# US 12,216,805 B2 · Monitoring file sharing commands between network equipment to identify adverse conditions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,805 B2 - Document ID: US12216805B2 - Status: Granted - Kind: B2 - Application number: 17/721,184 - Filed: 2022-04-14 - Published: 2023-10-19 - Granted: 2025-02-04 - Earliest claimed: 2022-04-14 - Assignees: Dell Products L.P. - Applicants: Dell Products, L.P. - Inventors: Maxim Balin; Tomer Shachar; Yevgeni Gehtman - Web page: https://patentgrep.com/patent/US12216805B2 ## CPC - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 21/31: User authentication - G06F 21/554: {involving event detection and direct action} - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The technologies described herein are generally directed toward monitoring file sharing commands between network equipment to identify adverse conditions. According to an embodiment, a system can comprise a processor and a memory that can enable performance of operations including monitoring resource sharing communication between first network equipment and second network equipment via a network. In one or more embodiments, the method can additionally include based on the resource sharing communication, detecting a condition of the resource sharing communication that has a likelihood of indicating a defined adverse event that has at least a threshold likelihood. Further, the method can include, but are not limited to, in response to detecting the condition, facilitating suspending the resource sharing communication between the first network equipment and the second network equipment. ## Claims ### Claim 1 A method, comprising: monitoring, by security equipment comprising a processor, resource sharing communication between first network equipment and second network equipment via a network; based on the resource sharing communication, determining, by the security equipment, an access activity pattern comprising one or more access command metrics, resulting in a determined access activity pattern; determining that the one or more access command metrics correspond to the determined access activity pattern having at least a likelihood of indicating a data leakage event based on a normal access activity pattern that comprises one or more normal access command metrics; and in response to determining that the one or more access command metrics has at least the likelihood of indicating the data leakage event, facilitating, by the security equipment, a mitigation action being performed to mitigate the data leakage event, wherein the resource sharing communication comprises one or more commands from the first network equipment to access storage units stored by the second network equipment, and wherein the one or more commands from the first network equipment to the access storage units stored by the second network equipment comprise a connect command followed by a read command followed by a disconnect command, and wherein the one or more access command metrics of the determined access activity pattern comprise copying all files in a directory after the connect command and disconnecting after all of the files in the directory have been copied without other commands from the first network equipment to the access storage units stored by the second network equipment occurring between the connect command and the disconnect command. ### Claim 2 (depends on 1) The method of claim 1, wherein the resource sharing communication comprises communication via a server message block protocol. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more commands from the first network equipment to the access storage units stored by the second network equipment comprise a COPY command, and wherein the one or more access command metrics of the determined access activity pattern comprise copying a number of files that exceeds, by a selected copied files variance amount, a normal number of files copied during a time of day that a determined access activity associated with the determined access activity pattern occurred. ### Claim 4 (depends on 1) The method of claim 1, wherein the one or more commands from the first network equipment to the access storage units stored by the second network equipment comprise a COPY command, and wherein the one or more access command metrics of the determined access activity pattern comprise copying one or more specific storage units. ### Claim 5 (depends on 1) The method of claim 1, wherein the one or more commands from the first network equipment to the access storage units stored by the second network equipment comprise a COPY command, and wherein the one or more access command metrics of the determined access activity pattern comprise periodically copying, by the first network equipment, storage units from the second network equipment. ### Claim 6 (depends on 1) The method of claim 1, wherein the one or more commands from the first network equipment to the access storage units stored by the second network equipment comprise a TREE_CONNECT command, and wherein the one or more access command metrics of the determined access activity pattern comprise a number of TREE_CONNECT requests, during a selected monitoring period, that exceeds, by a selected TREE_CONNECT request attempt variance amount, a normal number of TREE_CONNECT request attempts during a period having a length of the monitoring period during which a normal number of TREE_CONNECT requests are sent from the first network equipment to the second network equipment. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more access command metrics of the determined access activity pattern comprise one or more status messages in response to the one or more commands from the first network equipment to the access storage units stored by the second network equipment that indicate an access activity pattern corresponds to behavior other than baseline behavior corresponding to a storage unit. ### Claim 8 (depends on 1) The method of claim 1, wherein the mitigation action comprises at least one of: denying permission to access storage of the access storage units of the second network equipment by the first network equipment, disconnecting the first network equipment from the network, or generating a report for rendering at the second network equipment that the one or more access command metrics have at least the likelihood of indicating the data leakage event. ### Claim 9 Server equipment, comprising: at least one processor; and at least one memory that stores executable instructions that, when executed by the at least one processor, facilitate performance of operations, comprising: monitor resource sharing communication between first network equipment and second network equipment via a network; based on the resource sharing communication, determine an access activity pattern comprising at least one access command metric, resulting in a determined access activity pattern; determine that the at least one access command metric corresponds to the determined access activity pattern having at least a threshold likelihood of indicating a data leakage event based on a normal access activity pattern that comprises at least one normal access command metric; and in response to determining that the at least one access command metric has at least the threshold likelihood of indicating a data leakage event, cause a mitigation action to mitigate a potential effect of the data leakage event, wherein the resource sharing communication comprises at least one command from the first network equipment to access storage units stored by the second network equipment, and wherein the at least one command from the first network equipment to access storage units by the second network equipment comprises a connect command followed by a read command followed by a disconnect command, wherein the at least one access command metric of the determined access activity pattern comprises copying all files in a directory after the connect command and disconnecting after all of the files in the directory have been copied without other commands from the first network equipment to access storage units stored by the second network equipment occurring between the connect command and the disconnect command. ### Claim 10 (depends on 9) The server equipment of claim 9, wherein the resource sharing communication comprises communication via a server message block protocol. ### Claim 11 (depends on 9) The server equipment of claim 9, wherein the mitigation action comprises disconnecting the first network equipment from the network. ### Claim 12 (depends on 9) The server equipment of claim 9, wherein the mitigation action comprises providing a user report to the second network equipment indicating that the at least one access command metric has at least the threshold likelihood of indicating the data leakage event. ### Claim 13 (depends on 9) The server equipment of claim 9, wherein the at least one access command metric of the determined access activity pattern comprises at least one status message in response to the at least one command from the first network equipment to access storage units stored by the second network equipment that indicate an access activity pattern corresponds to behavior other than baseline behavior corresponding to a storage unit. ### Claim 14 (depends on 9) The server equipment of claim 9, wherein the mitigation action comprises denying permission to access storage of the second network equipment by the first network equipment. ### Claim 15 A non-transitory machine-readable medium, comprising executable instructions that, when executed by at least one processor of first network equipment, facilitate performance of operations, comprising: monitor resource sharing communication between second network equipment and third network equipment via a network; based on the resource sharing communication, determine an access activity pattern comprising an access command metric; determine that the access command metric corresponds to the access activity pattern having a threshold likelihood of indicating a data leakage event based on a normal access activity pattern that comprises a normal access command metric; and in response to determining that the access command metric has the threshold likelihood of indicating a data leakage event, initiate a mitigation action selected to mitigate the data leakage event, wherein the at least one access command metric corresponds to copying all files in at least one storage unit after a connect command and disconnecting after all of the files in the at least one storage unit have been copied without other commands to access the at least one storage unit occurring between the connect command and the disconnect command. ### Claim 16 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the resource sharing communication comprises a command from the second network equipment to access the at least one storage unit stored by the third network equipment. ### Claim 17 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the resource sharing communication comprises communication via a server message block protocol. ### Claim 18 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the mitigation action comprises denying permission to access storage of the third network equipment by the second network equipment. ### Claim 19 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the mitigation action comprises disconnecting the second network equipment from the network. ### Claim 20 (depends on 15) The non-transitory machine-readable medium of claim 15, wherein the mitigation action comprises sending a report to the third network equipment to indicate to a user associated with the third network equipment that the access command metric has the threshold likelihood of indicating the data leakage event.