Abstract: The technology disclosed herein provides batchwise metric-based malware detection by receiving a plurality of input/output (IO) requests, generating IO trace sequences by combining a number of IO requests, generating batchwise metrics, each of the batchwise metrics corresponding to one of the IO trace sequences and generated based on an operation performed on values of parameters within IO trace sequences, generating inferential model input feature vectors based on the generated batchwise metrics, and training an inferential model based on a plurality of the generated inferential model input feature vectors and ground truth values corresponding to the IO trace sequences, each of the ground truth values indicating whether a corresponding one of the IO trace sequences represents a ransomware attack.

Abstract: The technology disclosed herein provides a method including receiving a plurality of input/output (IO) requests at an object store, removing one or more fields from each of the plurality of input/output (IO) requests to generate a plurality of condensed IO requests, transforming one or more fields of each of the plurality of condensed IO requests to generate transformed IO requests, combining a predetermined number of transformed IO requests to generate IO trace temporal sequences, generating machine learning (ML) model input feature vectors by assigning each of the IO trace temporal sequences a ground truth value indicating whether the IO trace temporal sequence represents a ransomware attack, and training an ML model using a plurality of the ML model input feature vectors.