# US 11,451,574 B2 · Detecting security threats in storage systems using artificial intelligence techniques > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,574 B2 - Document ID: US11451574B2 - Status: Granted - Kind: B2 - Application number: 16/914,599 - Filed: 2020-06-29 - Published: 2021-12-30 - Granted: 2022-09-20 - Earliest claimed: 2020-06-29 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Deepak Gowda; Bina K. Thakkar; Wenjin Liu - Web page: https://patentgrep.com/patent/US11451574B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06N 3/02: Neural networks - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/08: Learning methods - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Methods, apparatus, and processor-readable storage media for detecting security threats in storage systems using AI techniques are provided herein. An example computer-implemented method includes obtaining historical performance data and historical capacity data pertaining to one or more storage objects within a storage system; determining supervised datasets pertaining to security threat-related data and non-security threat-related data by processing at least a portion of the obtained data using a first set of AI techniques; configuring a second set of AI techniques based at least in part on the determined supervised datasets; detecting one or more security threats in connection with at least one storage object within the storage system by processing input data from the at least one storage object using the second set of AI techniques; and performing at least one automated action based at least in part on the one or more detected security threats. ## Claims ### Claim 1 A computer-implemented method comprising: obtaining historical performance data and historical capacity data pertaining to one or more storage objects within at least one storage system; determining supervised datasets pertaining to security threat-related data and non-security threat-related data by processing at least a portion of the obtained historical performance data and historical capacity data using a first set of one or more artificial intelligence techniques, wherein the first set of one or more artificial intelligence techniques comprises at least one long short-term memory neural network comprising multiple hidden units, and wherein determining the supervised datasets comprises using the at least one long short-term memory neural network to determine multiple patterns, associated with multiple distinct intervals of time, in the at least a portion of the obtained historical performance data and historical capacity data; configuring a second set of one or more artificial intelligence techniques based at least in part on the determined supervised datasets; detecting one or more security threats in connection with at least one storage object within the at least one storage system by processing input data from the at least one storage object using the second set of one or more artificial intelligence techniques; and performing at least one automated action based at least in part on the one or more detected security threats; wherein the method is performed by at least one processing device comprising a processor coupled to a memory. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein determining the multiple patterns associated with multiple distinct intervals of time comprises determining, for each of one or more metrics within the at least a portion of the obtained historical performance data and historical capacity data, an upper bound value for non-security threat-related data and a lower bound value for non-security threat-related data. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the one or more storage objects comprises one or more of at least one file system within the at least one storage system and at least one logical unit number within the at least one storage system. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the second set of one or more artificial intelligence techniques comprises a machine learning model which uses at least one deep learning technique comprising a recurrent neural network, and wherein configuring the second set of one or more artificial intelligence techniques comprises learning one or more threat-related patterns in the determined supervised datasets based at least in part on a number of layers in the recurrent neural network. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein performing the at least one automated action comprises generating and outputting an alert regarding the one or more detected security threats to at least one entity associated with the at least one storage system. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein performing the at least one automated action comprises training the second set of one or more artificial intelligence techniques using at least a portion of the one or more detected security threats. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: implementing a closed-loop feedback mechanism responsive to one or more conditions related to at least a portion of the one or more detected security threats. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the historical performance data comprise data related to one or more of latency, input/output operations per second, bandwidth, central processing unit utilization, read percentage, and queue length. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the input data comprise real-time performance data and real-time capacity data from the at least one storage object. ### Claim 10 A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device: to obtain historical performance data and historical capacity data pertaining to one or more storage objects within at least one storage system; to determine supervised datasets pertaining to security threat-related data and non-security threat-related data by processing at least a portion of the obtained historical performance data and historical capacity data using a first set of one or more artificial intelligence techniques, wherein the first set of one or more artificial intelligence techniques comprises at least one long short-term memory neural network comprising multiple hidden units, and wherein determining the supervised datasets comprises using the at least one long short-term memory neural network to determine multiple patterns, associated with multiple distinct intervals of time, in the at least a portion of the obtained historical performance data and historical capacity data; to configure a second set of one or more artificial intelligence techniques based at least in part on the determined supervised datasets; to detect one or more security threats in connection with at least one storage object within the at least one storage system by processing input data from the at least one storage object using the second set of one or more artificial intelligence techniques; and to perform at least one automated action based at least in part on the one or more detected security threats. ### Claim 11 (depends on 10) The non-transitory processor-readable storage medium of claim 10, wherein determining the multiple patterns associated with multiple distinct intervals of time comprise determining, for each of one or more metrics within the at least a portion of the obtained historical performance data and historical capacity data, an upper bound value for non-security threat-related data and a lower bound value for non-security threat-related data. ### Claim 12 (depends on 10) The non-transitory processor-readable storage medium of claim 10, wherein the one or more storage objects comprises one or more of at least one file system within the at least one storage system and at least one logical unit number within the at least one storage system. ### Claim 13 (depends on 10) The non-transitory processor-readable storage medium of claim 10, wherein the second set of one or more artificial intelligence techniques comprises a machine learning model which uses at least one deep learning technique comprising a recurrent neural network, and wherein configuring the second set of one or more artificial intelligence techniques comprises learning one or more threat-related patterns in the determined supervised datasets based at least in part on a number of layers in the recurrent neural network. ### Claim 14 An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured: to obtain historical performance data and historical capacity data pertaining to one or more storage objects within at least one storage system; to determine supervised datasets pertaining to security threat-related data and non-security threat-related data by processing at least a portion of the obtained historical performance data and historical capacity data using a first set of one or more artificial intelligence techniques, wherein the first set of one or more artificial intelligence techniques comprises at least one long short-term memory neural network comprising multiple hidden units, and wherein determining the supervised datasets comprises using the at least one long short-term memory neural network to determine multiple patterns, associated with multiple distinct intervals of time, in the at least a portion of the obtained historical performance data and historical capacity data; to configure a second set of one or more artificial intelligence techniques based at least in part on the determined supervised datasets; to detect one or more security threats in connection with at least one storage object within the at least one storage system by processing input data from the at least one storage object using the second set of one or more artificial intelligence techniques; and to perform at least one automated action based at least in part on the one or more detected security threats. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein determining the multiple patterns associated with multiple distinct intervals of time comprise determining, for each of one or more metrics within the at least a portion of the obtained historical performance data and historical capacity data, an upper bound value for non-security threat-related data and a lower bound value for non-security threat-related data. ### Claim 16 (depends on 14) The apparatus of claim 14, wherein the one or more storage objects comprises one or more of at least one file system within the at least one storage system and at least one logical unit number within the at least one storage system. ### Claim 17 (depends on 14) The apparatus of claim 14, wherein the second set of one or more artificial intelligence techniques comprises a machine learning model which uses at least one deep learning technique comprising a recurrent neural network, and wherein configuring the second set of one or more artificial intelligence techniques comprises learning one or more threat-related patterns in the determined supervised datasets based at least in part on a number of layers in the recurrent neural network. ### Claim 18 (depends on 14) The apparatus of claim 14, wherein performing the at least one automated action comprises generating and outputting an alert regarding the one or more detected security threats to at least one entity associated with the at least one storage system. ### Claim 19 (depends on 14) The apparatus of claim 14, wherein the historical performance data comprise data related to one or more of latency, input/output operations per second, bandwidth, central processing unit utilization, read percentage, and queue length. ### Claim 20 (depends on 14) The apparatus of claim 14, wherein the input data comprise real-time performance data and real-time capacity data from the at least one storage object.