JP7670307B2 - Storage Device - Google Patents

Description

The present invention relates to a storage device, a tamper detection method, and a program.

There are known methods for detecting unauthorized access such as data tampering.

For example, Patent Document 1 describes an unauthorized access prevention control device that includes a kernel space and an AP space. According to Patent Document 1, in the kernel space, events executed by the OS are monitored based on a monitoring event definition table that defines events that are signs of unauthorized access, and if an event that is a sign of unauthorized access occurs, a notification is sent to the AP space. Also, in the AP space, there is provided an unauthorized access detection means that detects unauthorized access, and a software control unit that receives a notification from the kernel space and executes the unauthorized access detection means. This configuration makes it possible to detect unauthorized access in real time while suppressing performance degradation, etc.

JP 2006-65835 A International Publication No. 2012/101983

One method for protecting data from tampering is not only to detect unauthorized access, but also to use backup software to regularly back up data, and if tampering is detected, to retrieve and restore the data from past backup data. However, when using this method, if the backup data is tampered with at the same time as the original data, there is no way to restore the data. Another method is to replicate the backup data. However, even with this method, there is a risk that the tampered data will be replicated, making restoration impossible.

As such, there has been an issue that it is difficult to accurately detect data tampering. Therefore, the purpose of this disclosure is to provide a storage device, a tampering detection method, and a program that solve the issue that it is sometimes difficult to accurately detect data tampering.

In order to achieve this object, a storage device according to one embodiment of the present disclosure comprises:
A collection unit that collects I/O pattern information, which is information corresponding to an operation when performing a backup process;
a detection unit that detects tampering with data to be backed up based on the I/O pattern information collected by the collection unit;
The configuration has the following:

In addition, a tamper detection method according to another embodiment of the present disclosure includes:
An information processing device,
Collect I/O pattern information, which is information corresponding to the operation when performing backup processing;
The system is configured to detect any tampering with the data to be backed up based on the collected I/O pattern information.

In addition, a program according to another aspect of the present disclosure includes:
In the information processing device,
Collect I/O pattern information, which is information corresponding to the operation when performing backup processing;
This is a program for implementing a process for detecting tampering with data to be backed up based on the collected I/O pattern information.

The above-mentioned configurations make it possible to accurately detect data tampering.

FIG. 2 is a diagram illustrating an example of the configuration of a storage device and a client device according to the first embodiment of the present disclosure. 11 is a diagram illustrating an example of I/O pattern information collected by an I/O pattern collection unit; FIG. 13 is a diagram illustrating an example of an algorithm for detecting tampering by a data analysis unit. FIG. 13 is a diagram for explaining an example of tamper detection. 11 is a flowchart illustrating an example of an operation performed by the storage device when detecting tampering. FIG. 11 is a diagram illustrating another example of processing by the storage device. FIG. 11 is a diagram illustrating an example of a hardware configuration of a storage apparatus according to a second embodiment of the present disclosure. FIG. 2 is a block diagram showing a configuration example of a storage device.

[First embodiment]
A first embodiment of the present disclosure will be described with reference to Figs. 1 to 6. Fig. 1 is a block diagram showing an example of the configuration of a storage device 100 and a client device 200. Fig. 2 is a diagram showing an example of I/O pattern information collected by the I/O pattern collection unit 110. Fig. 3 is a diagram showing an example of a tampering detection algorithm by the data analysis unit 120. Fig. 4 is a diagram for explaining an example of tampering detection. Fig. 5 is a flowchart showing an example of an operation when the storage device 100 detects tampering. Fig. 6 is a diagram for explaining another example of processing by the storage device 100.

In the first embodiment of the present disclosure, a storage device 100 that performs backup processing to receive and store data to be backed up from a client device 200 will be described. As will be described later, the storage device 100 collects I/O pattern information, which is information corresponding to operations when performing backup processing, in response to receiving data to be backed up from the client device 200, etc. Then, the storage device 100 detects tampering with the data to be backed up, etc., based on the collected I/O pattern information. I/O by the backup software 210 often follows a fixed pattern for each software. The storage device 100 can detect tampering by focusing on the above patterns.

As described below, the I/O pattern information may include information extracted (collected) within the storage device 100 and information collected by the collection unit 220 operating within the client device 200. The I/O pattern information may include only one of the information extracted within the storage device 100 and the information collected by the collection unit 220 operating within the client device 200.

