Storage system and malicious program detection method

A malicious program detection method used in a storage system including a processor that processes data input to and output from a storage device, the malicious program detection method comprising:

• a step of deduplicating, by the processor, duplicated data, storing the deduplicated data in the storage device, and calculating a duplication rate being a ratio of duplicated data in a predetermined unit of storage;
• a step of detecting, by the processor, a change between a duplication rate before an update of the data and a duplication rate after the update of the data in units of the predetermined unit of storage;
• and
• a step of detecting, by the processor, that the data is updated by a malicious program, when a decrease amount of the duplication rate exceeds a duplication rate threshold value relating to the detected change in duplication rate;
• a step of managing, by the processor utilizing a duplication state management table, in a duplication state of the data in units of the unit of storage;
• and
• a step of storing, by the process utilizing an operation log list, an operation log for each operation executed on the data,
• wherein the processor calculates the change in duplication rate of the data having “not duplicated” stored in the duplication state management table,
• wherein the processor detects update of the data by the malicious program in reference to the operation log,
• wherein information indicating the detection of the decrease amount of the duplication rate exceeding the duplication rate threshold value by the processor is included as the type of the operation executed on the data in the operation log, and
• wherein the processor detects the update of the data by the malicious program when the number of decrease amounts of the duplication rate each exceeding the duplication rate threshold value in the certain period of time and being stored in the operation log list exceeds a number-of-decreases threshold value relating to the number of decrease amounts of the duplication rate each exceeding the duplication rate threshold value.

A storage system including a processor that processes data input to and output from a storage device, the processor deduplicating duplicated data, storing the deduplicated data in the storage device, and calculating a duplication rate being a ratio of duplicated data in a predetermined unit of storage, the storage system comprising:

• a duplication detection section that operates on the processor and detects a change between a duplication rate before an update of the data and a duplication rate after the update of the data in units of the predetermined unit of storage;
• a malicious program detection section that operates on the processor, and detects that the data is updated by a malicious program, when a decrease amount of a duplication rate after an update of data compared to a duplication rate before the update of the data exceeds a duplication rate threshold value relating to the detected change in duplication rate;
• a duplication state management table that manages a duplication state of the data in units of the unit of storage;
• and
• an operation log list that stores an operation log for each operation executed on the data,
• wherein the duplication detection section calculates the change in duplication rate of the data having “not duplicated” stored in the duplication state management table,
• wherein the malicious program detection section detects update of the data by the malicious program in reference to the operation log,
• wherein information indicating the detection of the decrease amount of the duplication rate exceeding the duplication rate threshold value by the duplication detection section is included as the type of the operation executed on the data in the operation log, and
• wherein the malicious program detection section detects the update of the data by the malicious program when the number of decrease amounts of the duplication rate each exceeding the duplication rate threshold value in the certain period of time and being stored in the operation log list exceeds a number-of-decreases threshold value relating to the number of decrease amounts of the duplication rate each exceeding the duplication rate threshold value.