Context-Based External Storage Copy Detection

The patent applies local quality by differentiating between malicious and legitimate copy operations through context analysis. Instead of uniformly blocking all copy operations, the system analyzes specific characteristics of each copy event (source file type, destination device, user behavior patterns, timing) to determine whether to allow or block the operation. This selective approach maintains security while permitting legitimate transfers.

The system changes parameters by monitoring multiple contextual variables simultaneously (file type, device identifier, user activity state, copy frequency, time of day) rather than relying on a single binary block/allow decision. By evaluating changes in these parameters across multiple dimensions, the system can distinguish between normal and suspicious copy behaviors and respond appropriately.

The patent applies segmentation by dividing the monitoring system into distinct functional modules: event loggers that capture raw data, analysis engines that process specific event types, pattern recognition components that identify suspicious behaviors, and response systems that execute appropriate actions. This modular architecture improves detection accuracy through specialized processing while managing complexity through clear separation of concerns.

The system performs preliminary action by pre-establishing baselines of normal user behavior and pre-defining suspicious patterns before actual copy operations occur. By having detection rules and analysis frameworks ready in advance, the system can quickly evaluate copy events without complex real-time computation, improving detection accuracy while reducing operational complexity.