| CPC G06F 21/577 (2013.01) [G06F 21/564 (2013.01)] | 20 Claims |

|
1. A method of detecting a security threat in a storage system using a machine learning (ML) model, comprising:
obtaining a sub-slice of sampled data by performing early sampling of a slice of successive input/output (IO) or non-IO operations directed to a storage object maintained on a storage device of a storage system;
generating a plurality of features based on the sub-slice of sampled data;
processing the plurality of features using an ML model;
generating a probability score for the sub-slice of sampled data based on an output of the ML model;
determining that the probability score falls within a range of overlap of continuous variable distributions for a benign class of data and a threat class of data;
in response to the probability score falling above a specified threshold within the range of overlap, comparing a class signature of the sub-slice of sampled data with a class signature of the threat class of data to determine a similarity between the respective class signatures; and
in response to the similarity between the respective class signatures exceeding a predetermined similarity level, assigning a “threat” class label to the probability score, and performing a remedial action on the storage system to address a perceived security threat involving the storage object.
|