Ransomware detection using I/O patterns

1. A method comprising:

receiving an I/O request from a host, the I/O request associated with one or more chunks within a logical unit (LU) of storage;

adding metadata about the I/O request to recent I/O activity data structures associated with the LU;

generating a ransomware probability by comparing the recent I/O activity data structures to the historical I/O activity data structures associated with the LU;

if the ransomware probability exceeds a first threshold value, taking one or more first actions to mitigate the effects of ransomware within the host; and

if the ransomware probability exceeds a second threshold value, taking one or more second actions to mitigate the effects of ransomware within the host, wherein the second threshold value is greater than the first threshold value;

wherein the one or more first actions include commencing copy-on-write (COW) for the LU and wherein the one or more second actions include generating a notification of suspected ransomware.

2. The method of claim 1 wherein generating a ransomware probability comprises using at least one of the following heuristics:

the number of times the chunks have been recently accessed according to the recent I/O activity data structures;

the probability of the chunks being accessed according to the historical I/O activity data structures;

whether the chunks have been recently read from and then overwritten according to the recent I/O activity data structures;

the probability of the chunks being read from and then overwritten according to the historical I/O activity data structures;

whether the chunks are within a range of chunks that have been recently accessed according to the recent I/O activity data structures; and

the probability of the chunks being accessed sequentially according to the historical I/O activity data structures.

3. The method of claim 1 further comprising:

if the ransomware probability is less than a third threshold value, wherein the third threshold value is less than or equal to the first threshold value, ending copy-on-write for the LU.

4. The method of claim 3 wherein ending copy-on-write for the LU includes erasing copy-on-write chunk versions from the storage.

5. The method of claim 1 wherein commencing COW for the LU comprises creating a snapshot of the LU.

6. The method of claim 1 wherein commencing COW for the LU comprises making a copy, in storage, of any data that will be overwritten by subsequent I/O requests.

7. A system comprising:

one or more processors;

a volatile memory; and

a non-volatile memory storing computer program code that when executed on the processor causes execution across the one or more processors of a process operable to perform the operations of:

receiving an I/O request from a host, the I/O request associated with one or more chunks within a logical unit (LU) of storage;

adding metadata about the I/O request to the recent I/O activity data structures associated with the LU;

generating a ransomware probability by comparing the recent I/O activity data structures to the historical I/O activity data structures associated with the LU;

if the ransomware probability exceeds a first threshold value, taking one or more first actions to mitigate the effects of ransomware within the host; and

if the ransomware probability exceeds a second threshold value, taking one or more second actions to mitigate the effects of ransomware within the host, wherein the second threshold value is greater than the first threshold value;

wherein the one or more first actions include commencing copy-on-write (COW) for the LU and wherein the one or more second actions include generating a notification of suspected ransomware.

8. The system of claim 7 wherein the computer program code causes execution of a process to generate a ransomware probability comprises using at least one of the following heuristics:

the number of times the chunks have been recently accessed according to the recent I/O activity data structures;

the probability of the chunks being accessed according to the historical I/O activity data structures;

whether the chunks have been recently read from and then overwritten according to the recent I/O activity data structures;

the probability of the chunks being read from and then overwritten according to the historical I/O activity data structures;

whether the chunks are within a range of chunks that have been recently accessed according to the recent I/O activity data structures; and

the probability of the chunks being accessed sequentially according to the historical I/O activity data structures.

9. The system of claim 7 wherein the computer program code causes execution of a process further operable to perform the operations of:

if the ransomware probability is less than a third threshold value, wherein the third threshold value is less than or equal to the first threshold value, ending copy-on-write for the LU.

10. The system of claim 9 wherein ending copy-on-write for the LU includes erasing copy-on-write chunk versions from the storage.

11. The system of claim 7 wherein commencing COW for the LU comprises creating a snapshot of the LU.

12. The system of claim 7 wherein commencing COW for the LU comprises making a copy, in storage, of any data that will be overwritten by subsequent I/O requests.

13. A computer program product tangibly embodied in a non-transitory computer-readable medium, the computer-readable medium storing program instructions that are executable to:

receive an I/O request from a host, the I/O request associated with one or more chunks within a logical unit (LU) of storage;

add metadata about the I/O request to the recent I/O activity data structures associated with the LU;

generate a ransomware probability by comparing the recent I/O activity data structures to the historical I/O activity data structures associated with the LU;

if the ransomware probability exceeds a first threshold value, take one or more first actions to mitigate the effects of ransomware within the host; and

if the ransomware probability exceeds a second threshold value, taking one or more second actions to mitigate the effects of ransomware within the host, wherein the second threshold value is greater than the first threshold value;

wherein the one or more first actions include commencing copy-on-write (COW) for the LU and wherein the one or more second actions include generating a notification of suspected ransomware.

14. The computer program product of claim 13 further storing program instructions that are generating a ransomware probability comprising using at least one of the following heuristics:

the number of times the chunks have been recently accessed according to the recent I/O activity data structures;

the probability of the chunks being accessed according to the historical I/O activity data structures;

whether the chunks have been recently read from and then overwritten according to the recent I/O activity data structures;

the probability of the chunks being read from and then overwritten according to the historical I/O activity data structures;

whether the chunks are within a range of chunks that have been recently accessed according to the recent I/O activity data structures; and

the probability of the chunks being accessed sequentially according to the historical I/O activity data structures.

15. The computer program product of claim 13 further storing program instructions that are executable to:

if the ransomware probability is less than a third threshold value, wherein the third threshold value is less than or equal to the first threshold value, ending copy-on-write for the LU.

16. The computer program product of claim 15 wherein ending copy-on-write for the LU includes erasing copy-on-write chunk versions from the storage.

17. The computer program product of claim 13 wherein commencing COW for the LU comprises creating a snapshot of the LU.

18. The computer program product of claim 13 wherein commencing COW for the LU comprises making a copy, in storage, of any data that will be overwritten by subsequent I/O requests.