Abstract: A method, computer program product, and computing system for processing a plurality of input/output (IO) requests for a storage object of a storage system. A sampling interval may be determined for the plurality of IO requests for the storage object based upon, at least in part, a machine learning model processing the plurality of IO requests. The plurality of IO requests may be sampled using the determined sampling interval. The plurality of sampled IO requests may be processed using the machine learning model.

Abstract: A method, computer program product, and computing system for monitoring for a potential ransomware attack on a storage object of a storage system based upon, at least in part, processing of a plurality of input/output (IO) features associated with the storage object using a machine learning model. A host computing device associated with the storage object under the potential ransomware attack is identified. A process executing on the host computing device associated with the storage object under the potential ransomware attack is identified. A remedial action is performed on the storage system in response to identifying the process executing on the host computing device.

Abstract: A data storage system includes a tuner that obtains data samples for data storage operations of workloads and calculates feature measures for a set of features of the data storage operations over aggregation intervals of an operating period. It further (1) applies a cluster analysis to the feature measures to define a set of clusters, and assigns the feature measures to the clusters, and (2) applies a classification analysis to the feature measures labelled by their clusters to identify dominating features of each cluster, and generates workload profiles for the clusters based on the dominating features, and then automatically adjusts configurable processing mechanisms (e.g., caching or tiering) based on the workload profiles and performance or efficiency goals.

Abstract: Techniques for performing early and adaptive IO stream sampling for ML-based optimizations in a storage system. The techniques include obtaining a sub-slice of sampled data by performing early sampling of a slice of successive operations directed to a storage object. The techniques include generating features based on the sub-slice, processing the features using an ML model, and generating a probability score based on the ML model's output. The techniques include determining that the probability score falls within an overlap range of continuous variable distributions for benign and threat classes of data. The techniques include, in response to the probability score exceeding a specified threshold, comparing a class signature of the sub-slice with a target class signature of the threat class of data to determine a similarity between the class signatures, and, in response to the similarity exceeding a predetermined similarity level, assigning a “threat” class label to the probability score.

Abstract: A method, computer program product, and computing system for processing historical input/output (IO) performance data associated with one or more storage objects of a storage system. A plurality of IO modeling systems may be trained using the historical IO performance data. Modeling performance information may be determined for the plurality of IO modeling systems across the historical IO performance data. A forecast score may be determined for each IO modeling system based on the modeling performance information for the plurality of IO modeling systems. A subset of the plurality of IO modeling systems may be selected based upon the forecast score for each IO modeling system. The at least one IO modeling system may be trained using the historical IO performance data. IO performance data may be forecasted using the at least one trained IO modeling system from the subset of the plurality of IO modeling systems.

Abstract: Techniques for forecasting temperatures of storage objects in a storage system using machine learning (ML). The techniques can include forecasting at least one temperature of a storage object using at least one ML model, modifying storage of the storage object based on the at least one temperature of the storage object, and, having modified storage of the storage object, obtaining at least one performance metric associated with the storage object. The techniques can further include, based on the performance metric(s), varying a frequency of forecasting the at least one temperature of the storage object, retraining the at least one ML model used in forecasting the at least one temperature, and/or adjusting at least one operational parameter of the system. The techniques provide increased accuracy over known statistical approaches to forecasting temperatures of storage objects, leading to increased performance gains in terms of IO latency, IO operations per second, and bandwidth.

Abstract: Techniques are disclosed for machine learning optimized storage system simulation in a virtual environment. For example, a system includes at least one processing device including a processor coupled to a memory; the at least one processing device being configured to implement the following steps: receiving a series of action alerts from a virtual reality system concerning a virtual reality representation of a storage system; translating each action alert in the action alert series into a corresponding storage system simulator event state, to generate a series of event states; using a machine learning model to determine a new event state based on the series of event states; generating a new event based on the new event state and on the series of event states; and updating a storage system simulation corresponding to the virtual reality representation of the storage system to display the new event in the virtual reality system.

Abstract: A method, computer program product, and computing system for forecasting a temperature of a storage object of a storage system using a machine learning model. The storage object may be divided into a plurality of storage sub-objects. A temperature may be determined for each storage sub-object using a simple moving average. A portion of the temperature of the storage object may be projected onto the temperature of each of the plurality of storage sub-objects based upon, at least in part, the temperature determined for each storage sub-object and the temperature determined for each storage object.

Abstract: A method, computer program product, and computing system for forecasting a temperature of a storage object of a storage system using a first machine learning model and a plurality of input/output (IO) features. The storage object may be divided into a plurality of storage sub-objects. A temperature may be determined for each storage sub-object with a subset of the plurality of IO features using a second machine learning model. A portion of the temperature of the storage object may be projected onto the temperature of each of the plurality of storage sub-objects based upon, at least in part, the temperature determined for each storage sub-object and the temperature determined for each storage object.