Furthermore, before performing the backup process, the storage device 100 can create a snapshot of the file system before the update, triggered by receiving the data to be backed up. Then, if tampering is detected, the storage device 100 can notify the user, etc., that tampering has been detected without restricting the I/O by the backup. For example, if the data to be backed up is increased or decreased, or if the backup software 210 is updated, the I/O pattern may change. By detecting tampering while not causing the backup to fail, it is possible to deal with the above-mentioned cases. Note that, particularly in a CAS (Contents Addressed Storage) device, by using a method such as that described in Patent Document 2, a snapshot can be created without affecting the I/O performance of the user. Therefore, a snapshot may be created using a method such as that described in Patent Document 2.

Figure 1 shows an example of the overall configuration. As shown in Figure 1, the storage device 100 is connected to a client device 200 so that they can communicate with each other. The storage device 100 receives data to be backed up and I/O pattern information collected by the client device 200 from the client device 200.

Referring to FIG. 1, the storage device 100 includes an I/O pattern collection unit 110, a data analysis unit 120, a control unit 130, a reporting unit 140, and a storage device 150, in addition to the configuration used during backup processing.

For example, the storage device 100 has a calculation device such as a CPU and a storage device such as the storage device 150. For example, the storage device 100 can realize each of the above-mentioned processing units by the calculation device executing a program stored in a storage device such as the storage device 150. The storage device 100 may realize each of the above-mentioned processing units by hardware or a combination of hardware and software.

The I/O pattern collection unit 110 collects I/O pattern information, which is information according to operations when performing backup processing. For example, when the I/O pattern collection unit 110 receives data to be backed up or I/O pattern information collected by the client device 200 from the client device 200, the I/O pattern collection unit 110 starts collecting I/O pattern information. Then, the I/O pattern collection unit 110 stores the collected I/O pattern information in the storage device 150.

The I/O pattern collection unit 110 collects I/O pattern information by receiving information from a collection unit 220 included in the client device 200, acquiring information from within the storage device 100, or the like. For example, referring to Fig. 2, the I/O pattern collection unit 110 collects I/O pattern information including at least some of the following examples.
IP address of the client device 200, network routing information, memory and CPU usage, software log of the backup software 210, setting parameters, frequency and amount of file creation, writing to files, reading, etc., execution time, file name, read and write execution performance, start position of read and write, data size, data characteristics (compressibility rate, duplicate data inclusion rate, etc.)
Memory, CPU usage, and resource allocation ratio in the storage device 100 Among the above-mentioned information, at least some of the IP address and network routing information of the client device 200, memory and CPU usage, software log of the backup software 210, and setting parameters can be collected, for example, by receiving information from the collection unit 220. In addition, at least some of the file creation, frequency and amount of writing to and reading from a file, execution time, file name, execution performance of reading and writing, starting position of reading and writing, data size, data characteristics (compressibility rate, duplicate data inclusion rate, etc.), memory and CPU usage in the storage device, etc. can be collected, for example, by acquiring information from within the storage device 100.

The I/O pattern collection unit 110 may be configured to delete the I/O pattern information stored in the storage device 150 according to a predetermined condition. For example, the I/O pattern collection unit 110 may be configured to leave a predetermined number of backups of I/O pattern information in the storage device 150 and delete the oldest information in order. The number of times that serves as the basis for deletion can be determined according to the amount of data required to detect tampering, such as the number of times required to calculate an average value or a standard deviation, or as input data for machine learning. The I/O pattern collection unit 110 may be configured to perform the above deletion at any timing.

The I/O pattern collection unit 110 may be configured to start collecting I/O pattern information and to instruct the control unit 130 to create a snapshot of the file system. The I/O pattern collection unit 110 may be configured to instruct the control unit 130 to delete the snapshot created before the backup process if no tampering is detected at the time the backup process is completed.

The data analysis unit 120 detects tampering with the data to be backed up based on the I/O pattern information collected by the I/O pattern collection unit 110. In other words, the data analysis unit 120 functions as a detection unit that detects tampering with the data to be backed up based on the I/O pattern information.

