System and method for maching learing-based detection of ransomware attacks on a storage system
AssigneeDell Products L.P.
InventorsShaul Dar, Ramakanth Kanagovi, Guhesh Swaminathan, Rajan Kumar
Life of this patent
Estimating the term…
Abstract
A method, computer program product, and computing system for processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system. A plurality of IO features are generated using the plurality of IO requests. The plurality of IO features are processed using a machine learning model. A ransomware attack on the storage system may be monitored for in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.
Claims20
A computer-implemented method, executed on a computing device, comprising:
- processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system;
- generating a plurality of IO features using the plurality of IO requests;
- processing the plurality of IO features using a machine learning model;
- and
- monitoring for a ransomware attack on the storage system in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.
A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
- processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system;
- generating a plurality of IO features using the plurality of IO requests;
- processing the plurality of IO features using a machine learning model;
- and
- monitoring for a ransomware attack on the storage system in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.
A computing system comprising:
- a memory;
- and
- a processor configured to process a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system, wherein the processor is further configured to generate a plurality of IO features using the plurality of IO requests, wherein the processor is further configured to process the plurality of IO features using a machine learning model, and wherein the processor is further configured to monitor for a ransomware attack on the storage system in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.
Dependencies are inferred from the claim text.