Abstract: A method, computer program product, and computing system for processing a plurality of input/output (IO) requests for a storage object of a storage system. A sampling interval may be determined or the plurality of IO requests for the storage object. The plurality of IO requests may be sampled using the determined sampling interval. The plurality of sampled IO requests may be processed using a machine learning model.

Abstract: A method, computer program product, and computing system for processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system. The plurality of storage objects may be divided into a plurality of classes using a classification-based machine learning model. A temperature for each storage object may be forecast based upon, at least in part, the plurality of classes.

Abstract: A method, computer program product, and computing system for processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system. A plurality of IO features may be generated using the plurality of IO requests including one or more of: a percentage of overwrite IO requests, a percentage of sequential read IO requests, and a percentage of sequential write IO requests. The plurality of IO features may be processed using a machine learning model. A ransomware attack may be monitored for on the storage system in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.

Abstract: Techniques are disclosed for machine learning optimized storage system simulation in a virtual environment. For example, a system includes at least one processing device including a processor coupled to a memory; the at least one processing device being configured to implement the following steps: receiving a series of action alerts from a virtual reality system concerning a virtual reality representation of a storage system; translating each action alert in the action alert series into a corresponding storage system simulator event state, to generate a series of event states; using a machine learning model to determine a new event state based on the series of event states; generating a new event based on the new event state and on the series of event states; and updating a storage system simulation corresponding to the virtual reality representation of the storage system to display the new event in the virtual reality system.

Abstract: A method, computer program product, and computing system for processing a plurality of input/output (IO) requests associated with a plurality of storage objects of a storage system. A plurality of IO features are generated using the plurality of IO requests. The plurality of IO features are processed using a machine learning model. A ransomware attack on the storage system may be monitored for in real-time based upon, at least in part, the processing of the plurality of IO features using the machine learning model.

Abstract: A method, computer program product, and computing system for determining a respective past activity level associated with a plurality of storage objects. The plurality of storage objects are divided into a plurality of storage object groups based upon, at least in part, the respective past activity level associated with the plurality of storage objects. Input/output (IO) performance data for a first storage object group of the plurality of storage object groups is forecasted using a first machine learning model. IO performance data for a second storage object group of the plurality of storage object groups is forecasted using a statistical method.

Abstract: A technique for performing load balancing between storage nodes includes generating a first performance metric for volumes accessed through a first storage node and generating a second performance metric for volumes accessed through a second storage node. The volumes accessed through the first storage node include a set of volumes that belong to a NAS (network-attached storage) file server hosted by the first storage node. In response to detecting a load imbalance based on the first performance metric and the second performance metric, the technique further includes moving the NAS file server from the first storage node to the second storage node and hosting the set of volumes that belong to the NAS file server from the second storage node.

Abstract: A data storage system includes a tuner that obtains data samples for data storage operations of workloads and calculates feature measures for a set of features of the data storage operations over aggregation intervals of an operating period. It further (1) applies a cluster analysis to the feature measures to define a set of clusters, and assigns the feature measures to the clusters, and (2) applies a classification analysis to the feature measures labelled by their clusters to identify dominating features of each cluster, and generates workload profiles for the clusters based on the dominating features, and then automatically adjusts configurable processing mechanisms (e.g., caching or tiering) based on the workload profiles and performance or efficiency goals.

Abstract: A method, computer program product, and computing system for processing a plurality of input/output (IO) operations on a plurality of storage objects of a storage system. The plurality of storage objects may be divided into a plurality of storage object groups based upon, at least in part, the plurality of IO operations processed on the plurality of storage objects. Each storage object group may be associated with an IO machine learning model selected from a plurality of IO machine learning models, thus defining a plurality of storage object group-specific IO machine learning models. IO performance data may be forecasted for the plurality of storage objects using the plurality of storage object group-specific IO machine learning models.

Abstract: Techniques for forecasting temperatures of storage objects in a storage system using machine learning (ML). The techniques can include forecasting at least one temperature of a storage object using at least one ML model, modifying storage of the storage object based on the at least one temperature of the storage object, and, having modified storage of the storage object, obtaining at least one performance metric associated with the storage object. The techniques can further include, based on the performance metric(s), varying a frequency of forecasting the at least one temperature of the storage object, retraining the at least one ML model used in forecasting the at least one temperature, and/or adjusting at least one operational parameter of the system. The techniques provide increased accuracy over known statistical approaches to forecasting temperatures of storage objects, leading to increased performance gains in terms of IO latency, IO operations per second, and bandwidth.

Abstract: A method, computer program product, and computing system for processing historical input/output (IO) performance data associated with one or more storage objects of a storage system. A smoothing model may be applied on at least a portion of the historical IO performance data to generate forecast IO performance data. The forecast IO performance data may be compared to observed IO performance data to generate one or more performance differentials. A normal IO performance range may be generated based upon, at least in part, the one or more performance differentials. One or more IO performance anomalies may be detected based upon, at least in part, the normal IO performance range.