For example, the data analysis unit 120 can detect tampering by comparing the past I/O pattern information stored by the I/O pattern collection unit 110 with the I/O pattern information to be the target of tamper detection, by using the results of machine learning based on the past I/O pattern information, or by other methods. In other words, the data analysis unit 120 detects tampering when, for example, there is a difference between the past I/O pattern information and the I/O pattern information to be the target of tamper detection, when it digitizes data indicated by the past I/O pattern information, and when an AI that has been trained to learn machine learning using the digitized data as input determines that there is a possibility of tampering.

Figure 3 shows an example of an algorithm used by the data analysis unit 120 to detect tampering. For example, referring to Figure 3, the algorithms used to detect tampering include detection based on a policy, detection of fraud that cannot be defined by the user using principal component analysis or k-nearest neighbors, etc.

For example, as an example of detection based on a policy, the data analysis unit 120 can detect tampering based on predetermined characteristic information. For example, characteristic information such as "unchanging due to backup" or "having a certain regularity" can be predefined for each piece of information included in the I/O pattern information. Then, the data analysis unit 120 can detect tampering when the I/O pattern information to be detected includes information that deviates from the predefined characteristic information. Note that the characteristic information may be other than the examples given above.

As an example, characteristic information such as "unchanging due to backup" and "having a certain regularity" can be defined in advance for the following information among the I/O pattern information. Characteristic information may be added to information other than the following examples.
- Items that do not change due to backup (presence or absence of backup log, connected client IP, backup execution time, etc.)
- Things that follow a certain pattern (file names, backup job identifiers, etc.)

For example, suppose that data to be backed up has been received, but the log of the backup software 210 has not arrived. In this case, for a backup log that has the characteristic of being "unchanged by backup," the backup log that should have arrived has not arrived. The data analysis unit 120 then determines that the I/O pattern information to be detected includes information that deviates from the predetermined characteristic information, and detects tampering. In this way, the data analysis unit 120 can detect tampering by comparing with past information using the characteristic information.

In addition, for example, the data analysis unit 120 can detect tampering using principal component analysis, as an example of detection of fraud that cannot be defined by the user. For example, the data analysis unit 120 can
A principal component analysis is performed in advance using components that can be measured and calculated from the number or amount of past I/O pattern information during one backup. Then, the data analysis unit 120 performs an analysis using a method of anomaly detection using principal component analysis. For example, when the current write, which is the I/O pattern information to be detected, deviates from the normal subspace, the data analysis unit 120 can regard it as tampering. In addition, the number or amount of I/O pattern information that can be measured and calculated during one backup includes, for example, the number of file creations, the number of file attribute updates, and the amount of data. The data analysis unit 120 may perform principal component analysis using some of the above examples, or may perform principal component analysis using information included in I/O pattern information other than the above examples. In addition, the method of anomaly detection using principal component analysis may be a known method.

The backup process by the backup software 210 is performed repeatedly and periodically with a certain logic on the same original data (including partial updates). Generally, when performing backup process, the backup software 210 embeds management data (metadata) in addition to the original data according to a certain rule. Therefore, among the I/O pattern information, consistency occurs in the following information (components). Therefore, by applying principal component analysis to at least a part of the following information, it becomes possible to detect abnormal tampering.
- The ratio of the number of files created to the number of times file attributes are changed - The upper limit of the number of files that can be written simultaneously - The timing of file creation (for example, the distribution of offset times from the start of the backup)
Ratio of the number of files created to the amount of data written Ratio of the number of small files (metadata) to the number of large files (data) Number of writes to a specific offset (e.g., the beginning of the file, 32KB, 64KB) Transition of the write offset (e.g., the average of (write offset - previous write offset - previous write size) ² )

For example, the backup software 210 is characterized by making three attribute changes to a single 2 GB file and eight attribute changes to a small management file. In the above situation, the I/O pattern information to be detected shows that only one attribute update has been made to each file. In such a case, for example, the data analysis unit 120 can detect tampering.

For example, the data analysis unit 120 can detect tampering using the results of classification using the k-nearest neighbor method, etc., as an example of detecting fraud that cannot be defined by the user. For example, the data analysis unit 120 performs machine learning (using the k-nearest neighbor method, etc.) in advance to classify past I/O pattern information that is time-series (continuous) data (write performance, CPU usage rate, deduplication rate, etc.) as feature values. Then, the data analysis unit 120 can determine that tampering has occurred when the I/O pattern information to be detected does not fall into any of the categories. Note that the time-series (continuous) data among the I/O pattern information is, for example, write performance, CPU usage rate, deduplication rate, etc. The data analysis unit 120 may perform machine learning using some of the above examples, or may perform machine learning using information included in I/O pattern information other than the above examples.

