System and method for tracing data access and detecting abnormality in the same
AssigneeDatiphy Inc.
InventorYeejang James Lin
Life of this patent
Estimating the term…
Abstract
Data DNA modeling is used to represent data and the relationship this data has with other data. When an information access request from a user is detected, an asset DNA associated with the user is retrieved and analyzed against the information access request. Using the asset DNA, it can be determined whether the information access request is a normal request or a suspicious request. If the user is unknown, a generic asset DNA can be created and populated with the data from the information access request. The system checks the newly created asset DNA against other similar asset DNA to determine whether there is any abnormality associated with this newly created asset DNA.
Claims20
A method for identifying risks associated with information access requests in a system, by an apparatus comprising a monitoring unit, a non-volatile computer-readable memory, and a control unit, comprising:
- receiving, by the monitoring unit, an information access request;
- determining, by the control unit, whether the information access request involves a known entity or a new entity;
- retrieving, from the non-volatile computer-readable memory, a first set of user DNA data related to the known entity if the information access request involves a known entity;
- comparing the first set of user DNA data with data related to the information access request;
- creating deviation data if the first set of user DNA data differs from the data related to the information access request;
- updating the first set of user DNA data if the deviation data indicates a new association of the known entity with a new asset;
- and
- increasing a risk level associated with the deviation data if the deviation data exceeds a predefined trigger level in a policy,
- wherein the new asset comprises a file, a method, a server, a database, a command, or a user.
An apparatus, for identifying risks associated with information access requests in a system, comprising:
- a network interface unit in communication with a network;
- a monitoring unit network in communication with the network interface and receiving information access request from the network;
- a control unit;
- and
- a non-volatile computer-readable memory in communication with the monitoring unit,
- wherein
- the control unit
- determines whether the information access request involves a known entity or a new entity,
- retrieves from the non-volatile computer-readable memory, a first set of user DNA data related to the known entity if the information access request involves a known entity,
- compares the first set of user DNA data with data related to the information access request,
- creates deviation data if the first set of user DNA data differs from the data related to the information access request,
- updates the first set of user DNA data if the deviation data indicates a new association of the known entity with a new asset;
- and
- increases a risk level associated with the deviation data if the deviation data exceeds a predefined trigger level in a policy,
- wherein the new asset comprises a file, a method, a server, a database, a command, or a user.
A non-transitory computer readable medium on which is stored a computer program for identifying risks associated with information access requests in a system, the computer program comprising computer instructions that when executed by a computing device with a monitoring unit, a non-volatile computer-readable memory, and a control unit causes the computing device to perform the steps for:
- receiving, by the monitoring unit, an information access request;
- determining, by the control unit, whether the information access request involves a known entity or a new entity;
- retrieving, from the non-volatile computer-readable memory, a first set of user DNA data related to the known entity if the information access request involves a known entity;
- comparing the first set of user DNA data with data related to the information access request;
- creating deviation data if the first set of user DNA data differs from the data related to the information access request;
- updating the first set of user DNA data if the deviation data indicates a new association of the known entity with a new asset;
- and
- increasing a risk level associated with the deviation data if the deviation data exceeds a predefined trigger level in a policy,
- wherein the new asset comprises a file, a method, a server, a database, a command, or a user.
Dependencies are inferred from the claim text.