Systems and methods for storage system attack detection and response

A method of determining an attack on a storage system, comprising:

• obtaining a plurality of count features corresponding to a respective plurality of time points based on data blocks of a storage object, wherein the count features comprise a plurality of count values for the data blocks, wherein the data blocks are deduplicated data blocks, and wherein the obtaining the plurality of count features corresponding to the respective plurality of time points based on the data blocks of the storage object further comprises:
• counting the number of the deduplicated data blocks in the storage object that conform to statistical features at the plurality of time points;
• and
• generating the plurality of count features corresponding to the respective plurality of time points, based, at least in part, on the number of the deduplicated data blocks;
• determining, for a first time point of the plurality of time points, a plurality of corresponding correlation coefficients between a first count feature for the first time point and other count features of the plurality of count features for other time points of the plurality of time points;
• determining a score for the first time point based, at least in part, on the plurality of corresponding correlation coefficients;
• determining that the score is less than a predetermined threshold;
• determining, based at least in part on the score being less than the predetermined threshold, that the storage object corresponding to the first time point is under an attack;
• and
• providing information responsive to the attack to a third party.

A memory coupled to a processor in an Information Handling System (IHS), wherein the memory comprises program instructions stored thereon that, upon execution by the processor, cause the IHS to:

• obtain a plurality of count features corresponding to a respective plurality of time points based on data blocks of a storage object, wherein the count features comprise a plurality of count values for the data blocks, wherein the data blocks are deduplicated data blocks, and wherein to obtain the plurality of count features corresponding to the respective plurality of time points based on the data blocks of the storage object, the program instructions, upon execution by the processor, further cause the IHS to:
• count the number of the deduplicated data blocks in the storage object that conform to statistical features at the plurality of time points;
• and
• generate the plurality of count features corresponding to the respective plurality of time points, based, at least in part, on the number of the deduplicated data blocks;
• determine, for a first time point of the plurality of time points, a plurality of corresponding correlation coefficients between a first count feature for the first time point and other count features of the plurality of count features for other time points of the plurality of time points;
• determine a score for the first time point based, at least in part, on the plurality of corresponding correlation coefficients;
• determine that the score is less than a predetermined threshold;
• determine, based at least in part on the score being less than the predetermined threshold, that the storage object corresponding to the first time point is under an attack;
• and
• provide information responsive to the attack to a third party.