Back to results
US 11,599,629 B2Granted
Real-time detection of system threats
AssigneeRubrik, Inc.
InventorsShanthi Kiran Pendyala, Di Wu, Matthew Edward Noe
Life of this patent
Estimating the term…
Abstract
Some examples relate generally to managing and storing data, and more specifically to the real-time detection of ransomware, system (or insider) threats, or the misappropriation of credentials by using file system audit events.
Claims20
A method for detection of a threat in a file system, the method comprising:
- accessing audit events in the file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
- de-duplicating the audit events to remove the duplicative file operations and retain the unique file operations from the audit events;
- generating time series data that comprises the unique file operations and is devoid of the duplicative file operations;
- analyzing the time series data to determine whether a subset of the unique file operations includes file-read instructions to copy files corresponding to the subset of unique file operations;
- comparing a pattern of the file-read instructions in the time interval to a normal pattern of file-read instructions;
- determining, based at least in part on the comparing, that the file-read instructions in the subset of unique file operations are abnormal based at least in part on a deviation between the pattern of the file-read instructions in the time interval and the normal pattern of file-read instructions;
- responsive to determining that the file-read instructions in the subset of unique file operations are abnormal, determining that the file system is subject to a threat;
- and
- generating an alert based at least in part on determining that the file system is subject to the threat.
6 more elements
A system for detection of a threat in a file system, the system comprising:
- at least one processor for executing machine-readable instructions;
- and
- a memory storing instructions configured to cause the at least one processor to perform operations comprising, at least:
- accessing audit events in the file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
- de-duplicating the audit events to remove the duplicative file operations and retain the unique file operations from the audit events;
- generating time series data that comprises the unique file operations and is devoid of the duplicative file operations;
- analyzing the time series data to determine whether a subset of the unique file operations includes file-read instructions to copy files corresponding to the subset of unique file operations;
- comparing a pattern of the file-read instructions in the time interval to a normal pattern of file-read instructions;
- determining, based at least in part on the comparing, that the file-read instructions in the subset of unique file operations are abnormal based at least in part on a deviation between the pattern of the file-read instructions in the time interval and the normal pattern of file-read instructions;
- responsive to determining that the file-read instructions in the subset of unique file operations are abnormal, determining that the file system is subject to a threat;
- and
- generating an alert based at least in part on determining that the file system is subject to the threat.
9 more elements
A non-transitory, machine-readable medium storing instructions which, when read by a machine, cause the machine to perform operations comprising, at least:
- accessing audit events in a file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
- de-duplicating the audit events to remove the duplicative file operations and retain the unique file operations from the audit events;
- generating time series data that comprises the unique file operations and is devoid of the duplicative file operations;
- analyzing the time series data to determine whether a subset of the unique file operations includes file-read instructions to copy files corresponding to the subset of unique file operations;
- comparing a pattern of the file-read instructions in the time interval to a normal pattern of file-read instructions;
- determining, based at least in part on the comparing, that the file-read instructions in the subset of unique file operations are abnormal based at least in part on a deviation between the pattern of the file-read instructions in the time interval and the normal pattern of file-read instructions;
- responsive to determining that the file-read instructions in the subset of unique file operations are abnormal, determining that the file system is subject to a threat;
- and
- generating an alert based at least in part on determining that the file system is subject to the threat.
6 more elements
Dependencies are inferred from the claim text.