Storage system and unauthorized access detection method
AssigneeHitachi, Ltd.
InventorsShabin XU, Masakazu KOBAYASHI, Akihito MIYAZAWA
Life of this patent
Estimating the term…
Abstract
A storage system controller executes an abnormal behavior detection process including at least one of: a first abnormal behavior detection process that detects that the first parameter is smaller than a first threshold parameter as an abnormal behavior; a second abnormal behavior detection process that detects that the second parameter is greater than a second threshold parameter as the abnormal behavior; and a third abnormal behavior detection process that detects that the third parameter is smaller than a third threshold parameter as the abnormal behavior.
Claims14
A storage system including a controller and a cache that caches data, the storage system providing multiple volumes to one or more computers,
- wherein
- the controller is configured to execute an abnormal behavior detection process including at least one of:
- a first abnormal behavior detection process that obtains a first parameter based on a cache hit rate of the volume within a predetermined sampling interval and detects that the first parameter is smaller than a first threshold parameter as an abnormal behavior;
- a second abnormal behavior detection process that obtains a second parameter based on a server cache occupancy rate of the server associated with the volume within the predetermined sampling interval and detects that the second parameter is greater than a second threshold parameter as the abnormal behavior;
- and
- a third abnormal behavior detection process that obtains a third parameter based on a data access speed of the volume within the predetermined sampling interval and detects that the third parameter is smaller than a third threshold parameter as the abnormal behavior.
A method for detecting unauthorized access in a storage system that includes a controller and a cache that caches data and provides multiple volumes to one or more computers, the method being executed by the controlled,
- the method including:
- executing an abnormal behavior detection including at least one of:
- a first abnormal behavior detection that obtains a first parameter based on the cache hit rate of the volume within a predetermined sampling interval and detects that the first parameter is smaller than a first threshold parameter as an abnormal behavior;
- a second abnormal behavior detection that obtains a second parameter based on the server cache occupancy rate of the server associated with the volume within the predetermined sampling interval and detects that the second parameter is greater than a second threshold parameter as the abnormal behavior;
- and
- a third abnormal behavior detection that obtains a third parameter based on the data access speed of the volume within the predetermined sampling interval and detects that the third parameter is smaller than a third threshold parameter as the abnormal behavior.
Dependencies are inferred from the claim text.