Storage system with snapshot-based detection and remediation of ransomware attacks
A storage system in one embodiment comprises a plurality of storage devices and a storage controller. The storage controller is configured to generate a plurality of snapshots of a storage volume of the storage system at respective different points in time, to monitor a differential between a given one of the snapshots and the storage volume, and to generate an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions. The one or more specified conditions illustratively comprise a specified minimum amount of change in the storage volume relative to the given snapshot of the storage volume. Compressibility of the storage volume is also taken into account in generating the alert in some embodiments. The storage controller illustratively initiates restoration of the storage volume utilizing a selected snapshot responsive to confirmation of an actual attack.
1. An apparatus comprising:
a storage system comprising a plurality of storage devices and a storage controller;
the storage controller being configured:
to generate a plurality of snapshots of a storage volume of the storage system at respective different points in time;
to monitor a differential between a given one of the snapshots and a current version of the storage volume; and
to generate an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions, the potential ransomware attack comprising a suspected ransomware attack not yet confirmed as an actual ransomware attack;
wherein generating an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions comprises:
determining that the monitored differential satisfies the one or more specified conditions;
determining compressibility of at least a portion of the storage volume; and
generating the alert responsive to the monitored differential satisfying the one or more specified conditions and the compressibility of the storage volume being below a specified level of compressibility, the specified level of compressibility being based at least in part on a minimum compressibility achievable for said at least a portion of the storage volume;
wherein determining compressibility of at least a portion of the storage volume comprises collecting compressibility statistics for the storage volume as data is written to the storage volume; and
wherein the storage controller comprises at least one processing device comprising a processor coupled to a memory.
2. The apparatus of claim 1 wherein the storage volume comprises at least one logical storage volume comprising at least a portion of a physical storage space of one or more of the storage devices.
3. The apparatus of claim 1 wherein at least a subset of the snapshots comprise respective point-in-time replicas of the storage volume generated at respective different points in time.
4. The apparatus of claim 1 wherein only two most recently generated snapshots for the storage volume are retained in the storage system.
5. The apparatus of claim 1 wherein the one or more specified conditions comprise a specified minimum amount of change in the storage volume relative to the given snapshot of the storage volume.
6. The apparatus of claim 5 wherein the specified minimum amount of change in the storage volume is specified in terms of a minimum number of storage units of the storage volume that have changed since generation of the given snapshot.
7. The apparatus of claim 5 wherein the specified minimum amount of change in the storage volume is specified in terms of a minimum percentage of the storage volume that has changed since generation of the given snapshot.
8. The apparatus of claim 1 wherein generating an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions comprises generating an alert of a potential ransomware attack and initiating one or more attack remediation operations responsive to confirmation of the potential ransomware attack as an actual ransomware attack.
9. The apparatus of claim 1 wherein the storage controller is configured to control deletion of one or more of the snapshots from the storage system based at least in part on the generated alert.
10. The apparatus of claim 1 wherein the storage controller is configured to determine that the generated alert is a false positive and to delete one or more of the snapshots from the storage system based at least in part on the false positive determination.
11. The apparatus of claim 1 wherein the storage controller is further configured to generate a message containing the generated alert and to deliver the message over a network to a storage administrator device.
12. The apparatus of claim 1 wherein the storage controller is further configured to initiate restoration of the storage volume utilizing a selected one of the snapshots generated prior to the given snapshot based at least in part on the generated alert.
13. A method comprising:
generating a plurality of snapshots of a storage volume of a storage system at respective different points in time;
monitoring a differential between a given one of the snapshots and a current version of the storage volume; and
generating an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions, the potential ransomware attack comprising a suspected ransomware attack not yet confirmed as an actual ransomware attack;
wherein generating an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions comprises:
determining that the monitored differential satisfies the one or more specified conditions;
determining compressibility of at least a portion of the storage volume; and
generating the alert responsive to the monitored differential satisfying the one or more specified conditions and the compressibility of the storage volume being below a specified level of compressibility, the specified level of compressibility being based at least in part on a minimum compressibility achievable for said at least a portion of the storage volume;
wherein determining compressibility of at least a portion of the storage volume comprises collecting compressibility statistics for the storage volume as data is written to the storage volume; and
wherein the method is implemented by at least one processing device comprising a processor coupled to a memory.
14. The method of claim 13 wherein the one or more specified conditions comprise a specified minimum amount of change in the storage volume relative to the given snapshot of the storage volume.
15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:
to generate a plurality of snapshots of a storage volume of a storage system at respective different points in time;
to monitor a differential between a given one of the snapshots and a current version of the storage volume; and
to generate an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions, the potential ransomware attack comprising a suspected ransomware attack not yet confirmed as an actual ransomware attack;
wherein generating an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions comprises:
determining that the monitored differential satisfies the one or more specified conditions;
determining compressibility of at least a portion of the storage volume; and
generating the alert responsive to the monitored differential satisfying the one or more specified conditions and the compressibility of the storage volume being below a specified level of compressibility, the specified level of compressibility being based at least in part on a minimum compressibility achievable for said at least a portion of the storage volume; and
wherein determining compressibility of at least a portion of the storage volume comprises collecting compressibility statistics for the storage volume as data is written to the storage volume.
16. The computer program product of claim 15 wherein the one or more specified conditions comprise a specified minimum amount of change in the storage volume relative to the given snapshot of the storage volume.
17. The computer program product of claim 16 wherein the specified minimum amount of change in the storage volume is specified in terms of a minimum number of storage units of the storage volume that have changed since generation of the given snapshot.
18. The computer program product of claim 16 wherein the specified minimum amount of change in the storage volume is specified in terms of a minimum percentage of the storage volume that has changed since generation of the given snapshot.
19. The computer program product of claim 15 wherein generating an alert indicative of at least a potential ransomware attack on the storage system based at least in part on the monitored differential satisfying one or more specified conditions comprises generating an alert of a potential ransomware attack and initiating one or more attack remediation operations responsive to confirmation of the potential ransomware attack as an actual ransomware attack.
20. The computer program product of claim 15 wherein the program code when executed by said at least one processing device further causes said at least one processing device to determine that the generated alert is a false positive and to delete one or more of the snapshots from the storage system based at least in part on the false positive determination.