Dynamic Session Recording Optimizes Storage for Audit Trails
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As enterprise and cloud applications become more complex, preventing inappropriate access and detecting unauthorized activities across user accounts becomes increasingly challenging.
Innovation Solution
A system and method for monitoring and recording user sessions in a computing environment, utilizing an account management system that captures and compares screen captures to determine active sessions, optimizing processor, storage, and network usage by discarding idle captures and focusing on meaningful visual changes, with the ability to configure snapshot frequency and ignore irrelevant changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all user session screen captures are recorded continuously, then complete audit trail is maintained, but storage resources and processing overhead increase significantly
Solution Approach 1:
The system changes the parameter of recording frequency dynamically - recording at high frequency during active user sessions and at low frequency during idle periods. This allows maintaining complete audit trails for active sessions while significantly reducing storage resource usage during inactive periods, directly resolving the contradiction between audit completeness and storage consumption
Solution Approach 2:
The recording system transitions from a static continuous recording mode to a dynamic mode where recording intensity adapts to system state. The system actively monitors for user activity and adjusts recording behavior accordingly, maintaining reliability when needed while optimizing resource usage when not needed
2Measurement precision
If screen capture frequency is increased to detect all activities, then detection precision improves, but processor usage and energy consumption increase
Solution Approach 1:
The system applies partial action by recording screen captures at full frequency only when user activity is detected, and at reduced frequency or not at all during idle periods. This ensures detection precision is maintained for actual activities while avoiding excessive processor energy consumption during inactive periods
Solution Approach 2:
The system takes preliminary action by detecting user activity states and preemptively adjusting recording frequency before resource consumption becomes excessive. By monitoring for activity indicators and adjusting recording behavior in advance, the system maintains detection precision while preventing unnecessary energy consumption
3Reliability
If all screen captures are stored for forensic analysis, then forensic capability is enhanced, but storage requirements and data management complexity increase
Solution Approach 1:
The system changes the parameter of data retention duration and volume based on activity detection - maintaining high-fidelity captures for active sessions and reducing storage for idle periods. This enhances forensic capability for actual user activities while reducing data management complexity by avoiding storage of redundant idle captures
Solution Approach 2:
The system discards low-value screen captures taken during clearly idle periods while retaining high-value captures from active sessions. This selective discarding maintains forensic capability for meaningful activities while reducing storage requirements and data management complexity
Data Source
AI summary
A system and method can monitor one or more user sessions on a target system in a computing environment. An account managing system can capture a plurality of user session screen captures that are associated with said one or more user sessions on the target system. Furthermore, the account managing system can compare a user session screen capture, which is captured at a time during said one or more user sessions, with one or more user session screen captures that are recorded before the time. Then, the account managing system can record said user session screen capture if the target system is determined to be active at the time when said user session screen capture is captured.