Using decoy datasets for cyber threat detection
A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.
1. A method comprising:
in a storage array with processors, volatile memory and managed disk drives that are not discoverable by host servers, deploying at least one decoy dataset together with real active data on at least one storage object of a plurality of storage objects maintained by a storage node on the managed disk drives, the storage object being accessed by the host servers as a single disk drive and being uniquely associated with a single host application running on the host servers and discoverable by the host servers;
detecting a remote cyber-attack originating from an instance of the single host application running on a compromised one of the servers based on receipt of an input-output (IO) command from that instance of the host application to access a logical block address at which decoy data of the decoy dataset is stored on the storage object; and
automatically performing at least one action to protect real data in response to detection of the cyber-attack.
2. The method of claim 1 further comprising deploying a first decoy dataset at a first range of logical block addresses starting at a first logical block address of the storage object and storing a real active dataset at a second range of logical block addresses adjacent to the first range of logical block addresses.
3. The method of claim 2 further comprising deploying a third decoy dataset at a third range of logical block addresses that includes a last logical block address of the storage object and is adjacent to the second range of logical block addresses.
4. The method of claim 1 further comprising maintaining an IO access bitmap of the storage object and detecting the cyber-attack based on receipt of an IO command that sets a bit associated with a logical block address at which decoy data is stored on the storage object.
5. The method of claim 1 further comprising calculating a digital signature of the decoy dataset and detecting the cyber-attack based on receipt of an IO command that changes the digital signature of the decoy dataset.
6. The method of claim 1 further comprising remotely replicating the storage object and detecting the cyber-attack based on receipt of an IO command that prompts replication of decoy data.
7. The method of claim 1 further comprising automatically performing at least one action to protect real data in response to detection of the cyber-attack selected from the group comprising:
creating a new targetless snapshot of the storage object;
locking-down the storage object; and
halting remote replication of the storage object.
8. A non-transitory computer-readable storage medium storing instructions that are executed by a computer to perform a method comprising:
in a storage array with processors, volatile memory and managed disk drives that are not discoverable by host servers, deploying at least one decoy dataset together with real active data on at least one storage object of a plurality of storage objects maintained by a storage node on the managed disk drives, the storage object being accessed by the host servers as a single disk drive and being uniquely associated with a single host application running on the host servers and discoverable by the host servers;
detecting a remote cyber-attack originating from an instance of the single host application running on a compromised one of the servers based on receipt of an input-output (IO) command from that instance of the host application to access a logical block address at which decoy data of the decoy dataset is stored on the storage object; and
automatically performing at least one action to protect real data in response to detection of the cyber-attack.
9. The non-transitory computer-readable storage medium of claim 8 further comprising deploying a first decoy dataset at a first range of logical block addresses starting at a first logical block address of the storage object and storing a real active dataset at a second range of logical block addresses adjacent to the first range of logical block addresses.
10. The non-transitory computer-readable storage medium of claim 9 further comprising deploying a third decoy dataset at a third range of logical block addresses that includes a last logical block address of the storage object and is adjacent to the second range of logical block addresses.
11. The non-transitory computer-readable storage medium of claim 8 further comprising maintaining an IO access bitmap of the storage object and detecting the cyber-attack based on receipt of an IO command that sets a bit associated with a logical block address at which decoy data is stored on the storage object.
12. The non-transitory computer-readable storage medium of claim 8 further comprising calculating a digital signature of the decoy dataset and detecting the cyber-attack based on receipt of an IO command that changes the digital signature of the decoy dataset.
13. The non-transitory computer-readable storage medium of claim 8 further comprising remotely replicating the storage object and detecting the cyber-attack based on receipt of an IO command that prompts replication of decoy data.
14. The non-transitory computer-readable storage medium of claim 8 further comprising automatically performing at least one action to protect real data in response to detection of the cyber-attack selected from the group comprising:
creating a new targetless snapshot of the storage object;
locking-down the storage object; and
halting remote replication of the storage object.
15. An apparatus comprising:
a storage node comprising non-volatile storage and at least one compute node with a processor and memory drives that are not discoverable by host servers, the storage node configured to deploy at least one decoy dataset together with real active data on at least one storage object of a plurality of storage objects maintained on the non-volatile storage, the storage object being accessed by the host servers as a single disk drive and being uniquely associated with a single host application running on the host servers and discoverable by the host servers, detect a remote cyber-attack originating from an instance of the single host application running on a compromised one of the servers based on receipt of an input-output (IO) command from that instance of the host application to access a logical block address at which decoy data of the decoy dataset is stored on the storage object, and automatically perform at least one action to protect real data in response to detection of the cyber-attack.
16. The apparatus of claim 15 further comprising a first decoy dataset deployed at a first range of logical block addresses starting at a first logical block address of the storage object and a real active dataset stored at a second range of logical block addresses adjacent to the first range of logical block addresses.
17. The apparatus of claim 16 further comprising a third decoy dataset deployed at a third range of logical block addresses that includes a last logical block address of the storage object and is adjacent to the second range of logical block addresses.
18. The apparatus of claim 15 further comprising an IO access bitmap of the storage object used to detect the cyber-attack based on receipt of an IO command that sets a bit associated with a logical block address at which decoy data is stored on the storage object.
19. The apparatus of claim 15 further comprising the compute node configured to calculate a digital signature of the decoy dataset and detect the cyber-attack based on receipt of an IO command that changes the digital signature of the decoy dataset.
20. The apparatus of claim 15 further comprising the storage object being remotely replicated and the compute node configured to detect the cyber-attack based on receipt of an IO command that prompts replication of decoy data.