# US 12,111,935 B2 · Intrusion detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,935 B2 - Document ID: US12111935B2 - Status: Granted - Kind: B2 - Application number: 18/052,085 - Filed: 2022-11-02 - Published: 2023-09-28 - Granted: 2024-10-08 - Earliest claimed: 2019-03-28 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Kenneth Byrne - Web page: https://patentgrep.com/patent/US12111935B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 3/0604: {Improving or facilitating administration, e.g. storage management} - G06F 3/0647: {Migration mechanisms} - G06F 3/0683: {Plurality of storage devices} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06N 20/00: Machine learning - G06F 3/0622: {in relation to access} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Techniques are provided for intrusion detection on a computer system. In an example, a computer host device is configured to access data storage of the computer system via a communications network. It can be determined that the computer host device is behaving anomalously because a first current access by the computer host device to the data storage deviates from a second expected access by the computer host device to the data storage by more than a predefined amount. Then, in response to determining that the computer host device is behaving anomalously, the computer system can mitigate against the computer host device behaving anomalously. ## Claims ### Claim 1 A system, comprising: a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising: enabling a first computer host device to access data storage via a communications network; determining a known attack signature based on a first signature of a second computer host device and a second signature of a third computer host device that exhibit anomalous access to the data storage; determining that the first computer host device is exhibiting an anomalous behavior based on a first current access by the first computer host device to the data storage matching the known attack signature, and based on performing machine learning on a second previous access by the first computer host device to the data storage to determine a third expected access by the first computer host device to the data storage; in response to determining that the first computer host device is exhibiting the anomalous behavior, mitigating the anomalous behavior of the first computer host device. ### Claim 2 (depends on 1) The system of claim 1, wherein the first current access by the first computer host device to the data storage comprises at least one from a group, the group comprising a first rate of sequential reads or writes, a second rate of random reads or writes, a first total number of sequential reads or writes, a second total number of random reads or writes, a first percentage of reads or writes that are sequential, and a second percentage of reads or writes that are random. ### Claim 3 (depends on 1) The system of claim 1, wherein the mitigating comprises: sending an alert to an administrator of the system. ### Claim 4 (depends on 1) The system of claim 1, wherein the mitigating comprises: throttling a bandwidth of data available to the first computer host device to access the data storage. ### Claim 5 (depends on 1) The system of claim 1, wherein the mitigating comprises: quarantining a write request from the first computer host device to the data storage. ### Claim 6 (depends on 4) The system of claim 4, wherein the operations further comprise: after quarantining the write request, and in response to determining that the first computer host device is permitted to make the write request, effectuating the write request on the data storage. ### Claim 7 (depends on 1) The system of claim 1, wherein the mitigating comprises: suspending a permission of the first computer host device to read data from the data storage. ### Claim 8 (depends on 1) The system of claim 1, wherein the operations further comprise: determining a fourth expected access by the first computer host device based on a fifth access by another host device to the data storage other than the first computer host device, wherein the other computer host device is one of the second computer host device, the third computer host device, or a fourth computer host device. ### Claim 9 A method, comprising: configuring, by a system comprising a processor, a first computer host device with access to data storage via a communications network; determining, by the system, a known attack signature based on a first signature of a second computer host device and a second signature of a third computer host device, wherein the second computer host device and the third computer host device exhibit anomalous access to the data storage; determining, by the system, that the first computer host device is operating anomalously based on a first current access by the first computer host device to the data storage matching the known attack signature, and based on performing machine learning on a second previous access by the first computer host device to the data storage to determine a third expected access by the first computer host device to the data storage; and mitigating, by the system, an effect resulting from the first computer host device operating anomalously. ### Claim 10 (depends on 9) The method of claim 9, wherein the mitigating comprises: terminating a communications link between the first computer host device and the system. ### Claim 11 (depends on 9) The method of claim 9, wherein the determining that the first computer host device is operating anomalously further comprises: determining that the first computer host device is operating anomalously based on the first current access by the first computer host device to the data storage deviating from a fourth expected access by the first computer host device to the data storage by more than a defined amount. ### Claim 12 (depends on 9) The method of claim 9, further comprising: implementing, by the system, a first learning period for a fourth computer host device upon initially communicating with the system during which anomalous operation by the fourth computer host device does not result in mitigation. ### Claim 13 (depends on 9) The method of claim 9, further comprising: determining, by the system, a fourth expected access by the first computer host device to the data storage based on past behavior of the first computer host device. ### Claim 14 (depends on 9) The method of claim 9, further comprising: in response to determining that the first computer host device continues to operate anomalously after a predefined time period, modifying, by the system, the mitigating of the effect resulting from the first computer host device operating anomalously. ### Claim 15 A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising: determining a known attack signature based on a first signature of a second computer host device and a second signature of a third computer host device that exhibit anomalous access to data storage; determining that a first computer host device is behaving anomalously based on a first current access by the first computer host device to the data storage matching the known attack signature, and based on performing machine learning on a second previous access by the first computer host device to the data storage to determine a third expected access by the first computer host device to the data storage; and initiating a mitigation action with respect to the first computer host device behaving anomalously. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the determining that the first computer host device is behaving anomalously comprises: determining that the first current access by the first computer host device to the data storage deviates from a fourth expected access by the first computer host device to the data storage by more than a defined amount. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the fourth expected access by the first computer host device to the data storage is based on a current time. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: after initiating the mitigating, determining that the first computer host device was not behaving anomalously; and updating a fourth expected access by the first computer host device based on the determining that the first computer host device was not behaving anomalously. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the operations further comprise: determining a fourth expected access by the first computer host device based on a fifth access by another host device to the data storage other than the first computer host device, wherein the other computer host device is one of the second computer host device, the third computer host device, or a fourth computer host device. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the mitigating is performed by an initiator group of the system.