Malware detection techniques

A system comprising:

• one or more processors;
• and
• a memory comprising code stored thereon that, when executed, performs a method comprising:
• monitoring input/output (I/O) activity of a first storage object for changes to a first characteristic set of one or more I/O activity characteristics with respect to the first storage object;
• monitoring I/O activity of a second storage object for changes to the first characteristic set with respect to the second storage object, the first and second storage objects residing within a set of storage devices of storage equipment;
• detecting a first unexpected change to a first characteristic of the first characteristic set with respect to the first storage object, wherein said first unexpected change indicates first suspected malware activity by first malware impacting the first storage object;
• detecting no unexpected change to the first characteristic with respect to the second storage object;
• and
• responsive to said detecting the first unexpected change, performing first processing including:
• monitoring I/O activity of the first storage object for changes to an additional characteristic set of one or more additional I/O activity characteristics with respect to the first storage object, wherein the additional characteristic set includes a second characteristic;
• detecting a second unexpected change to the second characteristic with respect to the first storage object, wherein said second unexpected change indicates the first suspected malware activity by the first malware impacting the first storage object;
• creating a first indication of compromise (IOC) record for the first suspected malware activity by the first malware impacting the first storage object, wherein the first IOC record includes a first signature characterizing behavior of the first suspected malware activity by the first malware impacting the first storage object, wherein the first signature includes the first unexpected change to the first characteristic and also includes the second unexpected change to the second characteristic;
• monitoring I/O activity of the second storage object for changes to the additional characteristic set with respect to the second storage object;
• detecting a third unexpected change to the second characteristic with respect to the second storage object;
• determining, in accordance with one or more IOC matching criteria, that a first set of one or more unexpected changes in I/O activity of the second storage object matches the first IOC record, wherein the first set of one or more unexpected changes in I/O activity of the second storage object includes the third unexpected change;
• and
• responsive to determining that the first set of one or more unexpected changes in I/O activity of the second storage object matches the first IOC record, providing an indication of second suspected malware activity by the first malware impacting the second storage object to safeguard the set of storage devices against malware activity;
• wherein the first unexpected change indicates that the first characteristic for the first storage object changed from a first expected value to a first unexpected value, and wherein the second unexpected change indicates that the second characteristic for the first storage object changed from a second expected value to a second unexpected value, wherein the first expected value is included in first one or more expected values of a first I/O profile, wherein the second expected value is included in second one or more expected values of a first I/O profile, wherein the first unexpected value and the second unexpected value are determined in accordance with information regarding current I/O activity of the first storage object obtained, respectively, in said monitoring I/O activity of the first storage object for changes to the first characteristic set and said monitoring I/O activity of the first storage object for changes to the additional characteristic set.

A non-transitory computer readable medium comprising code stored thereon that, when executed, performs a method comprising:

• monitoring input/output (I/O) activity of a first storage object for changes to a first characteristic set of one or more I/O activity characteristics with respect to the first storage object;
• monitoring I/O activity of a second storage object for changes to the first characteristic set with respect to the second storage object, the first and second storage objects residing within a set of storage devices of storage equipment;
• detecting a first unexpected change to a first characteristic of the first characteristic set with respect to the first storage object, wherein said first unexpected change indicates first suspected malware activity by first malware impacting the first storage object;
• detecting no unexpected change to the first characteristic with respect to the second storage object;
• and
• responsive to said detecting the first unexpected change, performing first processing including:
• monitoring I/O activity of the first storage object for changes to an additional characteristic set of one or more additional I/O activity characteristics with respect to the first storage object, wherein the additional characteristic set includes a second characteristic;
• detecting a second unexpected change to the second characteristic with respect to the first storage object, wherein said second unexpected change indicates the first suspected malware activity by the first malware impacting the first storage object;
• creating a first indication of compromise (IOC) record for the first suspected malware activity by the first malware impacting the first storage object, wherein the first IOC record includes a first signature characterizing behavior of the first suspected malware activity by the first malware impacting the first storage object, wherein the first signature includes the first unexpected change to the first characteristic and also includes the second unexpected change to the second characteristic;
• monitoring I/O activity of the second storage object for changes to the additional characteristic set with respect to the second storage object;
• detecting a third unexpected change to the second characteristic with respect to the second storage object;
• determining, in accordance with one or more IOC matching criteria, that a first set of one or more unexpected changes in I/O activity of the second storage object matches the first IOC record, wherein the first set of one or more unexpected changes in I/O activity of the second storage object includes the third unexpected change;
• and
• responsive to determining that the first set of one or more unexpected changes in I/O activity of the second storage object matches the first IOC record, providing an indication of second suspected malware activity by the first malware impacting the second storage object to safeguard the set of storage devices against malware activity;
• wherein the first unexpected change indicates that the first characteristic for the first storage object changed from a first expected value to a first unexpected value, and wherein the second unexpected change indicates that the second characteristic for the first storage object changed from a second expected value to a second unexpected value, wherein the first expected value is included in first one or more expected values of a first I/O profile, wherein the second expected value is included in second one or more expected values of a first I/O profile, wherein the first unexpected value and the second unexpected value are determined in accordance with information regarding current I/O activity of the first storage object obtained, respectively, in said monitoring I/O activity of the first storage object for changes to the first characteristic set and said monitoring I/O activity of the first storage object for changes to the additional characteristic set.