Issuing alerts for storage volumes using machine learning

Patent metadata

Field	Value
Publication number	US-11620524-B2
Application number	US-202217837125-A
Country	US
Kind code	B2
Filing date	Jun 10, 2022
Priority date	Feb 1, 2019
Publication date	Apr 4, 2023
Grant date	Apr 4, 2023

Abstract

A method is used in issuing alerts for storage volumes using machine learning. A machine learning system analyzes Input/Output (I/O) data of a storage volume in a data storage system. The machine learning system is trained with sample I/O data patterns associated with the storage volume. Based on the I/O data, the machine learning system identifies atypical behavior associated with I/O data patterns of the I/O data. The method then issues an alert.

First claim

What is claimed is:

1. A method of issuing alerts for storage volumes using machine learning, the method comprising:
analyzing, by a machine learning system, Input/Output (I/O) data of a storage volume in a data storage system, wherein the machine learning system is trained with sample I/O data patterns associated with the storage volume;
based on the I/O data, identifying, by the machine learning system, atypical behavior associated with I/O data patterns of the I/O data, wherein the identifying comprises identifying that the I/O data cannot be deduplicated; and
issuing an alert.

2. The method of claim 1 , further comprising:
training the machine learning system by analyzing the sample I/O data patterns over a period of time; and
maintaining a plurality of counters associated with the sample I/O data patterns.

3. The method of claim 2 , further comprising:
determining a respective threshold for each of the plurality of counters associated with the sample I/O data patterns, wherein the respective threshold indicates the atypical behavior.

4. The method of claim 2 , wherein the plurality of counters comprises a plurality of read counters and a plurality of write counters associated with the sample I/O data patterns.

5. The method of claim 2 , wherein a respective plurality of counters is maintained for each period of time.

6. The method of claim 2 , wherein maintaining the plurality of counters associated with the sample I/O data patterns comprises:
maintaining the plurality of counters for an address range within the storage volume.

7. The method of claim 1 , further comprising:
updating the machine learning system with the I/O data patterns identified by the analysis of the I/O data of the storage volume.

8. The method of claim 1 , further comprising:
determining that the I/O data patterns that triggered the alert do not indicate atypical behavior; and
updating the machine learning system with the I/O data patterns that triggered the alert.

9. The method of claim 1 , wherein analyzing, by the machine learning system, I/O data of the storage volume in the data storage system comprises:
maintaining at least one of read counters and write counters associated with the I/O data of the storage volume; and
comparing the at least one of read counters and write counters associated with the I/O data of the storage volume with a plurality of read counters and a plurality of write counters associated with the sample I/O data patterns.

10. The method of claim 9 , further comprising:
identifying that the at least one of read counters and write counters associated with the I/O data of the storage volume exceeds a threshold associated with the plurality of read counters and the plurality of write counters associated with the sample I/O data patterns, wherein the exceeding the threshold indicates the atypical behavior associated with the I/O data patterns of the I/O data.

11. The method of claim 1 , where analyzing, by the machine learning system, I/O data of the storage volume in the data storage system comprises:
detecting a change in the I/O patterns associated with the I/O data; and
comparing the change in the I/O data patterns with the sample I/O data patterns associated with the storage volume.

12. The method of claim 1 , wherein identifying, by the machine learning system, atypical behavior associated with the I/O data patterns of the I/O data comprises:
detecting a change in the I/O data patterns of the I/O data; and
determining that the change in the I/O data patterns indicates that the atypical behavior is indicative of a security risk.

13. The method of claim 1 , wherein I/O data associated with a second storage volume is analyzed using the machine learning system that analyzed the storage volume.

14. The method of claim 13 , further comprising:
updating the machine learning system with I/O data patterns identified by the analysis of the I/O data of the second storage volume.

15. The method of claim 1 , wherein the machine learning system is a convolutional neural network.

16. The method of claim 1 , further comprising:
obtaining at least one snapshot of the volume.

17. The method of claim 1 , further comprising:
providing, by the machines learning system, accumulated data to a graphical user interface for presentation to a user.

18. The method of claim 17 further comprising:
rendering I/O data pattern trends on the graphical user interface using the accumulated data.

19. A system for use in issuing alerts for storage volumes using machine learning, the system comprising a processor configured to:
analyze, by a machine learning system, Input/Output (I/O) data of a storage volume in a data storage system, wherein the machine learning system is trained with sample I/O data patterns associated with the storage volume;
based on the I/O data, identify, by the machine learning system, atypical behavior associated with I/O data patterns of the I/O data, wherein the identifying comprises identifying that the I/O data cannot be deduplicated; and
issue an alert.

20. A non-transitory computer readable storage medium having computer executable program code embodied therewith, the program code executable by a computer processor to:
analyze, by a machine learning system, Input/Output (I/O) data of a storage volume in a data storage system, wherein the machine learning system is trained with sample I/O data patterns associated with the storage volume;
based on the I/O data, identify, by the machine learning system, atypical behavior associated with I/O data patterns of the I/O data, wherein the identifying comprises identifying that the I/O data cannot be deduplicated; and
issue an alert.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Meiri David
• Kucherov Anton

Classifications

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G08B21/18

  Status alarms (G08B21/02 takes precedence) · CPC title

• G06N3/08 Primary

  Learning methods · CPC title

• G06N20/00

  Machine learning · CPC title