Method and apparatus for detecting the occurrence of a ransomware attack on a storage volume
A Ransomware Activity Detection System (RADS) characterizes historic read/write IO activity on a storage volume, and also characterizes historic data characteristics of the storage volume, such as the percentage reducibility of the data held in the storage volume. The RADS monitors the storage volume to identify differences between current read/write IO activity and historic read/write IO activity, as well as difference between current data characteristics of the storage volume and historic data characteristics of the storage volume. When the RADS detects a significant difference in read/write IO activity on a storage volume, that is coupled with a significant changes to the data characteristics of the storage volume, the RADS protects the storage volume and generates an alert of the possible occurrence of a ransomware attack. Protection may occur prior in connection with any bulk read operation to proactively protect storage volumes against ransomware attacks.
1. A non-transitory tangible computer readable storage medium having stored thereon a computer program for detecting existence of a ransomware attack on a storage volume, the computer program including a set of instructions which, when executed by a computer, cause the computer to perform a method comprising the steps of:
determining historic read and write Input/Output (IO) activity characteristics of extents of the storage volume by a ransomware activity detection system implemented in a data services layer of a storage system operating system, the data service layer being part of the storage system operating system that manages physical storage and retrieval of data on the physical storage;
comparing, by the ransomware activity detection system, current read and write IO activity characteristics of the extents of the storage volume with the historic read and write IO activity characteristics of the extents of the storage volume;
determining occurrence of a large sequential read IO operation on a set of extents of the storage volume;
in response to determining occurrence of the large sequential read IO operation, protecting the set of extents of the storage volume before determining occurrence of a large sequential write IO operation on the set of extents of the storage volume that was the subject of the large sequential read IO operation;
after protecting the set of extents of the storage volume, monitoring for occurrence of the subsequent large sequential write IO operation on the set of extents of the storage volume that was the subject of the large sequential read IO operation;
determining, by the ransomware activity detection system, historic data reducibility characteristics of data contained in the extents of the storage volume;
comparing, by the ransomware activity detection system, current data reducibility characteristics of data contained in the extents of the storage volume with the historic data characteristics of the data contained in the set of extents of the storage volume; and
detecting occurrence of the ransomware attack on the storage volume by the ransomware activity detection system where:
the large sequential read IO operation on the set of extents of the storage volume is followed by occurrence of the large sequential write IO operation on the set of extents of the storage volume;
the current read and write IO activity characteristics of the extents of the storage volume are significantly different than the historic read and write IO activity characteristics of the extents of the storage volume; and
the current data reducibility characteristics of data contained in the set of extents of the storage volume that was the subject of the large sequential read IO operation are significantly different than the historic data reducibility characteristics of data contained in the set of extents of the storage volume that was the subject of the large sequential read IO operation.
2. The non-transitory tangible computer readable storage medium of claim 1 , wherein the read and write IO activity characteristics comprise a sequentiality characteristic of read and write IO activity;
wherein a historic sequentiality characteristic quantifies how often read and write IO activity on the storage volume previously occurred to sequential extents of the storage volume; and
wherein a current sequentiality characteristic quantifies whether current read and write IO activity is occurring on sequential extents of the storage volume.
3. The non-transitory tangible computer readable storage medium of claim 1 , wherein the read and write IO activity characteristics comprise a continuity characteristic of read and write IO activity;
wherein a historic continuity characteristic quantifies how often read and write IO activity on the storage volume previously occurred in a continuous manner on extents of the storage volume; and
wherein a current continuity characteristic quantifies whether the current read and write IO activity is occurring on extents of the storage volume in a continuous manner.
4. The non-transitory tangible computer readable storage medium of claim 1 , wherein the read and write IO activity characteristics comprise a read and write pattern characteristic of read and write IO activity on individual extents of the storage volume;
wherein a historic read and write pattern characteristic quantifies how often read operations on particular extents of the storage volume are coupled with subsequent write operations on the particular extents of the storage volume; and
wherein a current read and write pattern characteristic quantifies how often read operations on the particular extents of the storage volume are currently coupled with subsequent write operations on the particular extents of the storage volume.
