System and method for tracing data access and detecting abnormality in the same
AssigneeDatiphy Inc.
InventorYeejang James Lin
Life of this patent
Estimating the term…
Abstract
Data DNA modeling is used to represent data and the relationship this data has with other data. When an information access request from a user is detected, an asset DNA associated with the user is retrieved and analyzed against the information access request. Using the asset DNA, it can be determined whether the information access request is a normal request or a suspicious request. If the user is unknown, a generic asset DNA can be created and populated with the data from the information access request. The system checks the newly created asset DNA against other similar asset DNA to determine whether there is any abnormality associated with this newly created asset DNA.
Claims17
A method for responding to a system attack, by an apparatus comprising a monitoring unit, a non-volatile computer-readable memory, and a control unit, comprising:
- receiving, by the monitoring unit, a system access request;
- creating an event DNA for the system access request and an asset DNA for each resource associated with the system access request;
- recording one or more deviation between one or more created asset DNAs and corresponding stored asset DNAs;
- quantifying risks associated with each deviation according to a user policy;
- aggregating the quantified risks into an aggregated risk;
- identifying type of the system attack according to the aggregated risk;
- and
- if the system attack is known, identifying a response according to the aggregated risk,
- wherein each quantified risk for a created asset DNA is computed by comparing a deviation from a stored asset DNA.
An apparatus, for identifying risks associated with information access requests in a system, comprising:
- a network interface unit in communication with a network;
- a monitoring unit network in communication with the network interface and receiving information access request from the network;
- a control unit;
- and
- a non-volatile computer-readable memory in communication with the monitoring unit,
- wherein
- the control unit
- receives a system access request,
- creates an event DNA for the system access request and an asset DNA for each resource associated with the system access request,
- records one or more deviation between one or more created asset DNAs and corresponding stored asset DNAs,
- quantifies risks associated with each deviation according to a user policy,
- aggregates the quantified risks into an aggregated risk,
- identifying type of the system attack according to the aggregated risk;
- and
- if the system attack is known, identifies a response according to the aggregated risk,
- wherein each quantified risk for a created asset DNA is computed by comparing a deviation from a stored asset DNA.
A non-transitory computer readable medium on which is stored a computer program for identifying risks associated with information access requests in a system, the computer program comprising computer instructions that when executed by a computing device with a monitoring unit, a non-volatile computer-readable memory, and a control unit causes the computing device to perform the steps for:
- receiving, by the monitoring unit, a system access request;
- creating an event DNA for the system access request and an asset DNA for each resource associated with the system access request;
- recording one or more deviation between one or more created asset DNAs and corresponding stored asset DNAs;
- quantifying risks associated with each deviation according to a user policy;
- aggregating the quantified risks into an aggregated risk;
- identifying type of the system attack according to the aggregated risk;
- and
- if the system attack is known, identifying a response according to the aggregated risk,
- wherein each quantified risk for a created asset DNA is computed by comparing a deviation from a stored asset DNA.
Dependencies are inferred from the claim text.