Simulating a ransomware attack in a testing environment
A technique is directed to simulating a ransomware attack in a testing environment. The technique involves obtaining access to a testing environment in which to perform a simulated ransomware attack. The technique further involves, after obtaining access to the testing environment, loading prepared data into the testing environment. The technique further involves performing, as the simulated ransomware attack, a set of input/output (IO) operations based on a set of IO traces corresponding to an actual ransomware attack, the set of IO operations accessing the prepared data.
1. A method of simulating a ransomware attack, the method comprising:
obtaining access to a testing environment in which to perform a simulated ransomware attack;
after obtaining access to the testing environment, loading prepared data into the testing environment; and
performing, as the simulated ransomware attack, a set of input/output (IO) operations based on a set of IO traces corresponding to an actual ransomware attack, the set of IO operations accessing the prepared data;
wherein performing the set of IO operations includes:
writing, in place of the prepared data, replacement data representing encrypted user data generated by the actual ransomware attack, the replacement data being based on the set of IO traces; and
wherein the method further comprises:
generating the replacement data based on data characteristics of the encrypted user data, the data characteristics being obtained from an IO trace of the set of IO traces, the IO trace describing a write request which was issued during the actual ransomware attack.
2. The method of claim 1 , further comprising:
obtaining, from the set of IO traces, an entropy measure of data written during the actual ransomware attack; and
generating, based on the entropy measure, input data simulating the data written during the actual ransomware attack; and
wherein performing the set of IO operations includes:
writing the input data into storage of the testing environment.
3. The method of claim 1 , further comprising:
obtaining, from the set of IO traces, a deduplication measure of data written during the actual ransomware attack; and
generating, based on the deduplication measure, input data simulating the data written during the actual ransomware attack; and
wherein performing the set of IO operations includes:
writing the input data into storage of the testing environment.
4. The method of claim 1 wherein the set of IO traces is acquired
from a first platform running a first operating system (OS); and
wherein performing the set of IO operations includes:
performing the set of IO operations on, as the testing environment, a second platform running a second OS that is a different OS than the first OS.
5. The method of claim 1 , further comprising:
obtaining, from the set of IO traces, other data characteristics of read data stored prior to the actual ransomware attack; and
generating the prepared data based on the other data characteristics to support proper access when performing a read operation based on the set of IO traces.
6. The method of claim 5 wherein obtaining the other data characteristics includes:
obtaining, as a data characteristic, an entropy measure of the read data.
7. The method of claim 5 wherein obtaining the other data characteristics includes:
obtaining, as a data characteristic, a deduplication measure of the read data.
8. The method of claim 5 wherein the prepared data includes
multiple portions of data each based on a respective read request recorded in the set of IO traces;
wherein the method further comprises:
collating the multiple portions of data to generate a set of collated data; and
wherein loading the prepared data includes:
loading, as at least part of the prepared data, the set of collated data into the testing environment.
9. The method of claim 8 wherein collating the multiple portions of
data exceeds a predetermined collation threshold; and
wherein the method further comprises:
in response to exceeding the predetermined collation threshold, issuing a request to load, as at least part of the prepared data, the set of collated data into the testing environment.
10. The method of claim 1 wherein the set of IO traces
define a plurality of sequential IO requests issued during the actual ransomware attack; and
wherein performing the IO operations includes:
generating a set of collated IO requests having an order of access based on the plurality of sequential IO requests, the set of collated IO requests including fewer IO requests than the plurality of IO requests; and
issuing, during the simulated ransomware attack, the set of collated IO requests in the testing environment.
11. The method of claim 10 wherein the plurality of sequential IO
requests includes a plurality of sequential read requests; and
wherein generating the set of collated IO requests includes:
generating a collated read request based on the set of sequential read requests.
12. The method of claim 10 wherein the plurality of sequential IO
requests includes a plurality of sequential write requests; and
wherein generating the set of collated IO requests includes:
generating a collated write request based on the set of sequential write requests.
13. The method of claim 12 wherein write requests in plurality of
sequential write requests are directed to different respective storage locations;
wherein the sequential IO requests further include a second plurality of sequential write requests directed to a same storage location; and
wherein performing the set of IO operations further includes:
issuing multiple write requests to store write data of the second plurality of write requests.
14. The method of claim 10 wherein generating the set of collated IO requests includes:
collating the sequential IO requests to generate a collated IO request having an IO size exceeding a predetermined size threshold; and
in response to the IO size exceeding the predetermined size threshold, issuing the collated IO request in the testing environment.
15. Data storage equipment, comprising:
memory; and
control circuitry coupled to the memory, the memory storing instructions which, when carried out by the control circuitry, cause the control circuitry to perform a method of:
obtaining access to a testing environment in which to perform a simulated ransomware attack;
after obtaining access to the testing environment, loading prepared data into the testing environment; and
performing, as the simulated ransomware attack, a set of input/output (IO) operations based on a set of IO traces corresponding to an actual ransomware attack, the set of IO operations accessing the prepared data;
wherein performing the set of IO operations includes:
writing, in place of the prepared data, replacement data representing encrypted user data generated by the actual ransomware attack, the replacement data being based on the set of IO traces; and
wherein the method further comprises:
generating the replacement data based on data characteristics of the encrypted user data, the data characteristics being obtained from an IO trace of the set of IO traces, the IO trace describing a write request which was issued during the actual ransomware attack.
16. The data storage equipment of claim 15 wherein the method further comprises:
obtaining, from the set of IO traces, an entropy measure of data written during the actual ransomware attack; and
generating, based on the entropy measure, input data simulating the data written during the actual ransomware attack; and
wherein performing the set of IO operations includes:
writing the input data into storage of the testing environment.
17. The data storage equipment of claim 15 wherein the method further comprises:
obtaining, from the set of IO traces, a deduplication measure of data written during the actual ransomware attack; and
generating, based on the deduplication measure, input data simulating the data written during the actual ransomware attack; and
wherein performing the set of IO operations includes:
writing the input data into storage of the testing environment.
18. A computer program product having a non-transitory computer readable medium which stores a set of instructions to simulate a ransomware attack, the set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:
obtaining access to a testing environment in which to perform a simulated ransomware attack;
after obtaining access to the testing environment, loading prepared data into the testing environment; and
performing, as the simulated ransomware attack, a set of input/output (IO) operations based on a set of IO traces corresponding to an actual ransomware attack, the set of IO operations accessing the prepared data;
wherein performing the set of IO operations includes:
writing, in place of the prepared data, replacement data representing encrypted user data generated by the actual ransomware attack, the replacement data being based on the set of IO traces; and
wherein the method further comprises:
generating the replacement data based on data characteristics of the encrypted user data, the data characteristics being obtained from an IO trace of the set of IO traces, the IO trace describing a write request which was issued during the actual ransomware attack.
19. The method of claim 1 wherein performing the set of IO operations further includes:
prior to writing the replacement data, reading the prepared data from a particular storage location in the testing environment, the replacement data being written to the particular storage location in place of the prepared data.