Methods and systems using an AI co-processor to detect anomalies caused by malware in storage devices
Computer implemented systems and methods for performing electromotive force analysis of a storage device that include a storage device, an Artificial Intelligence Co-processor (AI-Coprocessor) chipset, a thin coil inductor positioned in proximity to a portion of the surface of the storage device for capturing data from electro motive radia generated by the storage device, an analog-to-digital-converter, and at least one probe for communicating the captured data to an analog-to-digital converter. The data is captured by the thin coil inductor and communicated to the analog-to-digital-converter via the at least one probe and the analog-to-digital-converter digitizes the voltage level of the captured data and communicates the results of the digitization and amplification to the Ai-Coprocessor. The Ai-Coprocessor chipset performs analysis of the data to detect any anomalies in the operation of the storage device and outputs those result for further processing. Embodiments include the use of an NVM Express protocol or an AHCI controller engine so it can detect in real time any hardware threats or attacks such as side channel attack, power glitch and any other hardware changes. Embodiments can detect malicious activities such as ransomware, virus and malware, or non-malicious activities by measuring the electromotive force energy caused by anomalous activities.
1. A computer implemented system for performing electromotive force analysis of a storage device comprising:
a storage device configured to execute a predefined protocol;
an AI Co-processor chipset;
a thin coil inductor positioned in proximity to a portion of the surface of the storage device for capturing data associated to electromotive force energy generated by the storage device;
an analog-to-digital-converter; and
at least one probe for communicating the captured data to an analog-to-digital converter;
wherein the data is captured by the thin coil inductor and communicated to the analog-to-digital-converter via the at least one probe;
wherein the analog-to-digital-converter digitizes the voltage level of the captured data and communicates the results of the digitization and amplification to the AI-Coprocessor chipset;
wherein the AI-Coprocessor chipset performs analysis of the data to detect any anomalies in the operation of the storage device and outputs those result for further processing; and
wherein, to perform analysis of the data for the detection of anomalies, the AI-Coprocessor chipset is configured to calculate a cross-correlation between a command variable associated with the predefined protocol and the electromotive force energy generated by the storage device.
2. The computer implemented system for performing electromotive force analysis of a storage device of claim 1 wherein the storage device is a solid state drive.
3. The computer implemented system for performing electromotive force analysis of a storage device of claim 2 further comprising:
a solid state drive controller; and
a circuit chipset in communication with the solid state drive controller;
wherein the solid state drive controller monitors hardware performance of the solid state drive by measuring electromotive force of the solid state drive and communicates the measured electromotive force data to the Al-Coprocessor chipset.
4. The computer implemented system for performing electromotive force analysis of a storage device of claim 3 wherein the AI-Coprocessor chipset performs analysis to provide real time protection against any anomalies in the operation of the solid state drive.
5. The computer implemented system for performing electromotive force analysis of a storage device of claim 4 wherein the predefined protocol is NVMe protocol.
6. The computer implemented system for performing electromotive force analysis of a storage device of claim 4 wherein the predefined protocol is AHCI protocol.
7. The computer implemented system for performing electromotive force analysis of a storage device of claim 4 wherein the anomaly activities are caused by malware and wherein the further processing interrupts the operation of the solid state drive.
8. The computer implemented system for performing electromotive force analysis of a storage device of claim 4 wherein the AI-CoProcessor chipset applies artificial intelligence algorithms to detect ransomware activities.
9. The computer implemented system for performing electromotive force analysis of a storage device of claim 8 wherein when the ransomware activities are detected, the operation of the solid state drive is interrupted.
10. A computer implemented method for performing electromotive force analysis of a storage device comprising the steps of:
capturing data associated to electromotive force energy generated by a storage device using a thin coil inductor positioned in proximity to a portion of a surface of the storage device, the storage device executing a predefined protocol;
communicating the captured data to an analog-to-digital-converter via at least one probe;
digitizing the voltage level of the captured data using the analog-to-digital-converter;
communicating the voltage level to an AI-Coprocessor chipset;
analyzing the voltage level using the AI-Coprocessor chipset to detect any anomalies in the operation of the storage device; and
outputting the result for further processing,
wherein analyzing the voltage level for the detection of anomalies comprises calculating a cross-correlation between a command variable associated with the predefined protocol and the electromotive force energy generated by the storage device.
11. The computer implemented method for performing electromotive force analysis of a storage device of claim 10 wherein the storage device is a solid state drive.
12. The computer implemented method for performing electromotive force analysis of a storage device of claim 11 further comprising the steps of:
monitoring the hardware performance of the solid state drive by measuring electromotive force of the solid state drive with a solid state drive controller and a circuit chipset in communication with the solid state drive controller;
communicating the measured electromotive force data to the AI-Coprocessor chipset;
using the Al-Coprocessor chipset to analyze the measured electromotive force data; and
outputting the results of the analysis to provide real time protection against any anomalies in the operation of the solid state drive.
13. The computer implemented method for performing electromotive force analysis of a storage device of claim 12 wherein the AI-Coprocessor chipset performs analysis to provide real time protection against any anomalies in the operation of the solid state drive.
14. The computer implemented method for performing electromotive force analysis of a storage device of claim 11 wherein the predefined protocol is NVMe protocol.
15. The computer implemented method for performing electromotive force analysis of a storage device of claim 11 wherein the predefined protocol is AHCI protocol.
16. The computer implemented method for performing electromotive force analysis of a storage device of claim 11 wherein the anomaly activities are caused by malware and further comprising the step of:
interrupting the operation of the solid state drive when an anomaly caused by malware is detected.
17. The computer implemented method for performing electromotive force analysis of a storage device of claim 12 wherein the AI-Coprocessor chipset utilizes artificial intelligence algorithms to detect ransomware activities.
18. The computer implemented method for performing electromotive force analysis of a storage device of claim 17 further comprising the step of:
interrupting the operation of the solid state drive when the ransomware activities are detected by the Al-Coprocessor chipset.
19. The computer implemented system for performing electromotive force analysis of a storage device of claim 1 , wherein the AI Co-processor chipset is configured to perform the steps of limiting access to stored data, sending one or more alert beams through an external wireless connection or a wired connection or both, locking the storage device or a component within the storage device or a component external to the storage device, and/or allowing read only mode without the ability to overwrite any stored data.
20. The computer implemented method for performing electromotive force analysis of a storage device of claim 10 , further comprising the steps of limiting access to stored data, sending one or more alert beams through an external wireless connection or a wired connection or both, locking the storage device or a component within the storage device or a component external to the storage device, and/or allowing read only mode without the ability to overwrite any stored data.