113 .

The ransomware detection unit 111 detects the ransomware on the file requested to be overwritten. Ransomware detection may be performed through various detection algorithms, and as an embodiment, may be performed through calculation of similarity and entropy.

The I/O request processing unit 113 processes the I/O request by checking whether an I/O request exists at at least one preset preemption point while the ransomware is detected. When the I/O request is a read request, data stored in the NAND flash 120 is transmitted to the host, and when the I/O request is a write request, data transmitted from the host is stored in the NAND flash 120 . In the data transmission/reception process between the host and the NAND flash 120 , the DRAM 130 serves as a cache.

When there is an I/O request, the ransomware detection of the ransomware detection unit 111 is stopped, and the I/O request processing unit 113 processes the I/O request. Ransomware detection information indicating the state of the ransomware detection performed until the point of stopping the ransomware detection is stored in the SSD, and the ransomware detection unit 111 is Resumes ransomware detection.

2 is a diagram for explaining a ransomware detection method according to an embodiment of the present invention, and FIG. 3 is a diagram for explaining a specific embodiment of ransomware detection.

Referring to FIG. 2 , the SSD according to an embodiment of the present invention detects ransomware on a file for which the first overwrite is requested ( S210 ). The SSD may perform ransomware detection as shown in FIG. 3 as an embodiment in step S210.

In a first step (S310), the SSD is transmitted from the host, and first data for the file for which the first overwrite is requested is stored in the DRAM of the SSD. And in the second step ( S320 ), the SSD stores second data for the file stored in the page and for which the first overwrite is requested in the DRAM of the SSD. Here, the first data is data updated from the second data by overwriting, and the SSD detects whether ransomware is included in the first data.

The SSD determines the similarity between the first and second data in a third step (S330), and calculates the entropy of the first data in a fourth step (S340). Here, the similarity refers to a difference in byte-level between the second data, which is the previous data, and the first data, which is the new data, and the entropy is the Shannon entropy, which refers to the disorder of the new data. do. The SSD may determine that the first data includes ransomware when the similarity is equal to or less than the first threshold and the disorder is greater than or equal to the second threshold. A method for calculating the similarity and entropy for detecting ransomware may be performed through various known algorithms.

Returning to FIG. 2 , the SSD according to an embodiment of the present invention checks whether an I/O request exists at at least one preset preemption point during ransomware detection ( S220 ). The SSD can check whether an I/O request exists by checking the I/O request accumulated in the request queue.

The preemption point may be set between the first step (S310) and the second step (S320) as an embodiment, and may be a point included in the process of performing the third step (S330) and the fourth step (S340). have. If preemption is made while performing the first and second steps S310 and S320, data must be stored in DRAM from the beginning, so preemption is not performed during the process of the first and second steps S310 and S320. desirable. On the other hand, even if preemption is made while performing the third and fourth steps S330 and S340, the ransomware detection may be resumed from the point where the ransomware detection is stopped.

At this time, the number of preemption points included in the process of performing the third and fourth steps (S330 and S340) is determined by the latency of the third and fourth steps (S330 and S340) and the I/O request. It may be determined from the overhead according to the confirmation, and as an example [Equation 1], it may be calculated to be proportional to the latency and inversely proportional to the overhead. The time required to perform the third and fourth steps (S330 and S340) and the time taken to confirm the I/O request may be determined as latency and overhead, respectively, and may be determined experimentally.

The number of preemption points for the third and fourth steps S330 and S340 may be determined as an integer not exceeding the result value of [Equation 1], and if the result value of [Equation 1] is less than 1, preemption The number of points may be determined to be 1. For example, if the number of preemption points is determined to be 2, preemption may be performed twice while the third and fourth steps S330 and S340 are performed.

The positions of the preemption points for the third and fourth steps S330 and S340 may be determined in various ways, and may be positions on time or data. For example, the location of the preemption point may be determined as a point after a preset time from the time when the ransomware detection is started, or may be determined as a point corresponding to some size of the total size of data to be detected by the ransomware.

