# US 2018/0322280 A1 · Determining whether to destage write data in cache to storage based on whether the write data has malicious data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0322280 A1
- Document ID: US20180322280A1
- Status: Published application
- Kind: A1
- Application number: 15/585,997
- Filed: 2017-05-03
- Published: 2018-11-08
- Earliest claimed: 2017-05-03
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Matthew G. Borlick; Lokesh M. Gupta; Carol S. Mellgren; John G. Thompson
- Web page: https://patentgrep.com/patent/US20180322280A1

## CPC

- G06F 21/554: {involving event detection and direct action}
- G06F 12/0888: using selective caching, e.g. bypass
- G06F 12/0895: of parts of caches, e.g. directory or tag array
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 2212/1052: Security improvement
- G06F 2212/60: Details of cache memory
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Provided are a computer program product, system, and method for determining whether to destage write data in cache to storage based on whether the write data has malicious data. Write data for a storage is cached in a cache. A determination is made as to whether the write data in the cache comprises random data according to a randomness criteria. The write data in the cache to the storage in response to determining that the write data does not comprise random data according to the randomness criteria. The write data is processed as malicious data after determining that the write data comprises random data according to the randomness criteria.

## Claims

### Claim 1

A computer program product for processing data in cache directed to a storage, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:
caching write data for a storage in a cache;
determining whether the write data in the cache comprises random data according to a randomness criteria;
destaging the write data in the cache to the storage in response to determining that the write data does not comprise random data according to the randomness criteria; and
processing the write data as malicious data after determining that the write data comprises random data according to the randomness criteria.

### Claim 2 (depends on 1)

The computer program product of claim 1, wherein the processing the write data as malicious data comprises performing at least one of discarding the write data from the cache and copying the write data to a quarantine storage location for write data determined to be malevolent to be made available for further inspection.

### Claim 3 (depends on 1)

The computer program product of claim 1, wherein the randomness criteria comprises a compression ratio, wherein determining whether the write data in the cache comprises random data comprises:
compressing the write data to produce compressed write data; and
determining whether the compressed write data exceeds the compression ratio, wherein the write data is determined to comprise random data in response to determining that the compressed write data does not exceed the compression ratio and wherein the write data is determined to not comprise random data in response to determining that the compressed write data exceeds the compression ratio.

### Claim 4 (depends on 1)

The computer program product of claim 1, wherein the operations further comprise:
indicating when adding the write data to the cache that the write data has not been scanned; and
indicating that the write data was scanned in response to determining whether the write data in the cache comprises random data according to the randomness criteria.

### Claim 5 (depends on 4)

The computer program product of claim 4, wherein the operations further comprise:
accessing write data in the cache from a plurality of instances of write data in the cache to determine whether to destage the write data to the storage; and
determining whether the accessed write data was scanned, wherein the write data is destaged in response to determining that the write data was scanned and that the write data does not comprise random data.

### Claim 6 (depends on 5)

The computer program product of claim 5, wherein the operations further comprise:
indicating that the write data does not comprise random data when adding the write data to the cache; and
indicating that the write data comprises random data in response to determining that the write data comprises random data, wherein the write data is destaged in response to determining that the write data was scanned and does not comprise random data, wherein the write data is processed as malicious data in response to determining that the write data was scanned and comprises random data.

### Claim 7 (depends on 5)

The computer program product of claim 5, wherein the operations further comprise:
initiating a scan operation to access write data in the cache to determine whether the write data comprises random data, wherein the scan operation is performed independently of a destage operation to determine whether to destage write data from the cache.

### Claim 8 (depends on 1)

The computer program product of claim 1, wherein the operations further comprise:
determining whether the write data is from a suspicious process, wherein the determining whether the write data comprises random data is performed in response to determining that the write data is from a suspicious process; and
destaging the write data from the cache to the storage in response to determining that the write data is not from a suspicious process.

### Claim 9 (depends on 8)

The computer program product of claim 8, wherein the determining whether the write data is from a suspicious process comprises:
determining a characteristic of the write data in the cache; and
determining whether a characteristic of the write data satisfies a condition, wherein the write data is determined to be from a suspicious process in response to determining that the characteristic of the write data satisfies the condition.

### Claim 10 (depends on 9)

The computer program product of claim 9, wherein the characteristic of the write data comprises a process Input/Output (I/O) activity rate of a process that wrote the write data, wherein the determining whether the characteristic of the write data satisfies the condition comprises:
determining a historical I/O activity rate for the write data; and
determining whether the process I/O activity rate of a process that wrote the data exceeds the historical I/O activity rate by a threshold, wherein the condition is satisfied in response to determining that the process I/O activity rate exceeds the threshold.

### Claim 11 (depends on 10)

The computer program product of claim 10, wherein the characteristic of the write data comprises a timestamp of when a data entity including an address in the storage for the write data was last accessed, wherein the determining whether the characteristic of the write data satisfies the condition comprises determining whether a difference of a timestamp of the write data and the timestamp, when the data entity including the address in the storage for the write data was last accessed, exceeds a threshold, wherein the condition is satisfied in response to determining that the difference exceeds the threshold.

