Block-based anomaly detection
AssigneeInternational Business Machines Corporation
InventorsAbdul Kareem Lakkundi, Siddalinga Aradhya, Santosh Kulkarni
Life of this patent
Estimating the term…
Abstract
A plurality of blocks of a first storage device are monitored. The first storage device is related to a computer system. A subset of blocks of the plurality a compared to a first storage signature of the first storage device. Based on the comparing of the subset of blocks to the first storage signature, a security anomaly is determined on the computer system. In response to the security anomaly, a security action is performed. The security action is related to the computer system.
Claims20
A method comprising:
- monitoring, by an anomaly response system, a plurality of blocks of a first storage device, the first storage device related to a computer system;
- comparing, by the anomaly response system, a subset of blocks of the plurality to a first storage signature of the first storage device;
- determining, by the anomaly response system and based on the comparing the subset of blocks, a security anomaly on the computer system;
- and
- performing, by the anomaly response system and in response to the security anomaly, a security action related to the computer system.
The method of 1, wherein the comparing the subset of blocks of the plurality to the first storage signature occurs at a second time, and wherein the method further comprises:
- monitoring, by the anomaly response system, one or more storage devices at a first time that precedes the second time, the one or more storage devices related to the computer system, the one or more storage devices including the first storage device;
- and
- generating, based on the plurality of blocks of the first storage device at the first time, the first storage signature of the first storage device.
A system comprising:
- a memory, the memory containing one or more instructions;
- and
- a processor, the processor communicatively coupled to the memory, the processor, in response to reading the one or more instructions, configured to:
- monitor a plurality of blocks of a first storage device, the first storage device related to a computer system;
- compare a subset of blocks of the plurality to a first storage signature of the first storage device;
- determine, based on the comparing the subset of blocks, a security anomaly on the computer system;
- and
- perform, in response to the security anomaly, a security action related to the computer system.
A computer program product, the computer program product comprising:
- one or more computer readable storage media;
- and
- program instructions collectively stored on the one or more computer readable storage media, the program instructions configured to:
- monitor a plurality of blocks of a first storage device, the first storage device related to a computer system;
- compare a subset of blocks of the plurality to a first storage signature of the first storage device;
- determine, based on the comparing the subset of blocks, a security anomaly on the computer system;
- and
- perform, in response to the security anomaly, a security action related to the computer system.
Dependencies are inferred from the claim text.