Samsung Patents an AI Guard Built Into Your Storage Drive to Stop Ransomware
Most ransomware defense runs inside your operating system, which is exactly what attackers try to switch off. Samsung's filing puts the watchdog inside the storage drive itself.
What Samsung's ransomware-spotting drive does
Ever wonder what stops ransomware from just switching off your antivirus app? Often, not much. Ransomware is the attack that scrambles your files and demands payment, and the protection software running on your computer can be a target too.
Samsung's patent application moves the lookout into the storage drive, the part of your computer where files actually live. Every time something asks the drive to read or write data, an AI model looks at that request along with the ones just before it and decides whether it looks like an attack. The drive can then refuse the request, sound an alarm, or shut the attack down.
Because the checker lives inside the drive, malware has a harder time reaching it. And because it judges each request individually, it doesn't have to wait for a pile of statistics to build up before it spots trouble.
… generating, using a transformer model, ransomware information, indicating a presence or an absence of a ransomware attack on the memory device, for each of the memory commands …
Translation: An artificial intelligence model analyzes every single drive instruction to check for malicious activity.
How the model scores every storage command
The claims cover a method, a storage medium holding code, and a device with a memory and a processor, all built around the same steps. The system takes a sequence of memory commands (the read and write instructions a drive receives) and feeds them to a transformer model (the type of AI behind modern chatbots, good at reading a sequence and tracking how each item relates to the others). The model produces a ransomware verdict for each command, and the system runs some or all of the commands based on those verdicts.
Before the AI sees a command, the filing turns it into small pieces of data called tokens. Examples include:
- A timestamp, the block address (where on the drive the data sits), the number of blocks, and whether it is a read or a write
- A file path and a process ID (which program sent the command)
- A label for patterns such as write after read, found by checking a history of recent commands
Each command also gets a position marker so the model knows the order, then a self-attention step lets every command in the window weigh every other one. One example uses a window of 1,000 commands that slides forward 500 at a time, with three stacked layers. The output is either a yes-or-no flag per command or one number from 0 to 1 showing what share of commands look malicious.
A flagged command can be refused, set off an alarm, or have the attack shut down.
Why Samsung wants ransomware defense in the drive
Ransomware hits businesses hardest, and the filing points out that companies are moving more of their data onto fast SSDs, which makes those drives a more tempting target. A watchdog inside the drive could keep working even after an attacker has taken over the operating system, and it could stop a bad command before it overwrites your files. For you, that would mean a drive that helps defend itself.
The patent office has approved this application, and once Samsung pays the final fee it should be issued as a granted patent. The filing says tests showed better performance than conventional systems but gives no numbers, so how well this works in real use is still unknown.
Samsung's 39th filing we've tracked since June in our next-generation SSD patents builds on earlier work like one on failure prediction privacy and one on backup power for drives.
Claim 1 is short and wide. It asks for three things: a sequence of storage commands, a transformer model that gives a ransomware verdict for each command, and a device that runs the commands based on those verdicts. It never mentions an SSD, a window size, a file path, or an alarm.
Those details show up only in later claims. So the main claim describes any storage setup where a transformer scores commands one by one and the result decides what runs. The firm limits are the model type and the per-command verdict. A detector built on another kind of model would sit outside the wording of claim 1, and so would a tool that only reviews summary statistics.
Once issued, the claim would apply to any drive that follows that recipe. Whether that matters depends on whether transformers turn out to be the right tool for this job, and the filing offers no accuracy numbers to settle it.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Samsung patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
14 drawing sheets from US 2026/0350167 A1 · click any drawing to enlarge
Show the other 6 sheets
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in