5. The non-transitory tangible computer readable storage medium of claim 1 , further comprising determining an age of the data contained in the set of extents of the storage volume that was the subject of the large sequential read IO operation.
6. The non-transitory tangible computer readable storage medium of claim 1 , wherein the data reducibility characteristics comprise an amount of unreducible data per GB of application data stored in the storage volume.
7. The non-transitory tangible computer readable storage medium of claim 1 , wherein the data reducibility characteristics comprise a rate of change of an amount of unreducible data per GB of application data stored in the storage volume.
8. A method of detecting existence of a ransomware attack on a storage volume, comprising:
determining historic read and write Input/Output (IO) activity characteristics of extents of the storage volume by a ransomware activity detection system implemented in a data services layer of a storage system operating system, the data service layer being part of the storage system operating system that manages physical storage and retrieval of data on the physical storage;
comparing, by the ransomware activity detection system, current read and write IO activity characteristics of the extents of the storage volume with the historic read and write IO activity characteristics of the extents of the storage volume;
determining occurrence of a large sequential read IO operation on a set of extents of the storage volume;
in response to determining occurrence of the large sequential read IO operation, protecting the set of extents of the storage volume before determining occurrence of a large sequential write IO operation on the set of extents of the storage volume that was the subject of the large sequential read IO operation;
after protecting the set of extents of the storage volume, monitoring for occurrence of the subsequent large sequential write IO operation on the set of extents of the storage volume that was the subject of the large sequential read IO operation;
determining, by the ransomware activity detection system, historic data reducibility characteristics of data contained in the extents of the storage volume;
comparing, by the ransomware activity detection system, current data reducibility characteristics of data contained in the extents of the storage volume with the historic data characteristics of the data contained in the set of extents of the storage volume; and
detecting occurrence of the ransomware attack on the storage volume by the ransomware activity detection system where:
the large sequential read IO operation on the set of extents of the storage volume is followed by occurrence of the large sequential write IO operation on the set of extents of the storage volume;
the current read and write IO activity characteristics of the extents of the storage volume are significantly different than the historic read and write IO activity characteristics of the extents of the storage volume; and
the current data reducibility characteristics of data contained in the set of extents of the storage volume that was the subject of the large sequential read IO operation are significantly different than the historic data reducibility characteristics of data contained in the set of extents of the storage volume that was the subject of the large sequential read IO operation.
9. The method of claim 8 , wherein the read and write IO activity characteristics comprise a sequentiality characteristic of read and write IO activity;
wherein a historic sequentiality characteristic quantifies how often read and write IO activity on the storage volume previously occurred to sequential extents of the storage volume; and
wherein a current sequentiality characteristic quantifies whether current read and write IO activity is occurring on sequential extents of the storage volume.
10. The method of claim 8 , wherein the read and write IO activity characteristics comprise a continuity characteristic of read and write IO activity;
wherein a historic continuity characteristic quantifies how often read and write IO activity on the storage volume previously occurred in a continuous manner on extents of the storage volume; and
wherein a current continuity characteristic quantifies whether the current read and write IO activity is occurring on extents of the storage volume in a continuous manner.
11. The method of claim 8 , wherein the read and write IO activity characteristics comprise a read and write pattern characteristic of read and write IO activity on individual extents of the storage volume;
wherein a historic read and write pattern characteristic quantifies how often read operations on particular extents of the storage volume are coupled with subsequent write operations on the particular extents of the storage volume; and
wherein a current read and write pattern characteristic quantifies how often read operations on the particular extents of the storage volume are currently coupled with subsequent write operations on the particular extents of the storage volume.
12. The method of claim 8 , further comprising determining an age of the data contained in the set of extents of the storage volume that was the subject of the large sequential read IO operation; and
wherein the data reducibility characteristics comprise an amount of unreducible data per GB of application data stored in the storage volume or an amount of unreducible data per GB of application data stored in the storage volume.