Systems and methods for quantifying file access risk exposure by an endpoint in a network environment

A system for flagging suspicious file access behavior, the system comprising:

• a processing resource;
• a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
• calculate a file access metric based at least in part on a first file access path, a second file access path, and a third file access path, wherein the first file access path, the second file access path, and the third file access path each indicate respective file access attempts performed using an endpoint device;
• compare the file access metric with a threshold value;
• and
• report suspicious file access behavior by the endpoint device based upon the comparison of the file access metric and the threshold value;
• wherein further
• the file access metric is a file access variance indicating a variance across at least the first file access path, the second file access path, and the third file access path;
• and wherein an increase in the value of the file access metric indicates a greater likelihood that the endpoint device has been used for malicious file accesses;
• calculating the file access metric includes calculating:
• a first distance between the first file access path and the second file access path, a second distance between the first file access path and the third file access path, a third distance between the second file access path and the third file access path;
• and
• calculating the first distance includes:
• calculating a first root distance between a root and a file indicated in the first file access path, calculating a second root distance between the root and a file indicated in the second file access path, calculating a third root distance between the root and a farthest common ancestor in both the first file access path and the second file access path, and combining the first root difference, the second root difference, and the third root distance to yield the first distance.

A method for flagging suspicious file access behavior, the method comprising:

• calculating, by a processing resource, a file access metric based at least in part on a first file access path, a second file access path, and a third file access path, wherein
• the first file access path, the second file access path, and the third file access path each indicate respective file access attempts performed using an endpoint device;
• the file access metric is a file access variance indicating a variance across at least the first file access path, the second file access path, and the third file access path;
• and wherein an increase in the value of the file access metric indicates a greater likelihood that the endpoint device has been used for malicious file accesses;
• calculating the file access metric includes calculating:
• a first distance between the first file access path and the second file access path, a second distance between the first file access path and the third file access path, a third distance between the second file access path and the third file access path;
• calculating the first distance includes:
• calculating a first root distance between a root and a file indicated in the first file access path, calculating a second root distance between the root and a file indicated in the second file access path, calculating a third root distance between the root and a farthest common ancestor in both the first file access path and the second file access path, scaling the first root distance by a first scaling factor to yield a first scaled root distance, scaling the second root distance by a second scaling factor to yield a second scaled root distance, scaling the third root distance by a third scaling factor to yield a third scaled root distance, and combining the first scaled root difference, the second scaled root difference, and the third scaled root distance to yield the first distance.