As an example, the location of the preemption point may be set so that the ransomware detection can be performed for a uniform time before and after the preemption, or may be determined according to the size of the first and second data. As the size of the first and second data increases, the interval between the preemption points may increase.

In addition, the SSD according to an embodiment of the present invention processes the I/O request according to the confirmation result (S230). If there is an I/O request, the SSD preferentially processes the I/O request while the ransomware detection is stopped. If there is no I/O request, the SSD detects the ransomware.

When the I/O request is processed while the ransomware detection is stopped, the SSD may resume the ransomware detection using the ransomware detection information, and the method of resuming the ransomware detection will be described in detail with reference to FIG. 4 .

Referring to FIG. 4 , the SSD according to an embodiment of the present invention detects ransomware on a file requested to be overwritten ( S410 ).

Then, from at least one preset preemption point, ransomware detection information indicating the state of ransomware detection performed up to the preemption point is stored, and an I/O request is processed ( S420 ). The ransomware detection information is used to resume detection of ransomware, which will be described later.

After the I/O request is processed, the SSD according to an embodiment of the present invention resumes detection of ransomware using ransomware detection information (S430).

The ransomware detection information includes, as an embodiment, offset information indicating the number of a page where the ransomware detection is stopped at the preemption point, and byte information on which the detection is performed from the page where the ransomware detection is stopped to the preemption point can do. In addition, information on a step in which the detection of ransomware is stopped by preemption among the third and fourth steps (S330 and S340) may be further included.

The SSD according to an embodiment of the present invention uses this ransomware detection information, in the page corresponding to the page number in the stage where the ransomware detection is stopped, for data following the byte data corresponding to the offset information, Ransomware detection can be resumed.

5 is a diagram illustrating an example of a ransomware detection process performed in an SSD according to an embodiment of the present invention. 5 shows an embodiment in which there are two preemption points. In FIG. 5, OW denotes overwrite, R denotes read, W denotes write, and D denotes ransomware detection.

5 , when a first overwrite (OW1) is requested by the SSD, the SSD performs ransomware detection (D1_1) on the file for which the first overwrite (OW1) is requested. Thereafter, the SSD performs the I/O request (R, R, W) identified at the first preemption point 511 .

At this time, when the I/O request is the second overwrite (OW2) request, the SSD resumes the ransomware detection (D1_2) regardless of the remaining number of preemption points to complete the ransomware detection. That is, in the embodiment of FIG. 5 , there is one remaining preemption point, but the SSD does not check the I/O request at the remaining preemption point, but restarts and completes the ransomware detection. And when the detection of the ransomware is completed, overwriting of the file for which the first overwrite (OW1) is requested is processed.

If a new ransomware detection is started for the file for which the second overwrite (OW2) is requested, the ransomware detection for the file for which the first overwrite (OW1) is requested is not completed, resulting in garbage collection (GC). There may also be problems that cannot be performed. Accordingly, when the I/O request existing at the preemption point is an overwrite request, the SSD according to an embodiment of the present invention ignores the remaining preemption point and resumes the stopped ransomware detection to complete the ransomware detection.

In the SSD according to an embodiment of the present invention, after the ransomware detection for the file for which the first overwrite (OW1) is requested is completed, the ransomware detection (D2_1) for the file for which the second overwrite (OW2) is requested is performed. start performing Then, the I/O request (R, W, R) confirmed at the first preemption point 521 is performed, and the ransomware detection (D2_2) is resumed. Thereafter, the checked I/O request (W, R, W) is performed at the second preemption point 522 and the ransomware detection (D2_3) is completed.

As described above, according to an embodiment of the present invention, even if a new overwrite request occurs during the detection of ransomware, the delay in detecting ransomware according to the existing overwrite request can be prevented, and the problem that garbage collection cannot be performed is reduced. can be solved

6( a ) shows an SSD (original SSD) that does not detect ransomware, an inline detection SSD (SSD) that detects ransomware without using preemption, and 50 according to an embodiment of the present invention in an Erebus ransomware environment. It is a view showing the foreground I/O response time of a preemptive detection SSD (SSD) using preemptive points in the form of a cumulative distribution function (CDF), and FIG. 6(b) is When a new overwrite request occurs, according to an embodiment of the present invention, it is a diagram showing a detection time when the detection of ransomware is resumed regardless of the remaining number of preemption points.

