Patent ID: 11916938
Assignee: EMC IP HOLDING COMPANY LLC
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 13:
14. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code, when executed by at least one processing device comprising a processor coupled to a memory, causes the at least one processing device:
to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a storage area network;
to generate statistics relating to the received storage access protocol commands;
to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the storage area network; and
to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system;
wherein the statistics are generated in the storage system based at least in part on per-command records maintained by the storage system for respective ones of the received storage access protocol commands;
a given one of the per-command records for a corresponding one of the received storage access protocol commands comprising at least an identifier of a particular one of the storage devices to which the corresponding received storage access protocol command is directed, a data transfer offset of the corresponding received storage access protocol command and a data transfer length of the corresponding received storage access protocol command;
wherein the one or more host devices further comprise a multi-path layer comprising at least one multi-path input-output driver configured to control delivery of input-output operations to the storage devices of the storage system over selected ones of a plurality of paths through the storage area network, and wherein the at least one processing device is further configured to provide the alert to the multi-path input-output driver.