Automatic graph-based detection of unlikely file possession

A system for detecting unauthorized file possession, comprising:

• at least one processor;
• and
• memory including instructions that, when executed by the at least one processor, cause the at least one processor to:
• generate a networked computing environment graph, wherein nodes of the networked computing environment graph represent networked computing devices and files, and edges of the networked computing environment graph are between a networked computing device node and a file node, indicating a file represented by the file node is located on a networked computing device represented by the networked computing device node;
• identify a file in question node for a file in question in the networked computing environment graph;
• identify a device in question node connected to the file in question node, wherein the file in question is located on a respective networked computing device represented by the device in question node;
• identify a set of file nodes, wherein the set of files nodes includes each file node of the networked computing environment graph for the file in question except the file in question node;
• generate a set of connection paths from the device in question node to each file node of the set of file nodes based upon edges of the networked computing environment graph;
• determine the respective networked computing device represented by the device in question node should not have possession of the file in question based on a set of one or more metrics derived from the networked computing environment graph and the set of connection paths, wherein the set of metrics includes a first metric determined based on a minimum degree of separation exceeds a threshold, wherein the minimum degree of separation is a number of edges in a connection path between the device in question node and a respective file node for the connection path with lowest number of edges for all connection paths of the set of connection paths;
• generate an alert that unauthorized file possession has occurred for the file in question;
• and
• display the alert with indications of the device in question and the file in question on a graphical user interface.

At least one non-transitory computer readable medium including instructions for detecting unauthorized file possession that when executed by at least one processor, cause the at least one processor to:

• generate a networked computing environment graph, wherein nodes of the networked computing environment graph represent networked computing devices and files, and edges of the networked computing environment graph are between a networked computing device node and a file node, indicating a file represented by the file node is located on a networked computing device represented by the networked computing device node;
• identify a file in question node for a file in question in the networked computing environment graph;
• identify a device in question node connected to the file in question node, wherein the file in question is located on a respective networked computing device represented by the device in question node;
• identifying a set of file nodes, wherein the set of files nodes includes each file node of the networked computing environment graph for the file in question except the file in question node;
• generate a set of connection paths from the device in question node to each file node of the set of file nodes based upon edges of the networked computing environment graph;
• determine the respective networked computing device represented by the device in question node should not have possession of the file in question based on a set of one or more metrics derived from the networked computing environment graph and the set of connection paths, wherein the set of metrics includes a first metric determined based on a minimum degree of separation exceeds a threshold, wherein the minimum degree of separation is a number of edges in a connection path between the device in question node and a respective file for the connection path node with lowest number of edges for all connection paths of the set of connection paths;
• generate an alert that unauthorized file possession has occurred for the file in question;
• and
• display the alert with indications of the device in question and the file in question on a graphical user interface.