Apparatus and method of detecting potential security violations of direct access non-volatile memory device
An apparatus and method of providing direct access to a non-volatile memory of a non-volatile memory device and detecting potential security violations are provided. A method for providing access to a non-volatile memory of a non-volatile memory device may include tracking a parameter related to a plurality of direct access transactions of the non-volatile memory. A threshold behavior pattern of the host activity may be determined based upon the tracked parameters. The direct access transactions may be reviewed to determine whether the threshold behavior pattern is exceeded.
1. A method for providing access to a non-volatile memory of a non-volatile memory device, method comprising:
monitoring one or more parameters related to a direct access transaction of the non-volatile memory, wherein the one or more parameters are at least one of a timing of a direct access command, a size of a data accessed in the direct access transaction, and a type of access command, wherein either the non-volatile memory is monitoring all the direct access transactions or the non-volatile memory is monitoring a portion of the direct access transaction;
determining whether the one or more parameters of the direct access transaction exceeded a threshold behavior pattern for any of the one or more parameters, wherein the threshold behavior pattern is either set by:
a user mode page as the non-volatile memory device is in operation or created offline from a lookup table; or
a dictionary of normal behavior and uploaded to the non-volatile memory device; and
performing a countermeasure responsive to the direct access transaction exceeding the threshold behavior pattern.
2. The method of claim 1 , wherein the countermeasure comprises sending an alert that the threshold behavior pattern has been exceeded by the direct access transaction.
3. The method of claim 1 , wherein the countermeasure comprises creating a log that the threshold behavior pattern has been exceeded by the direct access transaction.
4. The method of claim 2 , wherein the alert includes a confidence level that the direct access transaction is a security violation.
5. The method of claim 2 , wherein the countermeasure further comprises receiving confirmation whether the direct access transaction is authorized.
6. The method of claim 1 , wherein the countermeasure comprises identifying a source of the direct access transaction exceeding the threshold behavior pattern.
7. The method of claim 6 , further comprising throttling a direct access provided to the identified source.
8. The method of claim 6 , further comprising blocking a direct access provided to the identified source.
9. The method of claim 1 , further comprising increasing a severity of the countermeasure responsive to the threshold behavior pattern continuing to be exceeded.
10. A non-volatile memory device, comprising:
a non-volatile memory; and
a controller coupled to the non-volatile memory and operable to provide a direct directed access to the non-volatile memory, the controller comprising an anomaly detector module to determine whether a threshold behavior pattern for a direct access transaction of the non-volatile memory has been exceeded, wherein the controller is configured to:
monitor threshold behavior patterns for the direct access of the non- volatile memory, wherein the threshold behavior pattern is set by either:
a user mode page as the non-volatile memory device is in operation or created offline from a lookup table; or
a dictionary of normal behavior and uploaded to the non-volatile memory device; and
perform a countermeasure responsive to the direct access transaction exceeding the threshold behavior pattern.
11. The non-volatile memory device of claim 10 , wherein the controller further comprisescompricing a normal-pattern-fitting module operable to determine the threshold behavior pattern.
12. The non-volatile memory device of claim 10 , wherein the threshold behavior pattern is determined from a mode page setting.
13. The non-volatile memory device of claim 10 , wherein the threshold behavior pattern is determined from thea look-up table.
14. The non-volatile memory device of claim 10 , wherein the controller further comprises an anomaly determination module operable to utilize machine learning to determine whether the threshold behavior pattern is exceeded.
15. A non-volatile memory device, comprising:
a controller, wherein the controller comprises an anomaly detector means; and
a non-volatile memory coupled to the controller, wherein the controller is operable to provide direct access to the non-volatile memory and wherein the anomaly detector means is operable to detect suspicious direct access transactions, wherein the controller is configured to:
monitor threshold behavior patterns for the direct access of the non- volatile memory, wherein the threshold behavior pattern is set by either:
a user mode page as the non-volatile memory device is in operation or created offline from a lookup table; or
a dictionary of normal behavior and uploaded to the non-volatile memory device; and
perform a countermeasure responsive to the direct access transaction exceeding the threshold behavior pattern.
16. The non-volatile memory device of claim 15 , wherein the anomaly detector module is further operable to monitor a parameter of the direct access transactions.
17. The non-volatile memory device of claim 15 , wherein the anomaly detector module is further operable to determine a source of the direct access transactions.
18. The non-volatile memory device of claim 15 , wherein the anomaly detector module is further operable to flag the suspicious direct access transactions.
19. A non-volatile memory device, comprising:
a non-volatile memory;
means to monitor one or more parameters related to a direct access transaction of the non-volatile memory, wherein the one or more parameters are at least one of a timing of a direct access command, a size of a data accessed in the direct access transaction, and a type of access command, wherein either the non-volatile memory is monitoring all the direct access transactions or the non-volatile memory is monitoring a portion of the direct access transaction;
means to determine whether the one or more parameters of the direct access transaction exceeded a threshold behavior pattern for any of the one or more parameters, wherein the threshold behavior pattern is either set by:
a user mode page as the non-volatile memory device is in operation or created offline from a lookup table; or
a dictionary of normal behavior and uploaded to the non-volatile memory device; and means to perform a countermeasure responsive to the direct access transaction exceeding the threshold behavior pattern.
20. The non-volatile memory device of claim 19 , wherein the countermeasure comprises sending an alert that the threshold behavior pattern has been exceeded by the direct access transaction.
21. The non-volatile memory device of claim 20 , wherein the countermeasure comprises creating a log that the threshold behavior pattern has been exceeded by the direct access transaction.
22. The non-volatile memory device of claim 20 , wherein the alert includes a confidence level that the direct access transaction is a security violation.
23. The non-volatile memory device of claim 20 , wherein the countermeasure further comprises receiving confirmation whether the direct access transaction is authorized.
24. The non-volatile memory device of claim 19 , wherein the countermeasure comprises identifying a source of the direct access transaction exceeding the threshold behavior pattern.
25. The non-volatile memory device of claim 24 , further comprising means to throttle a direct access provided to the identified source.
26. The non-volatile memory device of claim 24 , further comprising means to block a direct access provided to the identified source.