Application Data Access Classification for Endpoint Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security techniques struggle to accurately differentiate between applications that merely access file metadata and those that manipulate file data, leading to false positives when blocking access to confidential information, as they often rely on data output formats that may be unknown or encrypted, and may not intercept all data output by programs.
Innovation Solution
A method and apparatus that monitor file access events to classify application behavior based on data access patterns, determining whether attempts are made to manipulate file data versus metadata, using read block sizes, read offsets, and the frequency of file access events to trigger appropriate actions such as scanning for confidential information and blocking access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If endpoint system blocks application file access to prevent data loss, then security protection is improved, but false positive rate increases
Solution Approach 1:
The patent applies local quality by analyzing specific characteristics of file access events (read block sizes, read offsets, frequency patterns) rather than treating all application file accesses uniformly. This enables differentiated security responses based on the actual nature of each access event, improving security while reducing false positives.
Solution Approach 2:
The system changes parameters by monitoring multiple dimensions of file access behavior (block sizes, offsets, event frequency) and using these parameter variations to distinguish between legitimate metadata scanning and malicious data manipulation attempts, thereby resolving the contradiction between security and false positives.
2Reliability
If endpoint system scans data output to detect confidential information, then data loss prevention is improved, but measurement precision deteriorates
Solution Approach 1:
The patent applies preliminary action by analyzing file access patterns and determining the application's intent to manipulate data before the actual data output occurs. This proactive approach allows the system to prepare appropriate security actions in advance, improving both prevention capability and measurement precision.
Solution Approach 2:
The system introduces an intermediary layer that monitors file access events between the application and the file system. This intermediary captures and analyzes access patterns, providing precise information about data manipulation attempts without being constrained by the limitations of scanning output data in various formats.
3Reliability
If endpoint system intercepts data output from program, then security monitoring is improved, but device complexity increases
Solution Approach 1:
The patent applies self-service by leveraging the file system's existing event generation capabilities. The file system automatically generates file access events that contain the necessary information (read block sizes, offsets, frequencies), eliminating the need for complex interception mechanisms and reducing endpoint system complexity while maintaining effective security monitoring.
Data Source
AI summary
A method and apparatus for classifying behavior of an application based on its data access pattern is described. In one embodiment, the method includes monitoring file access events associated with an application, and determining whether at least one of the file access events indicates the application's attempt to manipulate data of a file. If at least one file access event indicates the application's attempt to manipulate the data within the file, then at least one action is caused to be performed.