Automated File Access Forensic Analysis Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures lack the ability to automatically determine typical file access patterns and detect abnormal file access attempts, leading to potential security risks due to excessive permissions configurations.
Innovation Solution
An automated mechanism that monitors file access requests, collects call information from runtime stacks, compares access patterns, and takes action on abnormal requests to enhance security by adjusting permissions and detecting potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If broad permission settings are configured for users, then ease of operation is improved, but security is worsened due to excessive permissions allowing attackers to easily access and exfiltrate data
Solution Approach 1:
The system performs preliminary actions by monitoring and analyzing file access requests before final permission decisions are made. It collects call information from runtime stacks, determines typical access patterns in advance, and establishes a baseline of normal behavior. When an abnormal request is detected, the system can take preventive action such as blocking the request or alerting administrators, thus maintaining security while allowing broad permissions to remain in place for ease of operation.
2Measurement precision
If detailed monitoring of file access requests is implemented, then security detection capability is improved, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary component that sits between the file access request and the permission checking mechanism. This intermediary monitors file access requests, collects call information from runtime stacks, and analyzes access patterns without requiring fundamental changes to the underlying operating system or application architecture. The intermediary processes the monitoring logic separately, making the system more modular and easier to implement while achieving detailed security monitoring.
3Productivity
If automated analysis of runtime stack information is performed, then productivity of security monitoring is improved, but loss of time for processing increases
Solution Approach 1:
The system applies partial action by selectively monitoring only the necessary call information from runtime stacks rather than analyzing every single detail of each file access request. It focuses on collecting specific parameters such as the calling application identity, file path, and access type, which are sufficient to determine access patterns. This selective approach maintains automated analysis productivity while minimizing processing time by avoiding unnecessary data collection and analysis.
Data Source
AI summary
Systems, methods, and computer program products to perform an operation comprising monitoring a set of file access requests to a file from a first application to obtain a set of call information based on runtime stack information related to calls of the first application requesting access to the file, storing the set of call information in a data file, receiving a request for access to the file from a second application, obtaining call information from a runtime stack from the second application, comparing the call information with the set of call information, determining the request for access is an abnormal request based on the comparing, and taking an action based on the determination.