Determining sampling frequency of input/output (i/o) requests for ransomware detection in computational storage systems

A system comprising:

• a computing node comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor of the computing node to cause the processor to perform a method comprising:
• receiving, from a computational storage device (CSD), a plurality of features and a sampling rate, the plurality of features extracted from a plurality of I/O requests sampled by the CSD using the sampling rate;
• providing the sampling rate and the plurality of sampled I/O operations to a plurality of machine learning (ML) models, each ML model trained on a training dataset comprising a plurality of training sampled operations and a training sampling rate;
• receiving, from each of the plurality of ML models, a compatibility metric associated with the training sampling rate of that ML model;
• selecting a highest compatibility metric from the plurality of compatibility metrics received from the plurality of ML models;
• and
• providing, to the CSD, the sampling rate associated with the compatibility metric.

A computer program product for sampling data at a storage system, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by the storage system to cause the storage system to perform a method comprising:

• receiving, from a computational storage device (CSD), a plurality of features and a sampling rate, the plurality of features extracted from a plurality of I/O requests sampled by the CSD using the sampling rate;
• providing the sampling rate and the plurality of sampled I/O operations to a plurality of machine learning (ML) models, each ML model trained on a training dataset comprising a plurality of training sampled operations and a training sampling rate;
• receiving, from each of the plurality of ML models, a compatibility metric associated with the training sampling rate of that ML model;
• selecting a highest compatibility metric from the plurality of compatibility metrics received from the plurality of ML models;
• and
• providing, to the CSD, the sampling rate associated with the compatibility metric.