For example, some CAS storage has the characteristic that performance varies depending on whether or not the write data overlaps with data that has already been stored. In such cases, the performance graph indirectly includes information about data duplication, and expresses the characteristics of where the updated parts of the data to be backed up are located (when it is written). Therefore, by performing the classification described above, it is possible to detect tampering.

For example, as shown in FIG. 4, the write performance does not fit into any class classified by machine learning (e.g., k-nearest neighbor method) (e.g., there is a distance greater than a certain value). In such a case, the data analysis unit 120 can detect tampering.

For example, as described above, the data analysis unit 120 can detect tampering by performing various processes on the I/O pattern information. The data analysis unit 120 may detect tampering by combining the methods exemplified above, or may detect tampering by using some of the methods exemplified above.

The control unit 130 creates and deletes snapshots. In addition, when the data analysis unit 120 detects tampering, the control unit 130 instructs the reporting unit 140 to issue a specified report.

For example, the control unit 130 can create or delete snapshots in response to instructions from the I/O pattern collection unit 110. As described above, the control unit 130 may create snapshots using a method such as that described in Patent Document 2.

The reporting unit 140 reports to a pre-registered user in response to an instruction from the control unit 130. For example, in response to detection of tampering by the data analysis unit 120, the reporting unit 140 reports to the user that tampering has been detected.

The storage device 150 is a storage device that stores I/O pattern information. The storage device 150 may also store data to be backed up, snapshots created by the control unit 130, etc.

The above is an example of the configuration of the storage device 100.

The client device 200 is an information processing device that transmits data to be backed up to the storage device 100. Referring to FIG. 1, the client device 200 has, for example, an OS, and also has backup software 210 and a collection unit 220.

The backup software 210 performs backup processing by, for example, transmitting the data to be backed up to the storage device 100. The backup software 210 may be a known software.

The collection unit 220 acquires I/O pattern information that can be acquired by the client device 200 and transmits it to the storage device 100. For example, the collection unit 220 monitors the log of the backup software 210. Then, the collection unit 220 acquires I/O pattern information that can be acquired by the client device 200 when a backup is started. The collection unit 220 can transmit the acquired I/O pattern information to the storage device 100, for example, periodically.

For example, the collection unit 220 acquires IP addresses, network routing information, memory and CPU usage, and the like. The collection unit 220 also acquires the setting values of the backup software 210 through the API of the backup software 210, for example. The setting values to be acquired are, for example, predetermined. The collection unit 220 then periodically transmits the log of the backup software 210 and the acquired I/O pattern information to the storage device 100 through a network path that has been set in advance, and the like.

The collection unit 220 may send the log of the backup software 210 without processing it, or may cut out a portion of it using a pre-set parsing method and send it. When cutting out a portion of it, the collection unit 220 may set characteristic information, such as values that should be different for each backup and values that should be common, to the cut-out values. In other words, the collection unit 220 may acquire I/O pattern information and add characteristic information to the acquired I/O pattern information according to pre-set criteria.

The above is an example of the configuration of the client device 200. Next, with reference to FIG. 5, an example of the operation of the storage device 100 when detecting tampering will be described.

Referring to FIG. 5, the I/O pattern collection unit 110 starts collecting I/O pattern information and instructs the control unit 130 to create a snapshot of the file system. This causes the control unit 130 to create a snapshot before the update (step S101).

The I/O pattern collection unit 110 collects I/O pattern information. For example, the I/O pattern collection unit 110 collects I/O pattern information by receiving it from the collection unit 220 or by collecting it within the storage device 100 (step S102).

The data analysis unit 120 detects tampering with the data to be backed up based on the I/O pattern information collected by the I/O pattern collection unit 110 (step S103). For example, the data analysis unit 120 detects tampering using at least one of the following algorithms: detection by policy, detection of fraud that cannot be defined by the user using principal component analysis or k-nearest neighbor method, etc.

