Back to results
US 2023/0069769 A1Published application
Real-time detection of system threats
AssigneeRubrik, Inc.
InventorsShanthi Kiran Pendyala, Di Wu, Mathew Edward Noe
Life of this patent
Estimating the term…
Abstract
Some examples relate generally to managing and storing data, and more specifically to the real-time detection of ransomware, system (or insider) threats, or the misappropriation of credentials by using file system audit events.
Claims20
A method for detection of whether a file system is infected with malware, the method comprising:
- accessing audit events in the file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
- de-duplicating the audit events to remove the duplicative file operations and retain the unique file operations from the audit events;
- generating time series data that comprises the unique file operations and is devoid of the duplicative file operations;
- analyzing the time series data to determine whether a subset of the unique file operations includes delete instructions to delete files corresponding to the subset of unique file operations;
- comparing a pattern of the delete instructions in the time interval to a normal pattern of delete instructions;
- determining, based at least in part on the comparing, that the delete instructions in the subset of unique file operations are abnormal based at least in part on a deviation between the pattern of the delete instructions in the time interval and the normal pattern of delete instructions;
- responsive to determining that the delete instructions in the subset of unique file operations are abnormal, determining that the file system is infected with malware;
- and
- generating an alert based at least in part on determining that the file system is infected with malware.
6 more elements
An apparatus for managing virtual machines, comprising:
- at least one processor;
- memory coupled with the processor;
- and
- instructions stored in the memory and executable by the at least one processor to cause the apparatus to:
- access audit events in a file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
- de-duplicate the audit events to remove the duplicative file operations and retain the unique file operations from the audit events;
- generate time series data that comprises the unique file operations and is devoid of the duplicative file operations;
- analyze the time series data to determine whether a subset of the unique file operations includes delete instructions to delete files corresponding to the subset of unique file operations;
- compare a pattern of the delete instructions in the time interval to a normal pattern of delete instructions;
- determine, based at least in part on the comparing, that the delete instructions in the subset of unique file operations are abnormal based at least in part on a deviation between the pattern of the delete instructions in the time interval and the normal pattern of delete instructions;
- responsive to determining that the delete instructions in the subset of unique file operations are abnormal, determine that the file system is infected with malware;
- and
- generate an alert based at least in part on determining that the file system is infected with malware.
10 more elements
A non-transitory computer-readable medium storing code for managing virtual machines, the code comprising instructions executable by at least one processor to:
- access audit events in a file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
- de-duplicate the audit events to remove the duplicative file operations and retain the unique file operations from the audit events;
- generate time series data that comprises the unique file operations and is devoid of the duplicative file operations;
- analyze the time series data to determine whether a subset of the unique file operations includes delete instructions to delete files corresponding to the subset of unique file operations;
- compare a pattern of the delete instructions in the time interval to a normal pattern of delete instructions;
- determine, based at least in part on the comparing, that the delete instructions in the subset of unique file operations are abnormal based at least in part on a deviation between the pattern of the delete instructions in the time interval and the normal pattern of delete instructions;
- responsive to determining that the delete instructions in the subset of unique file operations are abnormal, determine that the file system is infected with malware;
- and
- generate an alert based at least in part on determining that the file system is infected with malware.
6 more elements
Dependencies are inferred from the claim text.