### Claim 12 (depends on 10)

The computer program product of claim 10, wherein the storage stores trap data, wherein the characteristic of the write data comprises whether the write data is directed to the trap data in the storage, and wherein the determining whether the characteristic of the write data satisfies the condition comprises determining whether the write data is directed to the trap data.

### Claim 13 (depends on 9)

The computer program product of claim 9, wherein the write data is determined to be from a suspicious process in response to determining at least one of:
that the I/O activity rate of a process that wrote the write data exceeds a historical I/O activity rate by a I/O activity rate threshold,
that a difference of a timestamp of the write data and the timestamp of when a data entity including the write data in the storage was last written exceeds a time threshold, and
that write data is directed to trap data.

### Claim 14

A system for processing data directed to a storage, comprising:
a processor;
a cache; and
a computer readable storage medium having computer readable program code that when executed by the processor performs operations, the operations comprising:
caching write data for a storage in a cache;
determining whether the write data in the cache comprises random data according to a randomness criteria;
destaging the write data in the cache to the storage in response to determining that the write data does not comprise random data according to the randomness criteria; and
processing the write data as malicious data after determining that the write data comprises random data according to the randomness criteria.

### Claim 15 (depends on 14)

The system of claim 14, wherein the randomness criteria comprises a compression ratio, wherein determining whether the write data in the cache comprises random data comprises:
compressing the write data to produce compressed write data; and
determining whether the compressed write data exceeds the compression ratio, wherein the write data is determined to comprise random data in response to determining that the compressed write data does not exceed the compression ratio and wherein the write data is determined to not comprise random data in response to determining that the compressed write data exceeds the compression ratio.

### Claim 16 (depends on 14)

The system of claim 14, wherein the operations further comprise:
indicating when adding the write data to the cache that the write data has not been scanned; and
indicating that the write data was scanned in response to determining whether the write data in the cache comprises random data according to the randomness criteria.

### Claim 17 (depends on 16)

The system of claim 16, wherein the operations further comprise:
accessing write data in the cache from a plurality of instances of write data in the cache to determine whether to destage the write data to the storage; and
determining whether the accessed write data was scanned, wherein the write data is destaged in response to determining that the write data was scanned and that the write data does not comprise random data.

### Claim 18 (depends on 14)

The system of claim 14, wherein the operations further comprise:
determining whether the write data is from a suspicious process, wherein the determining whether the write data comprises random data is performed in response to determining that the write data is from a suspicious process; and
destaging the write data from the cache to the storage in response to determining that the write data is not from a suspicious process.

### Claim 19 (depends on 18)

The system of claim 18, wherein the write data is determined to be from a suspicious process in response to determining at least one of:
that the I/O activity rate of a process that wrote the write data exceeds a historical I/O activity rate by a I/O activity rate threshold,
that a difference of a timestamp of the write data and the timestamp of when a data entity including the write data in the storage was last written exceeds a time threshold, and
that write data is directed to trap data.

### Claim 20

A method for processing data in cache directed to a storage, comprising:
caching write data for a storage in a cache;
determining whether the write data in the cache comprises random data according to a randomness criteria;
destaging the write data in the cache to the storage in response to determining that the write data does not comprise random data according to the randomness criteria; and
processing the write data as malicious data after determining that the write data comprises random data according to the randomness criteria.

### Claim 21 (depends on 20)

The method of claim 20, wherein the randomness criteria comprises a compression ratio, wherein determining whether the write data in the cache comprises random data comprises:
compressing the write data to produce compressed write data; and
determining whether the compressed write data exceeds the compression ratio, wherein the write data is determined to comprise random data in response to determining that the compressed write data does not exceed the compression ratio and wherein the write data is determined to not comprise random data in response to determining that the compressed write data exceeds the compression ratio.

### Claim 22 (depends on 20)

The method of claim 20, further comprising:
indicating when adding the write data to the cache that the write data has not been scanned; and
indicating that the write data was scanned in response to determining whether the write data in the cache comprises random data according to the randomness criteria.

### Claim 23 (depends on 22)

The method of claim 22, further comprising:
accessing write data in the cache from a plurality of instances of write data in the cache to determine whether to destage the write data to the storage; and
determining whether the accessed write data was scanned, wherein the write data for the accessed cache entry is destaged in response to determining that the write data was scanned and that the write data does not comprise random data.

### Claim 24 (depends on 20)

The method of claim 20, further comprising:
determining whether the write data is from a suspicious process, wherein the determining whether the write data comprises random data is performed in response to determining that the write data is from a suspicious process; and
destaging the write data from the cache to the storage in response to determining that the write data is not from a suspicious process.

### Claim 25 (depends on 24)

The method of claim 24, wherein the write data is determined to be from a suspicious process in response to determining at least one of:
that the I/O activity rate of a process that wrote the write data exceeds a historical I/O activity rate by a I/O activity rate threshold,
that a difference of a timestamp of the write data and the timestamp of when a data entity including the write data in the storage was last written exceeds a time threshold, and
that write data is directed to trap data.