In the evolving landscape of cybersecurity, ransomware attacks remain one of the most significant threats to organizations worldwide. The financial and reputational damage caused by successful ransomware attacks can be devastating. Ransomware attacks are getting more sophisticated, bypassing traditional security. The impact can be severe: data loss, financial extortion, and business disruptions. You need advanced AI solutions to detect and prevent these threats quickly and effectively. When it comes to ransomware attacks, every second counts for a successful data recovery and building a real-time threat detection system that operates on a data layer provides huge benefits. Such a system empowers storage admins to quickly recover from an attack by rolling back to a clean data snapshot.
To address this challenge, NetApp introduced Autonomous Ransomware Protection (ARP) solution several years ago as the first built-in real-time threat detection and response for enterprise storage systems. Now, we are upgrading ARP to the next level by leveraging the power of Artificial Intelligence and Machine Learning (AI/ML) and multiple file-level signals. Adding to our existing hardening of the storage layer, NetApp's AI-powered ransomware detection capability is a game-changer to automatically detect and respond to file system anomalies in real-time. Reasoning on multiple file forensic signals simultaneously (such as file binary content, file headers, and file metadata signatures), the AI/ML algorithm is able to detect subtle malicious changes. By integrating AI/ML based detection, NetApp's solution can analyze data write operations in real-time to identify malicious encryption behaviors caused by ransomware threats. Once we accurately detect these threats, NetApp systems instantly trigger alerts and take automatic data snapshots that are crucial for timely data recovery.
The new ARP/AI solution was released in May 2024 as part of the Tech Preview in 9.15.1. It recently achieved a remarkable AAA rating from SE Labs, a renowned independent testing organization, after going through a rigorous effectiveness validation on real malware attacks. In this testing, ARP/AI reported an impressive 99% detection accuracy with 100% legitimate accuracy (i.e., no false positives). Delivering on the customer promise of providing the most secure storage on the planet, NetApp is announcing today that ARP/AI will be Generally Available (GA) with ONTAP version of 9.16.1 as part of ONTAP One license. ONTAP 9.16.1 is targeted for availability before the end of the calendar year.
The power of AI in cybersecurity
NetApp's ransomware detection capability can be attributed to its innovative use of artificial intelligence and machine learning technologies. By training AI models on vast amounts of data, including both benign and malicious samples, we’ve developed a solution that can accurately identify the subtle patterns and anomalies associated with ransomware attacks.
To ensure that the ARP/AI model adapts to the latest threats, the ransomware detection solution leverages a dataset collection pipeline and a continuous model training process in the cloud. At its core, the scheduled data collection pipeline leverages massive, open-source clean file samples covering a variety of file types to kick-off the process. Using these clean file datasets, a normal workspace is initially created in a sandbox environment. Thereafter, a malware sample, which is sourced from a threat intelligence feed that is continuously updated by a third-party vendor, is executed in the sandbox resulting in generating a huge, encrypted file samples and signatures.
After the malware completes the corruption process across multiple sandboxes, the encrypted files are collected and combined with previously collected corrupted and clean files creating a large training data. In addition to this, customers who have identified missed attacks (False Negatives) during simulated tests or real attacks can provide sample files to augment the training data as captured under “User FN Submission”. This training data is then fed to a supervised model training process resulting in a newer version of the model that adapts to the latest threats. The new model is then validated to ensure that it outperforms the existing model deployed on the box on the latest maliciously corrupted files and then packaged and deployed to the storage devices in a regular cadence without requiring full ONTAP upgrade; see figure below.
Figure 1. ARP/AI Model Training and Updating process
This process allows the AI-powered detection technology to adapt and evolve continuously as new ransomware variants emerge by learning from the continuous malware feeds that trigger model training and deployment framework. By learning from each encounter, the AI models become more sophisticated and effective over time, providing organizations with a future-proof defense against the ever-changing ransomware landscape.
Enable ARP/AI in ONTAP 9.16.1
In order to turn on ARP/AI on NAS volumes, customers are required to have an ONTAP One license and have upgraded to ONTAP 9.16.1. Once the requirements are satisfied, the following steps are needed:
- Use either BlueXP Advance View or System Manager to access Storage tab on the left panel and click on the Volumes and select on the volume of interest
- Once the volume detail page loads, click on the Security tab and enable the Anti-Ransomware toggle
Question & Answers
What does the upgrade look like? Can both features coexist? Can you convert the current version of ARP to the new generation ARP/AI without disruption?
Answer: The upgrade will be transparent to the customer and there will be no action required from the system admin. The analytics will seamlessly switch from heuristic based to AI/ML based detection after the upgrade. Starting from 9.16.1, ARP/AI is the sole option available for FlexVol, as the previous version (ARPv1) has been deprecated for FlexVol. There is no choice between ARP/AI and ARPv1 for FlexVol. However, ARP/AI is not yet supported for FlexGroup, which will continue to use ARPv1 until ARP/AI becomes available. Customers must enable ARP using the same CLI or System Manager interface for both FlexVol and FlexGroup. Internally, ARP/AI is utilized for FlexVol, while ARPv1 is used for FlexGroup. Customers do not need to make any explicit selections.
Is there a learning mode – active mode scenario for the new ARP?
Answer: No, ARP/AI is an already trained ML model that combines multiple file-level signals to make a detection. As a result, protection starts as soon as it is turned on with no learning mode requirement.
Is there a scale issue? Autonomous ransomware protection (ARP) today has a limit of around 150 volumes per node before the scanning schedule changes. Is that true for ARP/AI?
Answer: The scale is always considered as soft limit and the recommended 150 soft limit will continue to be there with ARP/AI. Though system performance will not degrade if enabled on more volumes, the reaction time to report the attack increases with the increase in number of volumes on which ARP/AI is enabled.
What happens if someone upgrades a 9.14.1 systems with ARP on a volume?
Answer: Volumes with ARP already enabled in the previous release will automatically transition to the ARP/AI method after upgrading to version 9.16.1. No action is required from the customer for these upgraded volumes.
Is there a way for the customer to opt-in or opt-out to the automatic AI/ML library updates?
Answer: The ARP/AI model auto-update feature is disabled by default. Customers must explicitly enable it to receive auto-updates. They can choose to enable or disable auto-updates at any time.
What happens in secure environments?
Answer: For automatic updates, customers must have both (1) AutoSupport with HTTPS enabled and (2) Automatic updates enabled. In secure environments, if either of these prerequisites is not met, ARP/AI model automatic updates will not occur. In such cases, customers can manually update the model by downloading the package from the NetApp Support Site or by upgrading to the ONTAP patch version that includes these updates. ARP/AI model updates are released in three ways: (1) Automatic update package, (2) Manual update package, and (3) Periodic ONTAP patch releases.