If no tampering is detected even after the backup process is completed (step S103, No), the data analysis unit 120 notifies the I/O pattern collection unit 110 that no tampering was detected. In response, the I/O pattern collection unit 110 notifies the control unit 130 to delete the snapshot created before the update. As a result, the control unit 130 deletes the snapshot created before the update (step S104). In this way, if the data analysis unit 120 does not detect tampering even after the backup process is completed, the control unit 130 deletes the snapshot created before the update.

On the other hand, if the data analysis unit 120 detects tampering (Yes in step S103), the data analysis unit 120 notifies the control unit 130 that tampering has been detected. In response, the control unit 130 instructs the reporting unit 140 to make a specified report. As a result, the reporting unit 140 notifies the user that tampering has been detected (S105).

In this way, the storage device 100 has an I/O pattern collection unit 110 and a data analysis unit 120. With this configuration, the data analysis unit 120 can detect tampering based on the I/O pattern information collected by the I/O pattern collection unit 110. In other words, the storage device 100 can detect tampering that has been performed without going through the backup software 210 by detecting differences in operation based on client information, particularly I/O pattern information including the log of the backup software 210. This makes it possible to accurately detect data tampering.

In addition, according to the storage device 100 described in this embodiment, tampering is detected by detecting differences in the data itself, including data size and data characteristics (compressibility rate, duplicate data inclusion rate, etc.) as I/O pattern information. Therefore, it may be possible to detect that tampered original data has been backed up. For example, a type of malware called ransomware encrypts files to prevent access to data and demands a ransom in exchange for a secret key for decryption, but the encrypted data has differences in the above-mentioned I/O pattern information compared to past data stored in the storage device 100. Therefore, according to the storage device 100 described in this embodiment, tampering can be detected without any problems in the above-mentioned cases.

Furthermore, according to the storage device 100 described in this embodiment, a snapshot is created before the update (before the backup). Then, if tampering is detected, the storage device 100 notifies the user, etc., that tampering has been detected, without restricting the I/O due to the backup. For example, if the data to be backed up is increased or decreased, or if the backup software 210 is updated, the I/O pattern may change. By detecting tampering without causing the backup to fail, it is possible to handle such cases.

Some storage devices provide a WORM (Write Once Read Many) function that prevents updates to a file for a preset period of time. The method described in this embodiment eliminates the need for a WORM function that requires a unique protocol, making it possible to detect tampering without placing restrictions on the selection of backup software 210.

The storage device 100 may be configured to perform processing for tuning performance in addition to detecting tampering based on the I/O pattern information. In other words, the I/O pattern information can also be used to improve the performance of the storage device 100. With this configuration, it is possible to automatically tune to optimal I/O performance simply by performing a certain amount of backup testing (machine learning). As a result, it is possible to reduce the effort required, for example, when building a new system or when updating the backup software 210 or the OS of the client device 200.

For example, thresholds and corresponding parameter values are set in advance for the number of files created, the amount of writing and reading to files, resource allocation ratios, and the like. Then, for example, when the value of each execution data indicated by the I/O pattern information exceeds the threshold, the data analysis unit 120 outputs the preset parameter value as a recommended value. Note that the parameter value may be, for example, a value calculated by AI or the like that has been machine-learned using I/O pattern information for a certain period stored in the storage device 150 as input. In other words, the parameters output by the data analysis unit 120 may be calculated using known technology such as deep learning.

Furthermore, when the data analysis unit 120 recommends changing parameters, the control unit 130 can change the parameters of the storage device 100 itself to values output by the data analysis unit 120, or can change or suggest parameter values on the client device 200 side. For example, the control unit 130 can be configured to change or suggest parameter values on the client device 200 side through an API, webhook, email, or the like provided by the client device 200.

For example, there are physical limitations to the resources that software can use, such as memory, CPU, and storage capacity. For this reason, it is common for resources to be allocated in advance within the software according to purpose. For example, as shown in Figure 6, in the storage device 100, it is possible to allocate an amount of memory to be used for structures that represent files, an amount of memory to be used as a buffer for written data, and an amount of memory to be used to cache read data.

It is thought that such internal resource allocations are built into the software as defaults, with the state optimized for common use cases. However, in individual cases, the resource allocations described above can become a bottleneck, leading to a decrease in performance. In addition, it is often difficult for users to understand the specifications within such software and change them by setting parameters.

