Method and apparatus for ransomware detection

A method for determining a ransomware attack, the method comprising:

• parsing read and write commands received from a host;
• detecting write after read operations based on the read and write commands and a read segments database;
• determining features of the write after read operations;
• determining a probability of a ransomware attack based on the features;
• and
• outputting a warning in response to determining a likely ransomware attack.

A system comprising:

• a host;
• and
• a nonvolatile memory device including a memory storing a read segments database and processing circuitry configured to
• parse read and write commands received from the host,
• detect write after read operations based on the read and write commands and the read segments database,
• determine features of the write after read operations,
• determine a probability of a ransomware attack based on the features, and
• output a warning in response to determining a likely ransomware attack.