Cloud File Integrity Monitoring With Timestamped Snapshot Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file integrity monitoring systems fail to effectively detect and respond to unauthorized changes in computer files, which can compromise cybersecurity, often missing nefarious user or malicious software activities.
Innovation Solution
A cloud-based file integrity monitoring service that utilizes an endpoint cybersecurity agent to capture and timestamp snapshots of file content changes, uploading them to the cloud for real-time analysis and comparison, alerting IT personnel to potential security risks and allowing for rollback of unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file integrity monitoring is implemented using traditional local systems, then file change detection capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent introduces an endpoint cybersecurity agent as an intermediary component that mediates between the monitored files and the cloud-based FIM service. This agent captures file system events locally and transmits them to the cloud, distributing system complexity across multiple components rather than concentrating it in a single complex local system.
Solution Approach 2:
The patent transitions file integrity monitoring from a local two-dimensional system (file to monitor) to a cloud-based three-dimensional system (file to monitor to cloud). By moving the analysis and storage functions to the cloud, the system reduces local device complexity while maintaining detection precision.
2Measurement precision
If continuous file monitoring is performed locally, then real-time detection accuracy is improved, but energy consumption and computational resources increase
Solution Approach 1:
The endpoint cybersecurity agent performs only partial monitoring actions locally by capturing specific file system events (creation, modification, deletion) rather than continuously analyzing all file operations. This selective event-based approach maintains real-time detection accuracy while significantly reducing local computational burden and energy consumption.
Solution Approach 2:
The system leverages the operating system's native file system event capabilities to self-generate monitoring data without requiring intensive local processing. The OS itself provides the file change notifications, and the agent simply captures and transmits these events, minimizing local energy consumption.
3Loss of information
If detailed file content snapshots are stored locally, then forensic analysis capability is improved, but storage space requirements increase
Solution Approach 1:
The system creates snapshots (copies) of file content at specific points in time and stores them in the cloud rather than maintaining multiple full copies locally. The endpoint agent captures file state information and transmits it to the cloud-based FIM service, which maintains the historical records for forensic analysis, thereby preserving information while reducing local storage requirements.
Solution Approach 2:
The patent moves storage capacity from the local device dimension to the cloud dimension. By utilizing cloud storage infrastructure, the system can maintain extensive forensic data sets without consuming local device storage space, effectively adding a new storage dimension to the architecture.
4Ease of operation
If centralized file monitoring is implemented, then security management control is improved, but response time to detect changes worsens
Solution Approach 1:
The endpoint cybersecurity agent performs preliminary actions by capturing and buffering file system events locally before transmission to the cloud. This preliminary local capture ensures that no file changes are missed during network interruptions or delays, maintaining detection response time while enabling centralized cloud-based analysis and management control.
Solution Approach 2:
The system implements a feedback mechanism where the cloud-based FIM service analyzes transmitted file events and provides responses back to the endpoint agent and administrators. This feedback loop enables centralized security management control while the rapid local-to-cloud transmission maintains timely detection response.
Data Source
AI summary
A cloud-based file integrity monitoring service identifies content changes to a computer file. An endpoint cybersecurity agent monitors its host client device for read/write and other operating system events associated with the computer file. When the endpoint cybersecurity agent detects each operating system event, the endpoint cybersecurity agent captures and reports, in real time or near real time, a snapshot of the file content representing the computer file. So, as the host client device changes the computer file with each operating system event, the endpoint cybersecurity agent uploads timestamped snapshots of the file content to a cloud-based file integrity monitoring service. The cloud-based file integrity monitoring service stores each snapshot of the file content, thus logging a change history for the computer file. The cloud-based file integrity monitoring service may thus retrieve and analyze different snapshots at different points in time, thus quickly identifying the content changes to the computer file.