The above allocation is therefore tuned based on I/O pattern information that indicates actual I/O patterns performed in the past. For example, when the memory usage rate of a file structure included in the I/O pattern information exceeds a threshold value (for example, the average number of times it has reached 100% is 3), the data analysis unit 120 outputs a predetermined parameter (for example, increase the memory allocation of the file structure by 10% and reduce the memory allocation of the read cache by 10%). For example, as described above, the data analysis unit 120 and the control unit 130 may be configured to perform processing for tuning performance in addition to detecting tampering based on the I/O pattern information.

Second Embodiment
Next, a second embodiment of the present disclosure will be described with reference to Fig. 7 and Fig. 8. In the second embodiment, a storage device 300 will be described.

Fig. 7 shows an example of the hardware configuration of the storage device 300. Referring to Fig. 7, the storage device 300 has, as an example, the following hardware configuration.
・CPU (Central Processing Unit) 301 (arithmetic unit)
ROM (Read Only Memory) 302 (storage device)
RAM (Random Access Memory) 303 (storage device)
Program group 304 loaded into RAM 303
A storage device 305 for storing the programs 304
A drive device 306 that reads and writes data from and to a recording medium 310 outside the storage device.
A communication interface 307 that connects to a communication network 311 outside the storage device
Input/output interface 308 for inputting and outputting data
A bus 309 that connects each component

In addition, the storage device 300 can realize the functions of the collection unit 321 and detection unit 322 shown in FIG. 8 by having the CPU 301 acquire and execute the group of programs 304. The group of programs 304 is stored in advance in the storage device 305 or ROM 302, for example, and is loaded into the RAM 303 or the like by the CPU 301 for execution as necessary. The group of programs 304 may be supplied to the CPU 301 via the communication network 311, or may be stored in advance in the recording medium 310, and the drive device 306 may read out the programs and supply them to the CPU 301.

Note that FIG. 7 shows an example of the hardware configuration of the storage device 300. The hardware configuration of the storage device 300 is not limited to the above-described case. For example, the storage device 300 may be configured with only a part of the above-described configuration, such as not having the drive device 306.

The collection unit 321 collects I/O pattern information, which is information corresponding to the operations performed when performing backup processing.

The detection unit 322 detects tampering with the data to be backed up based on the I/O pattern information collected by the collection unit 321.

As described above, the storage device 300 has a collection unit 321 and a detection unit 322. With this configuration, the detection unit 322 can detect tampering with the data to be backed up based on the I/O pattern information collected by the collection unit 321. As a result, it becomes possible to accurately detect tampering.

The above-mentioned storage device 300 can be realized by incorporating a specific program into an information processing device such as the storage device 300. Specifically, a program that is another embodiment of the present invention is a program for causing an information processing device such as the storage device 300 to collect I/O pattern information, which is information corresponding to the operation when performing backup processing, and to realize processing for detecting tampering with the data to be backed up based on the collected I/O pattern information.

The tamper detection method realized by an information processing device such as the storage device 300 described above is a method in which the information processing device such as the storage device 300 collects I/O pattern information, which is information corresponding to the operation when performing backup processing, and detects tampering of the data to be backed up based on the collected I/O pattern information.

Even if the invention is a program (or recording medium) or a tamper detection method having the above-mentioned configuration, it has the same action and effect as the above-mentioned storage device 300, and therefore can achieve the above-mentioned object of the present invention.

<Additional Notes>
A part or all of the above-described embodiment can be described as follows: A storage device and the like according to the present invention will be outlined below. However, the present invention is not limited to the following configuration.

