Cyber resilience

Ransomware threat detection

Ransomware threat detection is a process that identifies and responds to security threats before they can damage data or systems.

Ransomware threat detection uses information theory concepts such as Shannon Entropy and other statistics to characterize the current workload. This type of analysis requires byte-by-byte processing and is computationally expensive.

FlashCore Module (FCM) drives provide computational storage offload to compute and summarize these statistics, which the FlashSystem aggregates and analyzes to notify Storage Insights of a potential threat. With drives that run FCM 4.1 firmware or later, statistics about data are processed within the FCM drives, and presented to the FlashSystem on a per volume basis. This is collected on a regular basis, and aggregated across all participating drives, resulting in a set of statistics per volume. These statistics are then processed on the system to determine its threat potential.