File System Access Pattern Analysis for Suspicious Activity Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current systems lack the ability to detect file prospecting activity effectively, distinguishing between legitimate and malicious uses, and fail to identify open-ended browsing within file systems, making it difficult to prevent data loss and persistent threats.

Innovation Solution

Monitoring file system access patterns over a specific period, calculating lexicographic or mathematical distances between successive accesses, and reducing these distances to baseline statistics to detect anomalies indicative of suspicious activity, which triggers alerts for potential malicious behavior.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional supervised learning techniques are used to detect file prospecting, then detection accuracy can be improved, but the system requires ground truth labels which are lacking and impracticable to create for all file system access activity

Engineering Contradiction:

Improvedetection accuracyVSAvoiddata labeling complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system performs self-training by automatically generating labels from unlabeled file access data through clustering algorithms. The system serves itself by creating its own training data without external annotation, allowing it to learn patterns of legitimate versus malicious file prospecting behavior autonomously

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs preliminary unsupervised learning to generate initial labels and cluster patterns before deploying supervised detection. This preliminary action creates a foundation of labeled data that enables subsequent accurate detection without requiring manual annotation of all access activity

Inventive Principle:

Principle #10Preliminary action

2Productivity

If conventional systems monitor file access frequency with thresholds, then simple anomalies can be detected, but the systems cannot identify file prospecting activity or distinguish between legitimate and malicious patterns

Engineering Contradiction:

Improvedetection speedVSAvoidprospecting detection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system transitions from monitoring single-file access frequency to analyzing sequences of file access operations across multiple dimensions. By examining the temporal sequence and patterns of multiple file accesses rather than isolated events, the system can distinguish prospecting behavior from normal access while maintaining detection speed

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Reliability

If conventional systems establish typical file access patterns, then anomalous access can be detected, but the systems require long windows of time (months or years) to establish baseline patterns

Engineering Contradiction:

Improveanomaly detection reliabilityVSAvoidbaseline establishment time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system uses a shorter time window than conventional systems by focusing on the essential pattern elements that can be reliably established in less time. Rather than requiring months or years of data, the system identifies sufficient statistical patterns in a condensed timeframe to detect anomalies with acceptable reliability

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The system changes the parameters of baseline establishment by using statistical methods that can derive meaningful patterns from shorter time periods. By adjusting the temporal parameters and using more efficient statistical aggregation, the system reduces the time required to establish reliable baselines while maintaining detection accuracy

Inventive Principle:

Principle #35Parameter changes

4Quantity of substance

If the system monitors all file system access activity, then comprehensive data is collected, but the unlabeled noisy mixture makes it impracticable to create ground truth labels

Engineering Contradiction:

Improvemonitoring coverageVSAvoidlabeling feasibility

Core Design Contradiction:

Quantity of substanceVSEase of manufacture

Solution Approach 1:

The system extracts meaningful patterns from the noisy unlabeled mixture by applying clustering algorithms that separate legitimate from malicious access patterns. By extracting the essential signal from the noise through unsupervised learning, the system creates usable labels without requiring manual annotation of all comprehensive monitoring data

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS10037425B2Detecting suspicious file prospecting activity from patterns of user activity

Publication Date: 2018.07.31 GEN DIGITAL INC

AI summary

Suspicious file prospecting activity is detected based on patterns of file system access. A user's file system access is monitored over a specific time period. A sequence of the file accesses (e.g., represented as path names) made by the user during the time period is recorded. Distances between the recorded file accesses are determined, for example as edit distances. A distance sequence is recorded, comprising a record of the determined distances. The distance sequence is reduced to one or more baseline statistics describing the pattern of the user's access of the file system during the given period of time. At least one subsequent anomaly in the user's access of the file system is detected, by comparing at least one subsequently calculated statistic representing at least one subsequent pattern of the user's file system access to the at least one baseline statistic.