(Appendix 1)
A collection unit that collects I/O pattern information, which is information corresponding to an operation when performing a backup process;
a detection unit that detects tampering with data to be backed up based on the I/O pattern information collected by the collection unit;
A storage device having the above configuration.
(Appendix 2)
The storage device according to claim 1, wherein the collection unit collects the I/O pattern information within the storage device, and acquires the I/O pattern information acquired within a client device from a client device that transmits the data to be backed up.
(Appendix 3)
The storage device according to claim 1 or 2, wherein the I/O pattern information includes a log of a backup software.
(Appendix 4)
The storage device according to any one of claims 1 to 3, wherein the detection unit detects tampering based on characteristic information previously assigned to each piece of information included in the I/O pattern information.
(Appendix 5)
The storage device according to any one of Supplementary Note 1 to Supplementary Note 4, wherein the detection unit detects tampering by using a result of machine learning using information included in the I/O pattern information collected in the past.
(Appendix 6)
The storage device according to any one of claims 1 to 5, wherein the detection unit detects tampering by using principal component analysis, the principal component analysis being information included in the I/O pattern information collected in the past.
(Appendix 7)
The storage device according to any one of claims 1 to 6, wherein the detection unit detects tampering by using the results of classification of information contained in the I/O pattern information collected in the past as features previously performed by machine learning.
(Appendix 8)
A control unit that creates a snapshot of a file system before updating the file system by a backup;
8. The storage device according to claim 1, wherein the detection unit does not cause the backup to fail even when the detection unit detects tampering.
(Appendix 9)
9. The storage device according to claim 1, wherein the detection unit outputs a predetermined parameter value based on the I/O pattern information.
(Appendix 10)
An information processing device,
Collect I/O pattern information, which is information corresponding to the operation when performing backup processing;
The tampering detection method detects tampering with data to be backed up based on the collected I/O pattern information.
(Appendix 11)
In the information processing device,
Collect I/O pattern information, which is information corresponding to the operation when performing backup processing;
A program for implementing a process of detecting tampering with data to be backed up based on the collected I/O pattern information.

The programs described in the above embodiments and appendices may be stored in a storage device or a computer-readable recording medium. For example, the recording medium may be a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, or a semiconductor memory.

The present invention has been described above with reference to the above-mentioned embodiments, but the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

Reference Signs List 100 Storage device 110 I/O pattern collection unit 120 Data analysis unit 130 Control unit 140 Report unit 150 Storage device 200 Client device 210 Backup software 220 Collection unit 300 Storage device 301 CPU
302 ROM
303 RAM
304 Program group 305 Storage device 306 Drive device 307 Communication interface 308 Input/output interface 309 Bus 310 Recording medium 311 Communication network 321 Collection unit 322 Detection unit

Claims (10)

A collection unit that collects I/O pattern information, which is information corresponding to an operation when performing a backup process;
a detection unit that detects tampering with data to be backed up based on the I/O pattern information collected by the collection unit;
having
The detection unit detects tampering based on characteristic information previously assigned to each piece of information included in the I/O pattern information,
The characteristic information may be indicated as being immutable by a backup;
The detection unit detects tampering when the I/O pattern information to be detected includes information that deviates from the characteristic information. The storage device according to claim 1, wherein the collection unit collects the I/O pattern information within the storage device, and acquires the I/O pattern information acquired within the client device that transmits the data to be backed up, which is different from the I/O pattern information that can be collected within the storage device. 3. The storage device according to claim 1, wherein the I/O pattern information includes a log of a backup software. The storage device according to claim 1 , wherein the detection unit detects tampering by using a result of machine learning using information included in the I/O pattern information collected in the past. The storage device according to claim 1 , wherein the detection unit detects tampering by using principal component analysis, the principal component being information included in the I/O pattern information collected in the past. The storage device according to claim 1 , wherein the detection unit detects tampering by using the results of classification of information contained in the I/O pattern information collected in the past as features previously performed by machine learning. A control unit that creates a snapshot of a file system before updating the file system by a backup;
7. The storage device according to claim 1, wherein, in response to detection of tampering by the detection unit, a backup process is performed without restricting I/O by backup and a notification is issued in response to the detection, and if the detection unit does not detect tampering, the control unit deletes the created snapshot. The storage device according to claim 1 , wherein the detection unit outputs a predetermined parameter value based on the I/O pattern information. An information processing device,
Collect I/O pattern information, which is information corresponding to the operation when performing backup processing;
Detecting tampering with the data to be backed up based on the collected I/O pattern information;
When detecting tampering, the tampering is detected based on characteristic information previously assigned to each piece of information included in the I/O pattern information;
The characteristic information may be indicated as being immutable by a backup;
When detecting tampering, the tampering is detected if the I/O pattern information to be detected includes information that deviates from the characteristic information. In the information processing device,
Collect I/O pattern information, which is information corresponding to the operation when performing backup processing;
Detecting tampering with the data to be backed up based on the collected I/O pattern information;
When detecting tampering, the tampering is detected based on characteristic information previously assigned to each piece of information included in the I/O pattern information;
The characteristic information may be indicated as being immutable by a backup;
A program for implementing a process for detecting tampering when the I/O pattern information to be detected includes information that deviates from the characteristic information.

Images