Safeguarded Snapshot Generation within a Flash-based Storage System to Protect Against Ransomware

1 . A method comprising:

collecting I/O operation (IOP) data for each virtual disk included in a flash-based storage system;

transmitting the IOP data to an AI-powered detection module;

detecting, using the AI-powered detection module, unusual activity associated with the IOP data; and

performing, based on the detecting the unusual activity, a remedial action, the remedial action comprising automatically creating a snapshot of data included in the flash-based storage system.

2 . The method of claim 1 , wherein the snapshot is safeguarded against being deleted or modified.

3 . The method of claim 2 , further comprising requiring permission from at least two authorized entities to delete the snapshot.

4 . The method of claim 2 , wherein the snapshot is air gapped from malware or other threats.

5 . The method of claim 1 , further comprising using the snapshot to restore the data to the flash-based storage system.

6 . The method of claim 1 , wherein the remedial action further comprises sending an alert.

7 . The method of claim 6 , wherein the sending the alert comprises sending the alert to a storage insights monitoring system.

8 . The method of claim 7 , further comprising presenting, by the storage insights monitoring system within a user interface, diagnostic information associated with the flash-based storage system.

9 . The method of claim 7 , further comprising presenting, by the storage insights monitoring system within a user interface, capacity and performance metrics associated with the flash-based storage system.

10 . The method of claim 1 , wherein the unusual activity is associated with a ransomware attack against data included in the flash-based storage system.

11 . A system comprising:

a memory storing instructions; and

one or more processors communicatively coupled to the memory and configured to execute the instructions to perform a process comprising:

collecting I/O operation (IOP) data for each virtual disk included in a flash-based storage system;

transmitting the IOP data to an AI-powered detection module;

detecting, using the AI-powered detection module, unusual activity associated with the IOP data; and

performing, based on the detecting the unusual activity, a remedial action, the remedial action comprising automatically creating a snapshot of data included in the flash-based storage system.

12 . The system of claim 11 , wherein the snapshot is safeguarded against being deleted or modified.

13 . The system of claim 12 , wherein the process further comprises requiring permission from at least two authorized entities to delete the snapshot.

14 . The system of claim 12 , wherein the snapshot is air gapped from malware or other threats.

15 . The system of claim 11 , wherein the process further comprises using the snapshot to restore the data to the flash-based storage system.

16 . The system of claim 11 , wherein the remedial action further comprises sending an alert.

17 . The system of claim 16 , wherein the sending the alert comprises sending the alert to a storage insights monitoring system.

18 . The system of claim 17 , wherein the process further comprises presenting, by the storage insights monitoring system within a user interface, diagnostic information associated with the flash-based storage system.

19 . The system of claim 17 , wherein the process further comprises presenting, by the storage insights monitoring system within a user interface, capacity and performance metrics associated with the flash-based storage system.

20 . A computer program product comprising instructions that, when executed, cause a computing device to perform a process comprising:

collecting I/O operation (IOP) data for each virtual disk included in a flash-based storage system;

transmitting the IOP data to an AI-powered detection module;

detecting, using the AI-powered detection module, unusual activity associated with the IOP data; and

performing, based on the detecting the unusual activity, a remedial action, the remedial action comprising automatically creating a snapshot of data included in the flash-based storage system.