Grouped ransomware detection in data storage systems

A computer program product comprising:

• one or more computer-readable storage media;
• and
• program instructions stored on the one or more storage media to perform operations comprising:
• representing a set of volumes in a storage system as vectors of characteristics in a multi-dimensional vector space;
• using the vectors to identify subsets of the volumes having similar characteristics;
• clustering the subsets of volumes into respective common groups of volumes;
• causing the common groups of volumes to be identified in the multi-dimensional vector space;
• tracking, in the multi-dimensional vector space, the similar characteristics of the respective common groups of volumes;
• and
• performing ransomware detection on the common groups of volumes.

A computer system comprising:

• a processor set;
• one or more computer-readable storage media;
• and
• program instructions stored on the one or more storage media to cause the processor set to perform operations comprising:
• representing a set of volumes in a storage system as vectors of characteristics in a multi-dimensional vector space;
• using the vectors to identify subsets of the volumes having similar characteristics;
• clustering the subsets of volumes into respective common groups of volumes;
• causing the common groups of volumes to be identified in the multi-dimensional vector space;
• tracking, in the multi-dimensional vector space, the similar characteristics of the respective common groups of volumes;
• and
• performing ransomware detection on the common groups of volumes.