Device-based anti-malware
Methods and equipment for determining whether a ransomware attack is suspected include a data storage device including a controller; non-volatile memory; a data path between the controller and the non-volatile memory; and an anti-ransomware module configured to monitor the data path. Methods and equipment also include monitoring a data path between a controller and a non-volatile memory on a data storage device; calculating an entropy of a data set to be written to the non-volatile memory; analyzing the calculated entropy; and determining whether a malware attack is suspected. Methods and equipment also include monitoring a data path between a controller and a non-volatile memory on a data storage device; identifying activity indicative of ransomware; once activity indicative of ransomware has been identified, calculating an entropy of a data set to be written to the non-volatile memory; analyzing the calculation; and determining whether a ransomware attack is suspected.
1. A data storage device comprising:
an interface;
a controller coupled to the interface, the controller being configured to communicate with a host system through the interface and to receive one or more read and write commands from the host system;
non-volatile memory coupled to the controller, the non-volatile memory being configured to communicate with the controller and to receive the one or more read and write commands directly from the controller;
a data path extending directly between the controller and the non-volatile memory, wherein the one or more read and write commands are communicated directly from the controller to the non-volatile memory using the data path; and
an anti-ransomware module configured to monitor the data path by monitoring the one or more read and write commands communicated from the controller to the non-volatile memory, the anti-ransomware module being disposed between the controller and the non-volatile memory and directly coupled to the data path, wherein the one or more read and write commands received by the controller from the host system are unmonitored by the anti-ransomware module.
2. The data storage device of claim 1 , wherein the anti-ransomware module is configured to calculate an entropy of data to be written to the non-volatile memory.
3. The data storage device of claim 2 , wherein the anti-ransomware module is configured to identify a suspected ransomware attack based on the calculated entropy.
4. The data storage device of claim 3 , wherein the anti-ransomware module is configured to take remedial action once the suspected ransomware attack is identified.
5. A method comprising:
receiving one or more read and write commands to a controller of a data storage device from a host system, wherein the controller is coupled to the host system through an interface;
receiving the one or more read and write commands directly from the controller to a non-volatile memory, wherein the one or more read and write commands are communicated directly from the controller to the non-volatile memory using a data path;
monitoring the data path between the controller and the non-volatile memory on the data storage device using an anti-ransomware module disposed between the controller and the non-volatile memory, the anti-ransomware module being directly coupled to the data path, wherein the controller is directly coupled to the non-volatile memory through the data path, and wherein monitoring the data path comprises monitoring the one or more read and write commands communicated from the controller to the non-volatile memory, the one or more read and write commands received by the controller from the host system being unmonitored by the anti-ransomware module;
calculating an entropy of a data set to be written to the non-volatile memory;
analyzing the calculated entropy; and
determining whether a malware attack is suspected.
6. The method of claim 5 , wherein the malware is ransomware.
7. The method of claim 5 , further comprising calculating at least one of an amount of data in the data set read from the non-volatile memory and an amount of data in the data set written to the non-volatile memory.
8. The method of claim 5 , further comprising taking remedial action when the ransomware attack is suspected.
9. The method of claim 8 , wherein:
the non-volatile memory comprises a plurality of logical block address ranges; and
the remedial action comprises at least one of:
blocking suspicious host writes to the non-volatile memory;
informing the host system of the suspected ransomware attack; and
backing-up logical block address ranges associated with the suspected ransomware attack.
10. The method of claim 8 , wherein:
the data set was to be written to a first logical block address range of the non-volatile memory;
the remedial action comprises:
allocating a second logical block address range of the non-volatile memory, different from the first logical block address range;
writing the data set to the second logical block address range; and
retaining the first logical block address range.
11. The method of claim 5 , wherein the analyzing comprises at least one of:
comparing the calculated entropy to a threshold value; and
comparing the calculated entropy to a historic norm.
12. The method of claim 11 , further comprising updating the threshold value based on at least one of:
a firmware update;
a log of read-write activity; and
a user input.
13. The method of claim 5 , wherein the analyzing further comprises at least one of:
comparing a first amount of data in the data set that is read from the non-volatile memory with a second amount of data in the data set that is subsequently written to the non-volatile memory; and
comparing a first entropy calculation of the data set that is read from the non-volatile memory and a second entropy calculation of the data set that is subsequently written to the non-volatile memory.
