Hardware-Assisted Anomaly Detection in Storage Systems for Malware Resilience

With the increasing sophistication of ransomware and other malicious software, traditional host-based security mechanisms are becoming ineffective due to their vulnerability to tampering. This paper introduces a novel storage- level anomaly detection framework that leverages independent hardware-assisted monitoring to track file system activity in real time. By integrating multi-layer data collection across network interfaces, storage controllers, and filesystem structures, the proposed system effectively distinguishes between normal and malicious disk operations. Experimental analysis of various benign applications and malware samples reveals distinct access patterns that can be used to detect emerging threats. The study highlights the potential for integrating low-level storage metrics into a robust, tamper-resistant security framework for next- generation secure data storage solutions.