Detection of an ongoing data breach based on relationships among multiple network elements

A computer-implemented method for identifying a data breach, the method comprising:

• establishing a baseline pattern of movement of data including an expected user that accesses the data, an expected device used by the expected user to access the data, and an expected path traversed by the data,
• wherein the expected path includes an expected geographic location from where the data is accessed, an expected cloud storage, and an expected software application for the data at respective points in time;
• monitoring a pattern of movement of data over a computer network in real-time or near real-time relative to a user that accesses the data, a device used to access the data, and an actual path traversed by the data,
• wherein the actual path includes a geographic location from where the data is accessed, a cloud storage, and a software application for the data at respective points in time, and
• wherein the user directly or indirectly manipulates the data, the device is operable to manipulate the data, and the software application handles sending or receiving the data relative to a computing device;
• comparing the monitored pattern of movement of the data to the baseline pattern of movement of the data in real-time or near real-time relative to the user, the device, and the actual path;
• detecting an anomalous movement of the data that differs from an expected movement of the data based on the baseline pattern of movement,
• wherein the anomalous movement of the data includes a deviation from the expected geographic location from where the data is accessed, the expected cloud storage, or the expected software application for the data at the respective points in time;
• and
• identifying an ongoing data breach in real-time or near real-time based on a relationship among the data, the user, the device, and the anomalous movement.