US 12,348,537 B2Granted

Determining trusted file awareness via loosely connected events and file attributes

AssigneeCode42 Software, Inc.

InventorsBradley David Bebchuk, Elizabeth Verity Hammon Macgregor, Rohit Kumar Bagda, Shane Zako, Trevor Michael Tungseth, Nicholas Alexander Winninger, Erik Allan Hagen, Eric Tracy Christensen

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Disclosed in some examples are methods, systems, devices, and machine-readable mediums which monitor for file system element transfers to and from both the endpoint and authorized accounts on network-based service providers (e.g., cloud-based storage). The system uses the capabilities of monitoring both the network-based service and the client computing device to filter out legitimate uploads to authorized network-based services and legitimate downloads to authorized computing devices. By matching events, it filters out events that are likely legitimate, the system may provide more accurate information, notifications, awareness, and unmatched event indications.

Claims20

Dependent claims

A method for detecting file system element exfiltration to or from a network-based service, the method comprising:

receiving a first file system element event from a first source type, the first file system element event describing events associated with a file system element of a file system corresponding to the first source type, wherein the first source type is one of a client computing device or the network-based service;
determining whether the first file system element event from the first source type corresponds to any file system element events in a set of previously received file system element events corresponding to a second source type, wherein the second source type is the client computing device when the first source type is the network-based service and the network-based service when the first source type is the client computing device, wherein the determination is based at least in part on:
a comparison of an identifier indicative of an identity of a file system element associated with the first file system element event to identities of file system elements associated with the previously received file system element events, wherein the identifier is derived from one or more attributes of a corresponding file system element;
and
a comparison of a timestamp associated with the first file system element event to timestamps associated with the previously received file system element events, wherein the events match only if the timestamps are within a predetermined time threshold of each other;
responsive to determining that the first file system element event from the first source type does not correspond to any of the file system element events in the set of the previously received file system element events from the second source type, tagging the first file system element event as unmatched;
and
transmitting, over a network, an indication that the first file system element event is unmatched to a computing device.

5 more elements

A computing device for detecting file system element exfiltration to or from a network-based service, the computing device comprising:

a hardware processor;
a memory, the memory storing instructions, which when executed by the hardware processor cause the computing device to perform operations comprising:
receiving a first file system element event from a first source type, the first file system element event describing events associated with a file system element of a file system corresponding to the first source type, wherein the first source type is one of a client computing device or the network-based service;
determining whether the first file system element event from the first source type corresponds to any file system element events in a set of previously received file system element events corresponding to a second source type, wherein the second source type is the client computing device when the first source type is the network-based service and the network-based service when the first source type is the client computing device, wherein the determination is based at least in part on:
a comparison of an identifier indicative of an identity of a file system element associated with the first file system element event to identities of file system elements associated with the previously received file system element events, wherein the identifier is derived from one or more attributes of a corresponding file system element;
and
a comparison of a timestamp associated with the first file system element event to timestamps associated with the previously received file system element events, wherein the events match only if the timestamps are within a predetermined time threshold of each other;
responsive to determining that the first file system element event from the first source type does not correspond to any of the file system element events in the set of the previously received file system element events from the second source type, tagging the first file system element event as unmatched;
and
transmitting, over a network, an indication that the first file system element event is unmatched to a second computing device.

7 more elements

A non-transitory machine-readable medium, storing instructions for detecting file system element exfiltration to or from a network-based service, the instructions, which when executed, cause a machine to perform operations comprising:

receiving a first file system element event from a first source type, the first file system element event describing events associated with a file system element of a file system corresponding to the first source type, wherein the first source type is one of a client computing device or the network-based service;
determining whether the first file system element event from the first source type corresponds to any file system element events in a set of previously received file system element events corresponding to a second source type, wherein the second source type is the client computing device when the first source type is the network-based service and the network-based service when the first source type is the client computing device, wherein the determination is based at least in part on:
a comparison of an identifier indicative of an identity of a file system element associated with the first file system element event to identities of file system elements associated with the previously received file system element events, wherein the identifier is derived from one or more attributes of a corresponding file system element;
and
a comparison of a timestamp associated with the first file system element event to timestamps associated with the previously received file system element events, wherein the events match only if the timestamps are within a predetermined time threshold of each other;
responsive to determining that the first file system element event from the first source type does not correspond to any of the file system element events in the set of the previously received file system element events from the second source type, tagging the first file system element event as unmatched;
and
transmitting, over a network, an indication that the first file system element event is unmatched to a computing device.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/658,288Filed 8 May 2024 · continuation
Priority: 7 Sep 2021
Published: US 2024/0364713 A131 Oct 2024
Granted: 1 Jul 2025
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 16/1734
Details of further file system functions: details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 16/164
File or folder operations, e.g. details of user interfaces specifically adapted to file systems: file meta data generation
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies

Family

Application17/468,285Parent of this continuation · filed 7 Sep 2021
US 2024/0364713 A1Pre-grant publication · published 31 Oct 2024
US 12,003,518 B2Parent of this continuation
US 2023/0076201 A1Published application
US 12,348,537 B2This patent

From the US filing history. Foreign family members aren’t listed.