Method and system for storage-based intrusion detection and recovery
AssigneeInternational Business Machines Corporation
InventorsBulent Abali, Mohammad Banikazemi, Dan Edward Poff
Life of this patent
Estimating the term…
Abstract
A method for detecting a modification to stored data includes continuously creating a point-in-time copy of a storage level logical unit, the point-in-time copy comprising a volume copy of the storage level logical unit and a signature of the storage level logical unit, comparing at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, and monitoring, based on the comparing, changes on certain logical blocks of the stored data, using the signature of the storage level logical unit.
Claims20
A method for detecting a modification to stored data, said method comprising:
- continuously creating a point-in-time copy of a storage level logical unit, said point-in-time copy comprising a volume copy of said storage level logical unit and a signature of said storage level logical unit;
- comparing at least a portion of said point-in-time copy with a previous copy of the storage level logical unit;
- and
- monitoring, based on said comparing, changes on certain logical blocks of the stored data, using said signature of said storage level logical unit.
A non-transitory computer-readable storage medium encoded with a computer program to perform a method for detecting a modification to stored data, said method comprising:
- continuously creating a point-in-time copy of a storage level logical unit, said point-in-time copy comprising a volume copy of said storage level logical unit and a signature of said storage level logical unit;
- comparing at least a portion of said point-in-time copy with a previous copy of the storage level logical unit;
- and
- monitoring, based on said comparing, changes on certain logical blocks of the stored data, using said signature of said storage level logical unit.
Dependencies are inferred from the claim text.