DETECTION OF RANSOMWARE ATTACK USING ENTROPY VALUES

    公开(公告)号:US20240143761A1

    公开(公告)日:2024-05-02

    申请号:US18051110

    申请日:2022-10-31

    CPC classification number: G06F21/566 G06F17/18 G06F2221/033

    Abstract: Example implementations relate to storing data in a storage system. An example includes accessing a first portion of a data stream to be stored in a storage system; selecting sample data blocks included in the first portion; determining entropy values based on the sample data blocks; selecting, based on the sample data blocks, a entropy threshold from multiple precalculated entropy thresholds; determining whether the generated set of entropy values matches the selected entropy threshold within a probability level; and in response to a determination that the generated set of entropy values matches the selected entropy threshold within the probability level, identifying the first portion of the data stream as potentially including encrypted data affected by a ransomware attack.

    LOCK-FREE WORK-STEALING THREAD SCHEDULER

    公开(公告)号:US20220066831A1

    公开(公告)日:2022-03-03

    申请号:US17008549

    申请日:2020-08-31

    Abstract: Systems and methods are provided for lock-free thread scheduling. Threads may be placed in a ring buffer shared by all computer processing units (CPUs), e.g., in a node. A thread assigned to a CPU may be placed in the CPU's local run queue. However, when a CPU's local run queue is cleared, that CPU checks the shared ring buffer to determine if any threads are waiting to run on that CPU, and if so, the CPU pulls a batch of threads related to that ready-to-run thread to execute. If not, an idle CPU randomly selects another CPU to steak threads from, and the idle CPU attempts to dequeue a thread batch associated with the CPU from the shared ring buffer. Polling may be handled through the use of a shared poller array to dynamically distribute polling across multiple CPUs.

    Unauthorized data encryption detection

    公开(公告)号:US12061695B2

    公开(公告)日:2024-08-13

    申请号:US17661069

    申请日:2022-04-28

    CPC classification number: G06F21/554 G06F21/561 G06F2221/034

    Abstract: In some examples, a storage system creates a first copy of a data volume, and receives write requests having a specified characteristic from a host system, the write requests to write data of the data volume, where the storage system is to reject the write requests having the specified characteristic and to accept write requests without the specified characteristic. The storage system maintains metadata for the first copy of the data volume, the metadata indicating blocks of the data volume that have changed since the first copy of the data volume was created. The storage system determines, using the metadata, whether an unauthorized data encryption of the data of the data volume has occurred.

    OPERATIONAL FEATURE ACTIVATION/DISABLING

    公开(公告)号:US20230070722A1

    公开(公告)日:2023-03-09

    申请号:US17447104

    申请日:2021-09-08

    Abstract: In some examples, a computer system computes a rate of operations that involves a first system, and classifies, using a classifier, a request for an operation. The computer system determines a relationship between the computed rate of operations and a dynamic threshold rate determined during a training phase, and based on the determined relationship and a classification of the request by the classifier, selectively activates or disables an operational feature of the first system.

Patent Agency Ranking