US 11,720,714 B2
Inter-I/O relationship based detection of a security threat to a storage system
Ethan L. Miller, Santa Cruz, CA (US); Ronald Karr, Palo Alto, CA (US); Alexandre Xavier Duchâteau, Bellevue, WA (US); and Constantine P Sapuntzakis, Palo Alto, CA (US)
Assigned to Pure Storage, Inc., Santa Clara, CA (US)
Filed by Pure Storage, Inc., Mountain View, CA (US)
Filed on Sep. 30, 2020, as Appl. No. 17/39,556.
Application 17/039,556 is a continuation in part of application No. 16/711,060, filed on Dec. 11, 2019, abandoned.
Claims priority of provisional application 62/985,229, filed on Mar. 4, 2020.
Claims priority of provisional application 62/939,518, filed on Nov. 22, 2019.
Prior Publication US 2021/0216666 A1, Jul. 15, 2021
Int. Cl. G06F 21/78 (2013.01); G06F 3/06 (2006.01); G06F 21/56 (2013.01); G06F 21/57 (2013.01)
CPC G06F 21/78 (2013.01) [G06F 3/0604 (2013.01); G06F 3/067 (2013.01); G06F 3/0622 (2013.01); G06F 3/0653 (2013.01); G06F 3/0659 (2013.01); G06F 21/566 (2013.01); G06F 21/577 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method comprising:
determining, by a data protection system, that a total amount of read traffic and write traffic processed by a storage system during a time period exceeds a threshold;
determining, by the data protection system, a first compressibility metric associated with the write traffic, the first compressibility metric indicating an amount of storage space saved if the write traffic is compressed;
determining, by the data protection system, a second compressibility metric associated with the read traffic, the second compressibility metric indicating an amount of storage space saved if the read traffic is compressed;
determining, by the data protection system based on a comparison of the first compressibility metric with the second compressibility metric, that the write traffic is less compressible than the read traffic;
identifying, by the data protection system, an anomaly in a relationship between one or more input operations and one or more output operations performed between a source and the storage system; and
determining, by the data protection system based on the identifying of the anomaly and based on the total amount of read traffic and write traffic exceeding the threshold and based on the write traffic being less compressible than the read traffic, that the storage system is possibly being targeted by a security threat.