Systems and methods for protecting SSDs against threats
Various implementations described herein relate to systems and methods for protecting data stored on a Solid State Drive (SSD) against malware, including determining, by a controller of the SSD, a typical traffic profile, receiving, by the controller, commands from a host, and determining, by the controller, that the commands are likely caused by malware by determining that the commands deviate from the typical traffic profile. In response to determining the commands are likely caused by the malware, the controller performs a malware response action.
1. A method for protecting data stored on a Solid State Drive (SSD) against malware, comprising:
determining, by a controller of the SSD, a typical traffic profile;
receiving, by the controller, commands from a host, wherein the commands include at least one of a command to read data from the SSD to the host or a command to write data from the host to the SSD;
parsing, by the controller, one or more of a logical address range, a data transfer type and a data content type from the commands received by the controller from the host,
determining, by the controller, that the commands are likely caused by malware by determining that the commands deviate from the typical traffic profile based on the parsing; and
in response to determining the commands are likely caused by the malware, perform, by the controller, a malware response action.
2. The method of claim 1 , wherein the malware response action comprises one or more of delaying execution of the commands, stopping the execution of the commands, ignoring the commands, or reporting to the host that the commands are likely caused by the malware.
3. The method of claim 1 , wherein the typical traffic profile is determined based on one or more of input/output (I/O) command pattern, logical block address range sizes, data transfer types, rates or sizes of data received from the host, or data content types of the data received from the host.
4. The method of claim 1 , wherein the typical traffic profile is determined based on input/output (I/O) operations per second (IOPS) for one or more of sequential write operations, random write operations, sequential read operations, random read operations, trim operations, unmap operations, or deallocate operations.
5. The method of claim 4 , wherein
the commands received from the host comprises sequential read commands, sequential write commands, trim operations, unmap operations or deallocate operations; and
the sequential read commands, the sequential write commands, the trim operations, the unmap operations or the deallocate operations are determined to deviate from the typical traffic profile based on the IOPS for the one or more of the sequential write operations, the random write operations, the sequential read operations, the random read operations, the trim operations, the unmap operations or the deallocate operations.
6. The method of claim 1 , wherein the typical traffic profile is determined based on input/output (I/O) operations per second (IOPS) for one or more of small write operations, large write operations, small read operations, large read operations, trim operations, unmap operations, or deallocate operations.
7. The method of claim 6 , wherein
the commands received from the host comprises read commands corresponding to large data sizes or write commands corresponding to large data sizes; and
the read commands corresponding to large data sizes or the write commands corresponding to large data sizes are determined to deviate from the typical traffic profile based on the IOPS for the one or more of the small write operations, the large write operations, the small read operations, or the large read operations.
8. The method of claim 1 , wherein the commands are write commands; and
determining that the commands are likely caused by the malware comprises determining, by the controller, that data associated with the write commands is encrypted data.
9. The method of claim 8 , wherein determining that the data associated with the write commands is the encrypted data comprises:
compressing, by a compressor of the controller, the data associated with the write commands; and
determining, by the compressor, that the data is incompressible.
10. The method of claim 9 , wherein
compressing the data comprises determining an entropy value for the data; and
the data associated with the write commands is determined to be encrypted data based on the entropy value and an encrypted data threshold.
11. The method of claim 8 , wherein the malware response action comprises one or more of:
stopping processing trim, unmap, deallocate commands received from the host;
stopping processing write commands received from the host;
causing the SSD to not respond to any commands from the host;
stopping all write operations; or
stopping any garbage collection operations.
12. The method of claim 8 , further comprising simultaneously providing the data to a memory controller and a compressor.
13. A Solid State Drive (SSD), comprising:
a controller; and
a non-volatile memory, wherein the controller is configured to:
determine a typical traffic profile;
receive commands from a host, wherein the commands include at least one of a command to read data from the SSD to the host or a command to write data from the host to the SSD;
parse one or more of a logical address range, a data transfer type and a data content type from the commands received by the controller from the host,
determine that the commands are likely caused by malware by determining that the commands deviate from the typical traffic profile based on the parsing; and
in response to determining the commands are likely caused by the malware, performing a malware response action.
14. The SSD of claim 13 , wherein
the commands are write commands; and
the controller determines that the commands are likely caused by the malware by determining that data associated with the write commands is encrypted data.
15. The SSD of claim 14 , wherein
the controller comprises a compressor; and
the controller determines that the data associated with the write commands is the encrypted data by:
compressing, by the compressor, the data associated with the write commands; and
determining, by the compressor, that the data is incompressible.
16. The SSD of claim 15 , wherein
compressing the data comprises determining an entropy value for the data; and
the data associated with the write commands is determined to be encrypted data based on the entropy value and an encrypted data threshold.
17. The SSD of claim 14 , wherein the malware response action comprises one or more of:
stopping processing trim, unmap, deallocate commands received from the host;
stopping processing write commands received from the host;
causing the SSD to not respond to any commands from the host;
stopping all write operations; or
stopping any garbage collection operations.
18. The SSD of claim 14 , wherein
the controller comprises a compressor and a memory controller; and
the data is simultaneously provided to the compressor and the memory controller.
19. The SSD of claim 13 , wherein the typical traffic profile is determined based on one or more of input/output (I/O) command pattern, data sizes of data received from the host, or data content types of the data received from the host.
20. A non-transitory computer-readable medium storing computer-readable instructions, such that when executed, causes a controller of a Solid State Drive (SSD) to:
determine a typical traffic profile;
receive commands from a host, wherein the commands include at least one of a command to read data from the SSD to the host or a command to write data from the host to the SSD;
parse one or more of a logical address range, a data transfer type and a data content type from the commands received by the controller from the host,
determine that the commands are likely caused by malware by determining that the commands deviate from the typical traffic profile based on the parsing; and
in response to determining the commands are likely caused by the malware, performing a malware response action.