arXiv subjects

Roman Pletka

Publications and source records attributed to Roman Pletka.

3 recordsLinked to original sources

arXiv2026

DT-RAID: A Software-Defined Tiered RAID Architecture for Heterogeneous SSDs

The rapid proliferation of cloud and AI-driven workloads has led to increasingly complex requirements for modern storage subsystems. To meet these demands, SSD controller architectures have evolved into a fragmented landscape, offering tiers of drive types optimized for endurance, performance, or capacity. More recently, SSDs have begun to differentiate regions within the same device, enabling intra-drive heterogeneity. However, integrating such heterogeneity into the existing storage stack with minimal disruption remains challenging. In this paper, we argue that storage middleware, such as RAID, is an effective control layer to address these integration challenges. We present DT-RAID, an intra-drive heterogeneity-aware RAID architecture designed for emerging SSDs. DT-RAID monitors stripe-level I/O access patterns and makes online placement decisions without requiring application modifications. It employs a lightweight heat-tracking mechanism to dynamically place frequently accessed (hot) stripes onto the higher-performance, higher-endurance tier. Using simulations based on SNIA MSR enterprise I/O traces, we demonstrate that DT-RAID improves modeled I/O performance by up to $6.8\times$ under greater tier asymmetry and extends normalized lifespan by up to $20.9\times$ compared to uniform RAID deployments.

cs.AR↗

arXiv2024

On the Generalizability of Machine Learning-based Ransomware Detection in Block Storage

Ransomware represents a pervasive threat, traditionally countered at the operating system, file-system, or network levels. However, these approaches often introduce significant overhead and remain susceptible to circumvention by attackers. Recent research activity started looking into the detection of ransomware by observing block IO operations. However, this approach exhibits significant detection challenges. Recognizing these limitations, our research pivots towards enabling robust ransomware detection in storage systems keeping in mind their limited computational resources available. To perform our studies, we propose a kernel-based framework capable of efficiently extracting and analyzing IO operations to identify ransomware activity. The framework can be adopted to storage systems using computational storage devices to improve security and fully hide detection overheads. Our method employs a refined set of computationally light features optimized for ML models to accurately discern malicious from benign activities. Using this lightweight approach, we study a wide range of generalizability aspects and analyze the performance of these models across a large space of setups and configurations covering a wide range of realistic real-world scenarios. We reveal various trade-offs and provide strong arguments for the generalizability of storage-based detection of ransomware and show that our approach outperforms currently available ML-based ransomware detection in storage. Empirical validation reveals that our decision tree-based models achieve remarkable effectiveness, evidenced by higher median F1 scores of up to 12.8%, lower false negative rates of up to 10.9% and particularly decreased false positive rates of up to 17.1% compared to existing storage-based detection approaches.

cs.CR↗

arXiv2024

WannaLaugh: A Configurable Ransomware Emulator -- Learning to Mimic Malicious Storage Traces

Ransomware, a fearsome and rapidly evolving cybersecurity threat, continues to inflict severe consequences on individuals and organizations worldwide. Traditional detection methods, reliant on static signatures and application behavioral patterns, are challenged by the dynamic nature of these threats. This paper introduces three primary contributions to address this challenge. First, we introduce a ransomware emulator. This tool is designed to safely mimic ransomware attacks without causing actual harm or spreading malware, making it a unique solution for studying ransomware behavior. Second, we demonstrate how we use this emulator to create storage I/O traces. These traces are then utilized to train machine-learning models. Our results show that these models are effective in detecting ransomware, highlighting the practical application of our emulator in developing responsible cybersecurity tools. Third, we show how our emulator can be used to mimic the I/O behavior of existing ransomware thereby enabling safe trace collection. Both the emulator and its application represent significant steps forward in ransomware detection in the era of machine-learning-driven cybersecurity.

cs.CR↗