Input/output (I/O) inspection methods and systems to detect and defend against cybersecurity threats
Input/output (I/O) inspection methods and systems are disclosed to detect and defend against cybersecurity threats. In one example, a method includes intercepting input/output (I/O) operations including I/O write operations for a storage system. Segments of data related to the intercepted write I/O operations are stored in a write I/O buffer. One or more levels of inspection are performed on the segments of data stored in the write I/O buffer to detect a security threat. A protection instruction is injected in any segments of data having a detected security threat. The defensive action can be performed for the injected protection instruction prior to storing segments of data in the write I/O buffer in the storage system. The protection instruction can be injected at the head of the segments of data having a detected security threat.
1. A computer-implemented method comprising:
intercepting one or more input/output (I/O) operations including write I/O operations for a storage system;
storing segments of data related to the intercepted write I/O operations in a write I/O buffer;
performing one or more levels of inspection on each segment of data stored in the write I/O buffer to detect a security threat, the number of inspection levels performed on each segment based, at least in part, on a size of the segment and wherein each level of inspection comprises a technique for detecting a security threat;
injecting a protection instruction in any segments of data having a detected security threat; and
performing a defensive action for the injected protection instruction prior to storing segments of data in the write I/O buffer in the storage system, wherein performing the defensive action comprises taking a point-in-time snap shot of the segments of data, breaking a replication relationship for the segments of data, creating a gap for the segments of data, throttling an I/O operation for the segments of data, duplicating an I/O operation for the segments of data, or halting I/O operations for the segments of data.
2. The computer-implemented method of claim 1 , further comprising:
storing the segments of data having a detected security threat from the write I/O buffer after the defensive action is performed.
3. The computer-implemented method of claim 1 , wherein injecting the protection instruction includes injecting the protection instruction at the head of the segments of data having a detected security threat.
4. A data processing system comprising:
a storage system having one or more persistent storage units to store data; and
an input/output (I/O) inspector coupled to the storage system including an I/O write buffer, the I/O inspector to intercept I/O operations including I/O write operations for the storage system, store segments of data related to the intercepted write I/O operations in a write I/O buffer, perform one or more levels of inspection on each segment of data stored in the write I/O buffer to detect a security threat, the number of inspection levels performed on each segment based, at least in part, on a size of the segment, wherein each level of inspection comprises a technique for detecting a security threat, and inject a protection instruction in any segments of data having a detected security threat, and perform a defensive action for the injected protection instruction prior to storing segments of data in the write I/O buffer in the storage system, wherein performing the defensive action comprises taking a point-in-time snap shot of the segments of data, breaking a replication relationship for the segments of data, creating a gap for the segments of data, throttling an I/O operation for the segments of data, duplicating an I/O operation for the segments of data, or halting I/O operations for the segments of data.
5. The data processing system of claim 4 , wherein the I/O inspector stores the segments of data having a detected security threat from the write I/O buffer in the storage system after the defensive action is performed.
6. The data processing system of claim 4 , wherein the I/O inspector injects the protection instruction at the head of the segments of data in the write I/O buffer having a detected security threat.
7. A non-transitory computer-readable medium, including instructions, which if executed by one or more computers, cause the computers to perform an operation comprising:
intercepting input/output (I/O) operations including I/O write operations for a storage system;
storing segments of data related to the intercepted write I/O operations in a write I/O buffer;
performing one or more levels of inspection on each segment of data stored in the write I/O buffer to detect a security threat, the number of inspection levels performed on each segment based, at least in part, on a size of the segment, and wherein each level of inspection comprises a technique for detecting a security threat;
injecting a protection instruction in any segments of data having a detected security threat; and
performing a defensive action for the injected protection instruction prior to storing segments of data in the write I/O buffer in the storage system, wherein performing the defensive action comprises taking a point-in-time snap shot of the segments of data, breaking a replication relationship for the segments of data, creating a gap for the segments of data, throttling an I/O operation for the segments of data, duplicating an I/O operation for the segments of data, or halting I/O operations for the segments of data.
8. The non-transitory computer-readable medium of claim 7 , including instructions, which if executed by the one or more computers, cause the computers to perform an operation comprising:
storing the segments of data having a detected security threat from the write I/O buffer after the defensive action is performed.
9. The non-transitory computer-readable medium of claim 7 , including instructions, which if executed by the one or more computers, cause the computers to perform an operation comprising:
injecting the protection instruction at the head of the segments of data having a detected security threat.
10. A computing system comprising:
an I/O write buffer storing segments of data for an I/O write operation to a storage system;
a processor coupled to the I/O write buffer and configured to intercept an I/O operation including an I/O write operation to the storage system, store segments of data related to the intercepted I/O write operation in the write I/O buffer, perform one or more levels of inspection on each segment of data stored in the write I/O buffer to detect a security threat, the number of inspection levels performed on each segment based, at least in part, on a size of the segment, wherein each level of inspection comprises a technique for detecting a security threat, inject a protection instruction in any segments of data having a detected security threat, and perform a defensive action for the injected protection instruction prior to storing segments of data in the write I/O buffer in the storage system, wherein performing the defensive action comprises taking a point-in-time snap shot of the segments of data, breaking a replication relationship for the segments of data, creating a gap for the segments of data, throttling an I/O operation for the segments of data, duplicating an I/O operation for the segments of data, or halting I/O operations for the segments of data.
11. The computing system of claim 10 , wherein the processor is configured to store the segments of data having a detected security threat from the write I/O buffer after the defensive action is performed.
12. The computing system of claim 10 , wherein the processor is to inject the protection instruction at the head of the segments of data having a detected security threat.