Three-dimensional file event representation

At least one non-transitory machine-readable medium including instructions for spatial file operation mapping that, when executed by at least one processor, cause the at least one processor to perform operations to:

• obtain file event data for a file for a time segment, the file event data including a file system hierarchy for the file;
• generate a spatial file operation map for the file system hierarchy including a file operation map for the file for the time segment, wherein the file operation map for the file includes a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file;
• determine that a file operation was performed on the file during the time segment based on the file event data;
• generate an indication on a layer of the plurality layers of the file operation map that the file operation was performed, wherein the layer corresponds to a file operation class of the file operation;
• generate a file operation anomaly machine learning model;
• evaluate the spatial file operation map using the file operation anomaly machine learning model to change a file operation anomaly state from negative to positive;
• and
• prevent access to the file until the file operation anomaly state has changed to negative.

A method for spatial file operation mapping, the method comprising:

• obtaining file event data for a file for a time segment, the file event data including a file system hierarchy for the file;
• generating a spatial file operation map for the file system hierarchy including a file operation map for the file for the time segment, wherein the file operation map for the file includes a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file;
• determining that a file operation was performed on the file during the time segment based on the file event data;
• generating an indication on a layer of the plurality layers of the file operation map that the file operation was performed, wherein the layer corresponds to a file operation class of the file operation;
• generating a file operation anomaly machine learning model;
• evaluating the spatial file operation map using the file operation anomaly machine learning model to change a file operation anomaly state from negative to positive;
• and
• preventing access to the file until the file operation anomaly state has changed to negative.