Aggregating input/output operation features extracted from storage devices to form a machine learning vector to check for malware

A system for gathering I/O operation features from a plurality of storage devices, comprising:

• a processor;
• and
• a computer readable storage medium, implemented in a storage controller, having computer readable program code embodied therein that when executed performs operations, the operations comprising:
• generating feature extraction functions, for the storage devices, indicating I/O operation features for the storage devices to gather, wherein the I/O operation features comprise statistics and characteristics of read and write requests at the storage devices predictive of whether malware is contained in the storage devices;
• communicating the feature extraction functions to the storage devices, wherein the feature extraction functions transmitted to the storage devices cause each storage device of the storage devices receiving a feature extraction function to perform:
• gathering information on I/O operation features, identified in the feature extraction functions, from the storage device;
• aggregating the gathered information by volume and I/O operation feature into aggregated information by volume and I/O operation feature for the I/O operation features gathered for volumes at the storage device;
• and
• transmitting the aggregated information by volume and I/O operation feature for the volumes and the I/O operation features to the storage controller;
• for the volumes, aggregating the aggregated information for a given volume from the storage devices into system-wide aggregated information having the I/O operation features for the given volume;
• and
• inputting the system-wide aggregated information for the given volume into a machine learning model to output indication whether the given volume contains malware.

A computer implemented method for gathering I/O operation features from a plurality of storage devices, comprising:

• generating feature extraction functions, for the storage devices, indicating I/O operation features for the storage devices to gather, wherein the I/O operation features comprise statistics and characteristics of read and write requests at the storage devices predictive of whether malware is contained in the storage devices;
• communicating the feature extraction functions to the storage devices, wherein the feature extraction functions transmitted to the storage devices cause each storage device of the storage devices receiving a feature extraction function to perform:
• gathering information on I/O operation features, identified in the feature extraction functions, from the storage device;
• aggregating the gathered information by volume and I/O operation feature into aggregated information by volume and I/O operation feature for the I/O operation features gathered for volumes at the storage device;
• and
• transmitting the aggregated information by volume and I/O operation feature for the volumes and the I/O operation features to a storage controller;
• for the volumes, aggregating the aggregated information for a given volume from the storage devices into system-wide aggregated information having the I/O operation features for the given volume;
• and
• inputting the system-wide aggregated information for the given volume into a machine learning model to output indication whether the given volume contains malware.