Ransomware-aware solid-state drive

An example embodiment may involve a storage device comprising one or more processors, memory, a host interface connectable to a host device, a network interface connectable to a backup device, and program instructions, stored in the memory, that upon execution by the one or more processors cause the storage device to perform operations comprising: causing data received, by way of the host interface, to be stored in a page of the memory; after storing the data, marking the page as invalid due to input/output operations of the memory; determining a predicted idle time period within which the memory is not expected to be engaged in further input/output operations; determining that a duration of the predicted idle time period exceeds a threshold length; and during the predicted idle time period, transmitting, by way of the network interface, the data to the backup device.