Anomaly detection based on storage protocol connections

A non-transitory machine readable medium storing instructions, which when executed by one or more processing resources of a storage system, cause the storage system to:

• perform real-time monitoring of system metrics of a storage system to obtain information indicative of a number of storage protocol connections between a host system running a workload and a storage device of the storage system during a predetermined or configurable time period by polling an application programming interface (API) exposed by the storage system;
• generate a connection count for each of one or more bucketed sliding temporal windows based on the number of storage protocol connections and prior observations;
• for each of the one or more bucketed sliding temporal windows, categorizing the connection count as anomalous or not in real time by determining, by a machine-learning (ML) model, based on the connection count, the bucketed sliding temporal window, and prior training of the ML model on rolling temporal windows of historical data in relation to usage of the storage system by a particular organization for a particular type of workload;
• and
• based at least in part on the connection count categorization, perform an automated remediation on the storage system to adjust a load on one or more nodes of a plurality of nodes interconnected as a cluster and representing the storage system, wherein the automated remediation includes moving the workload from a first node of the plurality of nodes to a second node of the plurality of nodes by reassigning responsibility for a volume used by the workload from the first node to the second node.

A storage system comprising:

• one or more processing resources;
• and
• instructions that when executed by the one or more processing resources cause the storage system to:
• perform real-time monitoring of system metrics of a storage system to obtain information indicative of a number of storage protocol connections between a host system running a workload and a storage device of the storage system during a predetermined or configurable time period by polling an application programming interface (API) exposed by the storage system;
• generate a connection count for each of one or more bucketed sliding temporal windows based on the number of storage protocol connections and prior observations;
• for each of the one or more bucketed sliding temporal windows, categorizing the connection count as anomalous or not in real time by determining, by a machine-learning (ML) model, based on the connection count, the bucketed sliding temporal window, and prior training of the ML model on rolling temporal windows of historical data in relation to usage of the storage system by a particular organization for a particular type of workload;
• and
• based at least in part on the connection count categorization, perform an automated remediation on the storage system to adjust a load on one or more nodes of a plurality of nodes interconnected as a cluster and representing the storage system, wherein the automated remediation includes moving the workload from a first node of the plurality of nodes to a second node of the plurality of nodes by reassigning responsibility for a volume used by the workload from the first node to the second node.