14. A method comprising:
receiving one or more read and write commands to a controller of a data storage device from a host system, wherein the controller is coupled to the host system through an interface;
receiving the one or more read and write commands directly from the controller to a non-volatile memory, wherein the one or more read and write commands are communicated directly from the controller to the non-volatile memory using a data path;
monitoring the data path between the controller and the non-volatile memory on the data storage device using an anti-ransomware module disposed between the controller and the non-volatile memory, the anti-ransomware module being directly coupled to the data path, wherein the controller is directly coupled to the non-volatile memory through the data path, and wherein monitoring the data path comprises monitoring the one or more read and write commands communicated from the controller to the non-volatile memory, the one or more read and write commands received by the controller from the host system being unmonitored by the anti-ransomware module;
identifying activity indicative of ransomware;
once activity indicative of ransomware has been identified, calculating an entropy of a data set to be written to the non-volatile memory;
analyzing the calculated entropy; and
determining whether a ransomware attack is suspected.
15. The method of claim 14 , wherein the analyzing comprises at least one of:
comparing the calculated entropy to a threshold value; and
comparing the calculated entropy to a historic norm.
16. The method of claim 14 , wherein monitoring the data path comprises:
identifying historic norms or patterns of read-write activity; and
identifying anomalous read-write activity relative to the historic norms or patterns.
17. The method of claim 14 , wherein monitoring the data path further comprises logging historic read-write activity.
18. The method of claim 14 , wherein activity indicative of ransomware comprises at least one of:
a read access of the data set from a first logical block address range and a subsequent write access to the first logical block address range;
a difference in a first amount of data in the data set that is read from a second logical block address range and a second amount of data in the data set that is subsequently written to a third logical block address range; and
a difference in a first calculation of the entropy of the data set that is read from a fourth logical block address range and a second calculation of the entropy that is subsequently written to a fifth logical block address range.
19. The method of claim 14 , further comprising tracking patterns of access of the data set.
20. The method of claim 19 , wherein activity indicative of ransomware comprises an anomalous frequency of access of the data set in comparison to the tracked patterns of access.
21. The method of claim 14 , further comprising taking remedial action comprising at least one of:
blocking a write access of the non-volatile memory;
informing a host system that a ransomware attack is suspected; and
backing-up at least one logical block address range associated with the data set.
22. A device comprising:
means for receiving one or more read and write commands to a controller of a data storage device from a host system, wherein the controller is coupled to the host system through an interface;
means for receiving the one or more read and write commands directly from the controller to a non-volatile memory, wherein the one or more read and write commands are communicated directly from the controller to the non-volatile memory using a data path;
means for monitoring the data path between the controller and the non-volatile memory using an anti-ransomware module disposed between the controller and the non-volatile memory, the anti-ransomware module being directly coupled to the data path, wherein the controller is directly coupled to the non-volatile memory through the data path, and wherein the means for monitoring the data path comprises means for monitoring the one or more read and write commands communicated from the controller to the non-volatile memory, the one or more read and write commands received by the controller from the host system being unmonitored by the anti-ransomware module;
means for calculating an entropy of a data set written to the non-volatile memory;
means for identifying a suspected ransomware attack based on at least one of:
whether the calculated entropy exceeds a threshold value; and
whether the calculated entropy exceeds a historic norm.
23. The device of claim 22 , wherein the means for monitoring the data path between the controller and the non-volatile memory determines the historic norm.
24. The device of claim 22 , further comprising a means for taking remedial action once the suspected ransomware attack is identified.
25. A computer program product for determining whether a ransomware attack is suspected, comprising a non-transitory, computer-readable storage medium encoded with instructions adapted to be executed by a processor to implement:
receiving one or more read and write commands to a controller of a data storage device from a host system, wherein the controller is coupled to the host system through an interface;
receiving the one or more read and write commands directly from the controller to a non-volatile memory, wherein the one or more read and write commands are communicated directly from the controller to the non-volatile memory using a data path;
monitoring activity of the data path between the controller and the non-volatile memory of the storage device using an anti-ransomware module disposed between the controller and the non-volatile memory, the anti-ransomware module being directly coupled to the data path, wherein the controller is directly coupled to the non-volatile memory through the data path, and wherein monitoring the activity of the data path comprises monitoring the one or more read and write commands communicated from the controller to the non-volatile memory, the one or more read and write commands received by the controller from the host system being unmonitored by the anti-ransomware module;
identifying in the activity indications of the ransomware attack;
once indications of the ransomware attack have been identified, calculating an entropy of a data set to be written to the non-volatile memory;
analyzing the calculated entropy; and
determining whether the ransomware attack is suspected to have occurred.
26. The computer program product of claim 25 , wherein the analyzing the calculated entropy includes at least one of:
determining whether the calculated entropy exceeds a threshold value; and
determining whether the calculated entropy exceeds a historic norm.
27. The computer program product of claim 25 , wherein the instructions further implement taking remedial action if it is determined that the ransomware attack is suspected to have occurred.