Security threat monitoring for a storage system
An exemplary security threat monitoring system receives performance metric data representative of a performance metric for a storage system, applies the performance metric data as an input to an unsupervised machine learning model, and identifies, based on an output of the unsupervised machine learning model, an anomaly in the performance metric data.
1. A method comprising:
receiving, by a security threat monitoring system, performance metric data representative of a performance metric for a storage system;
applying, by the security threat monitoring system, the performance metric data as an input to an unsupervised machine learning model;
identifying, by the security threat monitoring system based on an output of the unsupervised machine learning model, an anomaly in the performance metric data;
determining, by the security threat monitoring system, that the anomaly is representative of a security threat to the storage system; and
performing, by the security threat monitoring system based on the determining that the anomaly is representative of the security threat to the storage system, a remedial action associated with the anomaly by performing one or more of
slowing down a performance of at least one operation on the storage system,
preventing at least one operation from being performed on the storage system, or
disabling at least one element of the storage system.
2. The method of claim 1 , wherein the determining that the anomaly is representative of the security threat to the storage system comprises applying data representative of the anomaly as an input to a supervised machine learning model, the supervised machine learning model configured to:
determine a confidence score for the anomaly;
determine that the confidence score is above a threshold associated with the security threat; and
classify, in response to the determination that the confidence score is above the threshold, the anomaly as being representative of the security threat to the storage system.
3. The method of claim 2 , further comprising:
receiving, by the security threat monitoring system, user input confirming or refuting that the anomaly is an actual security threat to the storage system; and
providing, by the security threat monitoring system, the user input as a training input to the supervised machine learning model.
4. The method of claim 1 , wherein the determining that the anomaly is representative of the security threat to the storage system comprises:
applying a rule set to the data representative of the anomaly to generate a confidence score for the anomaly; and
determining that the confidence score is above a threshold associated with the security threat.
5. The method of claim 1 , further comprising:
identifying, by the security threat monitoring system based on an output of the unsupervised machine learning model, an additional anomaly in the performance metric data;
determining, by the security threat monitoring system, that the additional anomaly is not representative of a security threat to the storage system; and
abstaining, by the security threat monitoring system in response to the determining that the additional anomaly is not representative of the security threat to the storage system, from performing a remedial action associated with the additional anomaly.
6. The method of claim 1 , wherein the storage system comprises a plurality of storage elements, and wherein the performing of the remedial action comprises:
determining that the anomaly is only associated with a particular storage element included in the storage elements;
performing the remedial action with respect to the particular storage element; and
abstaining from performing the remedial action with respect to other storage elements in the plurality of storage elements that are not the particular storage element.
7. The method of claim 1 , wherein the receiving of the performance metric data comprises:
receiving, by way of a network, phone-home logs from the storage system; and
extracting the performance metric data from the phone-home logs.
8. The method of claim 1 , wherein the receiving of the performance metric data comprises extracting the performance metric data with an application executed by the storage system.
9. The method of claim 1 , wherein the performance metric is associated with at least one of data reads from the storage system, data writes to the storage system, compression of data maintained by the storage system, and encryption of data maintained by the storage system.
10. The method of claim 1 , wherein the unsupervised machine learning model is configured to implement a variational autoencoder heuristic by:
encoding the performance metric data to generate encoded data;
decoding the encoded data to generate decoded data;
determining an error measurement that represents a decoding error between the performance metric data and the decoded data; and
generating, based on the decoding error, a confidence score for a data subset of the performance metric data that indicates that the data subset includes the anomaly.
11. A system comprising:
a memory storing instructions;
a processor communicatively coupled to the memory and configured to execute the instructions to:
receive performance metric data representative of a performance metric for a storage system,
apply the performance metric data as an input to an unsupervised machine learning model,
use an output of the unsupervised machine learning model to identify an anomaly in the performance metric data;
determine that the anomaly is representative of a security threat to the storage system; and
perform, based on the determining that the anomaly is representative of the security threat to the storage system, a remedial action associated with the anomaly by performing one or more of
slowing down a performance of at least one operation on the storage system,
preventing at least one operation from being performed on the storage system, or
disabling at least one element of the storage system.
12. The system of claim 11 , wherein the determining that the anomaly is representative of the security threat to the storage system comprises applying data representative of the anomaly as an input to a supervised machine learning model, the supervised machine learning model configured to:
determine a confidence score for the anomaly;
determine that the confidence score is above a threshold associated with the security threat; and
classify, in response to the determination that the confidence score is above the threshold, the anomaly as being representative of the security threat to the storage system.
13. The system of claim 11 , wherein the determining that the anomaly is representative of the security threat to the storage system comprises applying data representative of the anomaly as an input to a supervised machine learning model, the supervised machine learning model configured to:
determine a confidence score for the anomaly;
determine that the confidence score is above a threshold associated with the security threat; and
classify, in response to the determination that the confidence score is above the threshold, the anomaly as being representative of the security threat to the storage system.
14. The system of claim 13 , wherein the processor is further configured to execute the instructions to:
receive user input confirming or refuting that the anomaly is an actual security threat to the storage system; and
provide the user input as a training input to the supervised machine learning model.
15. The system of claim 11 , wherein the determining that the anomaly is representative of the security threat to the storage system comprises:
applying a rule set to the data representative of the anomaly to generate a confidence score for the anomaly; and
determining that the confidence score is above a threshold associated with the security threat.
16. The system of claim 11 , wherein the processor is further configured to execute the instructions to:
identify, based on an output of the unsupervised machine learning model, an additional anomaly in the performance metric data;
determine that the additional anomaly is not representative of a security threat to the storage system; and
abstain, in response to the determining that the additional anomaly is not representative of the security threat to the storage system, from performing a remedial action associated with the additional anomaly.
17. The system of claim 11 , wherein the storage system comprises a plurality of storage elements, and wherein the performing of the remedial action comprises:
determining that the anomaly is only associated with a particular storage element included in the storage elements;
performing the remedial action with respect to the particular storage element; and
abstaining from performing the remedial action with respect to other storage elements in the plurality of storage elements that are not the particular storage element.
18. The system of claim 11 , wherein the receiving of the performance metric data comprises:
receiving, by way of a network, phone-home logs from the storage system; and
extracting the performance metric data from the phone-home logs.
19. The system of claim 11 , wherein the receiving of the performance metric data comprises extracting the performance metric data with an application executed by the storage system.
20. A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to:
receive performance metric data representative of a performance metric for a storage system;
apply the performance metric data as an input to an unsupervised machine learning model;
use an output of the unsupervised machine learning model to identify an anomaly in the performance metric data;
determine that the anomaly is representative of a security threat to the storage system; and
perform, based on the determining that the anomaly is representative of the security threat to the storage system, a remedial action associated with the anomaly by performing one or more of
slowing down a performance of at least one operation on the storage system,
preventing at least one operation from being performed on the storage system, or
disabling at least one element of the storage system.