Ransomware detection and mitigation in a zoned storage device storage system
AssigneePure Storage, Inc.
InventorsChristopher Golden, Ronald Karr
Life of this patent
Estimating the term…
Abstract
Accesses of blocks of multiple zoned storage devices are monitored to detect one or more characteristics of the accesses of the blocks. A preventative action is performed in response to the detecting, wherein the preventative action includes sending an indication from the storage system upon determining that one or more of the accesses of the blocks are indicative of a malicious action based on the one or more characteristics.
Claims20
A storage system, comprising:
- a plurality of zoned storage devices;
- and
- a storage controller operatively coupled to the plurality of zoned storage devices, the storage controller comprising a processing device, the processing device to:
- monitor accesses of blocks of the plurality of zoned storage devices to detect one or more characteristics of the accesses of the blocks;
- and
- perform a preventative action in response to the detecting, wherein the preventative action comprises sending an indication from the storage system upon determining that one or more of the accesses of the blocks are indicative of a malicious action based on the one or more characteristics.
A method, comprising:
- monitoring, by a processing device of a storage controller, accesses of blocks of a plurality of zoned storage devices to detect one or more characteristics of the accesses of the blocks;
- and
- performing a preventative action in response to the detecting, wherein the preventative action comprises sending an indication from the storage system upon determining that one or more of the accesses of the blocks are indicative of a malicious action based on the one or more characteristics.
A non-transitory computer-readable storage medium including instructions which, when executed by a processing device of a storage controller, cause the processing device to:
- monitor, by the processing device, accesses of blocks of a plurality of zoned storage devices to detect one or more characteristics of the accesses of the blocks;
- and
- perform a preventative action in response to the detecting, wherein the preventative action comprises sending an indication from the storage system upon determining that one or more of the accesses of the blocks are indicative of a malicious action based on the one or more characteristics.
Dependencies are inferred from the claim text.