Referring to FIG. 6( a ), the average I/O response time for detecting ransomware without using preemption is 622.6 ms, and the average I/O response time for not detecting ransomware is 23.7 ms. As much as 26.3 times, it can be seen that the input/output delay is very serious if preemption is not used. On the other hand, according to an embodiment of the present invention, the average I/O response time is 26.4 ms, and it can be seen that there is no significant difference from the case where the ransomware is not detected.

Also, referring to FIG. 6(b) , it can be seen that 99% of the total detection operation is performed within about 16 ms, and there is no problem in that the detection operation is delayed according to a new overwrite request.

The technical contents described above may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiments, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. A hardware device may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, in the present invention, specific matters such as specific components, etc., and limited embodiments and drawings have been described, but these are only provided to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , various modifications and variations are possible from these descriptions by those of ordinary skill in the art to which the present invention pertains. Therefore, the spirit of the present invention should not be limited to the described embodiments, and not only the claims described below, but also all those with equivalent or equivalent modifications to the claims will be said to belong to the scope of the spirit of the present invention. .

Claims

performing ransomware detection on the file for which the first overwrite is requested;

checking whether an I/O request exists at at least one preset preemption point while the ransomware detection is being performed; and

processing the I/O request according to the confirmation result;

Ransomware detection method on SSD including
The method of claim 1,

The step of detecting the ransomware is

a first step of storing first data for the file transmitted from a host in a DRAM of the SSD;

a second step of storing second data for the file stored in the page in the DRAM;

a third step of determining a degree of similarity between the first and second data; and

A fourth step of calculating the degree of disorder of the first data

Ransomware detection method on SSD including
3. The method of claim 2,

The preemption point is

A point set between the first step and the second step

How to detect ransomware on SSD.
3. The method of claim 2,

The preemption point is

A point included in the process of performing the third and fourth steps

How to detect ransomware on SSD.
5. The method of claim 4,

The number of preemption points preset in the third step and the fourth step is

It is determined from the latency of the third step and the fourth step and the overhead according to the confirmation of the I/O request.

How to detect ransomware on SSD.
The method of claim 1,

The step of resuming the ransomware detection is

Resuming the ransomware detection by using the ransomware detection information indicating the state of the ransomware detection performed up to the preemption point after the I/O request is processed

Ransomware detection method of SSD further comprising.
7. The method of claim 6,

Information on the ransomware detection is

The number of the page where the ransomware detection was stopped at the preemption point, the step in which the ransomware detection was stopped during the third and fourth steps, and the bytes detected from the page where the ransomware detection was stopped to the preemption point offset information representing information

Ransomware detection method on SSD including
7. The method of claim 6,

The step of resuming the ransomware detection is

When the I/O request is a second overwrite request, restarting and completing the ransomware detection regardless of the remaining number of preemption points

How to detect ransomware on SSD.
9. The method of claim 8,

After the detection of ransomware on the file for which the first overwrite is requested is completed, performing ransomware detection on the file for which the second overwrite is requested;

Ransomware detection method of SSD further comprising.
performing ransomware detection on files requested to be overwritten;

storing ransomware detection information indicating a state of ransomware detection performed from at least one preemption point preset to the preemption point, and processing an I/O request; and

After the I/O request is processed, resuming the ransomware detection using the ransomware detection information

Ransomware detection method on SSD including
11. The method of claim 10,

The ransomware detection information is

Offset information indicating the number of the page where the ransomware detection is stopped at the preemption point and byte information on which the detection is performed from the page where the ransomware detection is stopped to the preemption point

Ransomware detection method on SSD including
a ransomware detection unit that detects ransomware on a file requested to be overwritten; and

an I/O request processing unit configured to process the I/O request by checking whether an I/O request exists at at least one preemption point set in advance while the ransomware detection is being performed;

The ransomware detection unit

Resuming the ransomware detection after the I/O request is performed

SSD controller.