Issuing alerts for storage volumes using machine learning

Patent metadata

Field	Value
Publication number	US-11449749-B2
Application number	US-201916264828-A
Country	US
Kind code	B2
Filing date	Feb 1, 2019
Priority date	Feb 1, 2019
Publication date	Sep 20, 2022
Grant date	Sep 20, 2022

Abstract

A method is used in issuing alerts for storage volumes using machine learning. A machine learning system analyzes Input/Output (I/O) data of a storage volume in a data storage system. The machine learning system is trained with sample I/O data patterns associated with the storage volume. Based on the I/O data, the machine learning system identifies atypical behavior associated with I/O data patterns of the I/O data. The method then issues an alert.

First claim

What is claimed is:

1. A method of issuing alerts for storage volumes using machine learning, the method comprising: analyzing, by a machine learning system, Input/Output (I/O) data of a storage volume in a data storage system, wherein the machine learning system is trained with sample I/O data patterns associated with the storage volume; based on the I/O data, identifying, by the machine learning system, atypical behavior associated with I/O data patterns of the I/O data; and issuing an alert; wherein identifying, by the machine learning system, atypical behavior associated with the I/O data patterns of the I/O data comprises: identifying a change in a compression ratio associated with the I/O data.

2. The method of claim 1 , further comprising:
training the machine learning system by analyzing the sample I/O data patterns over a period of time; and
maintaining a plurality of counters associated with the sample I/O data patterns.

3. The method of claim 2 , further comprising:
determining a respective threshold for each of the plurality of counters associated with the sample I/O data patterns, wherein the respective threshold indicates the atypical behavior.

4. The method of claim 2 , wherein the plurality of counters comprises a plurality of read counters and a plurality of write counters associated with the sample I/O data patterns.

5. The method of claim 2 , wherein a respective plurality of counters is maintained for each period of time.

6. The method of claim 2 , wherein maintaining the plurality of counters associated with the sample I/O data patterns comprises:
maintaining the plurality of counters for an address range within the storage volume.

7. The method of claim 1 , further comprising:
updating the machine learning system with the I/O data patterns identified by the analysis of the I/O data of the storage volume.

8. The method of claim 1 , further comprising:
determining that the I/O data patterns that triggered the alert do not indicate atypical behavior; and
updating the machine learning system with the I/O data patterns that triggered the alert.

9. The method of claim 1 , wherein analyzing, by the machine learning system, I/O data of the storage volume in the data storage system comprises:
maintaining at least one of read counters and write counters associated with the I/O data of the storage volume; and
comparing the at least one of read counters and write counters associated with the I/O data of the storage volume with a plurality of read counters and a plurality of write counters associated with the sample I/O data patterns.

10. The method of claim 9 , further comprising:
identifying that the at least one of read counters and write counters associated with the I/O data of the storage volume exceeds a threshold associated with the plurality of read counters and the plurality of write counters associated with the sample I/O data patterns, wherein the exceeding the threshold indicates the atypical behavior associated with the I/O data patterns of the I/O data.

11. The method of claim 1 , where analyzing, by the machine learning system, I/O data of the storage volume in the data storage system comprises:
detecting a change in the I/O patterns associated with the I/O data; and
comparing the change in the I/O data patterns with the sample I/O data patterns associated with the storage volume.

12. The method of claim 1 , wherein identifying, by the machine learning system, atypical behavior associated with the I/O data patterns of the I/O data comprises:
detecting a change in the I/O data patterns of the I/O data; and
determining that the change in the I/O data patterns indicates that the atypical behavior is indicative of a security risk.

13. The method of claim 1 , wherein I/O data associated with a second storage volume is analyzed using the machine learning system that analyzed the storage volume.

14. The method of claim 13 , further comprising:
updating the machine learning system with I/O data patterns identified by the analysis of the I/O data of the second storage volume.

15. The method of claim 1 , wherein the machine learning system is a convolutional neural network.

16. The method of claim 1 , wherein identifying, by the machine learning system, atypical behavior associated with the I/O data patterns of the I/O data comprises:
identifying that the I/O data cannot be deduplicated.

17. The method of claim 1 , further comprising:
obtaining at least one snapshot of the volume.

18. A system for use in issuing alerts for storage volumes using machine learning the system comprising a processor configured to: analyze by a machine learning system, Input/Output (I/O) data of a storage volume in a data storage system wherein the machine learning system is trained with sample I/O data patterns associated with the storage volume; based on the I/O data, identify, by the machine learning system, atypical behavior associated with I/O data patterns of the I/O data; and issue an alert; wherein identifying, by the machine learning system, atypical behavior associated with the I/O data patterns of the I/O data comprises: identifying a change in a compression ratio associated with the I/O data.

19. A non-transitory computer readable storage medium having computer executable program code embodied therewith, the program code executable by a computer processor to: analyze, by a machine learning system, Input/Output (I/O) data of a storage volume in a data storage system, wherein the machine learning system is trained with sample I/O data patterns associated with the storage volume; based on the I/O data, identify, by the machine learning system, atypical behavior associated with I/O data patterns of the I/O data; and issue an alert; wherein identifying, by the machine learning system, atypical behavior associated with the I/O data patterns of the I/O data comprises: identifying a change in a compression ratio associated with the 1/0 data.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Meiri David
• Kucherov Anton

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/08 Primary

  Learning methods · CPC title

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06F21/554

  involving event detection and direct action · CPC title