Anomaly detection and remediation utilizing analysis of storage area network access patterns
An apparatus comprises at least one processing device that includes a processor and a memory coupled to the processor. The at least one processing device is configured to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a storage area network, to generate statistics relating to the received storage access protocol commands, to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network, and to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system. A multi-path input-output (MPIO) driver of the one or more host devices may be provided with the alert and configured to initiate one or more remediation actions responsive to the alert.
1. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
where the at least one processing device is configured:
to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a storage area network;
to generate statistics relating to the received storage access protocol commands;
to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network; and
to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system;
wherein the statistics are generated in the storage system based at least in part on per-command records maintained by the storage system for respective ones of the received storage access protocol commands;
a given one of the per-command records for a corresponding one of the received storage access protocol commands comprising at least an identifier of a particular one of the storage devices to which the corresponding received storage access protocol command is directed, a data transfer offset of the corresponding received storage access protocol command and a data transfer length of the corresponding received storage access protocol command;
wherein the one or more host devices further comprise a multi-path layer comprising at least one multi-path input-output driver configured to control delivery of input-output operations to the storage devices of the storage system over selected ones of a plurality of paths through the storage area network, and wherein the at least one processing device is further configured to provide the alert to the multi-path input-output driver.
2. The apparatus of claim 1 wherein the storage access protocol commands comprise at least one of commands in a Small Computer System Interface (SCSI) access protocol and commands in a Non-Volatile Memory Express (NVMe) access protocol.
3. The apparatus of claim 2 wherein the SCSI access protocol comprises at least one of a SCSI over Fibre Channel (SCSI-FC) access protocol and an Internet SCSI (iSCSI) access protocol, and the NVMe access protocol comprises at least one of an NVMe over Fibre Channel (NVMeoFC) access protocol, an NVMe over Fabrics (NVMeoF) access protocol, and an NVMe/Transmission Control Protocol (TCP) access protocol.
4. The apparatus of claim 1 wherein generating statistics relating to the received storage access protocol commands comprises generating separate sets of statistics for respective ones of the storage devices.
5. The apparatus of claim 4 wherein the sets of statistics generated for the respective ones of the storage devices each comprise one or more of:
number of read operations per second;
number of write operations per second;
average length of read operations; and
average length of write operations.
6. The apparatus of claim 4 wherein the sets of statistics generated for the respective ones of the storage devices each comprise number of management commands per second for the corresponding storage device.
7. The apparatus of claim 4 wherein the sets of statistics generated for the respective ones of the storage devices each comprise number of host devices communicating with the corresponding storage device.
8. The apparatus of claim 7 wherein each of the sets of statistics further includes identifiers of the host devices communicating with the corresponding storage device.
9. The apparatus of claim 1 wherein generating statistics relating to the received storage access protocol commands comprises generating, for each of the received storage access protocol commands, a per-command record comprising, in addition to the identifier of the storage device to which the command was directed, the data transfer offset and the data transfer length, one or more of:
an identifier of the particular host device that directed the command;
a command type; and
a timestamp associated with the command.
10. The apparatus of claim 1 wherein processing the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network comprises:
offloading the generated statistics from the storage system to at least one external server that implements the machine learning system; and
processing the generated statistics in the machine learning system implemented by the at least one external server.
11. The apparatus of claim 1 wherein processing the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network comprises processing the generated statistics utilizing at least one of a Gaussian mixture model (GMM) and a Holt-Winters model.
12. The apparatus of claim 1 wherein the at least one processing device is further configured to initiate one or more remediation actions responsive to the alert.
13. The apparatus of claim 1 wherein the multi-path input-output driver is configured to initiate one or more remediation actions responsive to the alert.
14. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by at least one processing device comprising a processor coupled to a memory, causes the at least one processing device:
to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a storage area network;
to generate statistics relating to the received storage access protocol commands;
to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network; and
to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system;
wherein the statistics are generated in the storage system based at least in part on per-command records maintained by the storage system for respective ones of the received storage access protocol commands;
a given one of the per-command records for a corresponding one of the received storage access protocol commands comprising at least an identifier of a particular one of the storage devices to which the corresponding received storage access protocol command is directed, a data transfer offset of the corresponding received storage access protocol command and a data transfer length of the corresponding received storage access protocol command;
wherein the one or more host devices further comprise a multi-path layer comprising at least one multi-path input-output driver configured to control delivery of input-output operations to the storage devices of the storage system over selected ones of a plurality of paths through the storage area network, and wherein the at least one processing device is further configured to provide the alert to the multi-path input-output driver.
15. The computer program product of claim 14 wherein generating statistics relating to the received storage access protocol commands comprises generating separate sets of statistics for respective ones of the storage devices.
16. A method comprising:
receiving storage access protocol commands directed by one or more host devices to storage devices of a storage system over a storage area network;
generating statistics relating to the received storage access protocol commands;
processing the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network; and
generating an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system;
wherein the statistics are generated in the storage system based at least in part on per-command records maintained by the storage system for respective ones of the received storage access protocol commands;
a given one of the per-command records for a corresponding one of the received storage access protocol commands comprising at least an identifier of a particular one of the storage devices to which the corresponding received storage access protocol command is directed, a data transfer offset of the corresponding received storage access protocol command and a data transfer length of the corresponding received storage access protocol command;
wherein the one or more host devices further comprise a multi-path layer comprising at least one multi-path input-output driver configured to control delivery of input-output operations to the storage devices of the storage system over selected ones of a plurality of paths through the storage area network, and wherein at least one processing device is configured to provide the alert to the multi-path input-output driver; and
wherein the method is performed by the at least one processing device, the at least one processing device comprising a processor coupled to a memory.
17. The method of claim 16 wherein generating statistics relating to the received storage access protocol commands comprises generating separate sets of statistics for respective ones of the storage devices.