Securing data lakes via object store monitoring
AssigneeImperva, Inc.
InventorOri Nakar
Life of this patent
Estimating the term…
Abstract
Embodiments of the present disclosure provide a method for detecting security incidents in an object store by aggregating log files generated by a monitoring program of the object store and monitoring the aggregated log data. A processing device may periodically execute database operations to access data stored in the object store. In response to each database operation, an access log set may be generated and stored in an access log storage. The processing device may periodically aggregate access log data from a plurality of access log sets currently stored in the access log storage to generate aggregated log data. The processing device may then monitor the aggregated log data over time to identify one or more security incidents of the object store.
Claims20
A method comprising:
- periodically executing database operations, each database operation to access data stored in an object store;
- in response to each database operation, generating an access log set and storing the access log set in an access log storage;
- periodically aggregating, by a processing device, access log data from a plurality of access log sets currently stored in the access log storage to generate aggregated log data;
- and
- monitoring the aggregated log data over time to identify one or more security incidents of the object store.
A system comprising:
- a memory;
- and
- a processing device, operatively coupled to the memory, the processing device to:
- periodically execute database operations, each database operation to access data stored in an object store;
- in response to each database operation, generate an access log set and storing the access log set in an access log storage;
- periodically aggregate access log data from a plurality of access log sets currently stored in the access log storage to generate aggregated log data;
- and
- monitor the aggregated log data over time to identify one or more security incidents of the object store.
A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:
- periodically execute database operations, each database operation to access data stored in an object store;
- in response to each database operation, generate an access log set and storing the access log set in an access log storage;
- periodically aggregate, by the processing device, access log data from a plurality of access log sets currently stored in the access log storage to generate aggregated log data;
- and
- monitor the aggregated log data over time to identify one or more security incidents of the object store.
Dependencies are inferred from the claim text.