File Access Time Instrumentation for Low-Overhead Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack effective methods to identify files accessed by applications for detecting unusual behavior or malicious activity, as they rely on inefficient and performance-heavy mount options for access time updates.
Innovation Solution
Implementing atime instrumentation by setting initial access times for files, updating them upon access, and identifying files with changed access times to detect accessed subsets, using kernel features and instrumentation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional mount options are used for access time updates, then file access detection is achieved, but performance penalty increases
Solution Approach 1:
The patent extracts the access time tracking functionality from the traditional mount option mechanism and implements it through a separate instrumentation system. The instrumentation uses kernel-level hooks and access time value manipulation to track file accesses without relying on the performance-heavy mount options, thereby maintaining detection accuracy while reducing performance penalty.
Solution Approach 2:
The patent introduces an intermediary instrumentation layer between the application and the file system. This intermediary uses access time values as a mediator to track file accesses indirectly, avoiding the need for direct monitoring through traditional mount options. The instrumentation modifies access time values in a controlled manner to enable detection without the performance overhead of conventional methods.
2Measurement precision
If access time updates are performed frequently, then file access identification is improved, but system overhead increases
Solution Approach 1:
The patent applies preliminary action by initializing access time values to a predetermined state before the instrumentation begins. This setup allows the system to detect only meaningful changes in access time values during execution, rather than continuously updating and processing every access event. The preliminary initialization establishes a baseline that reduces the overhead of subsequent access time monitoring.
Solution Approach 2:
The patent utilizes parameter changes by manipulating access time values as a key parameter for file access detection. Instead of frequently updating and processing multiple time parameters, the instrumentation focuses on changes in the access time value itself. By tracking only the delta in access time values rather than continuous updates, the system achieves accurate file identification with reduced system overhead.
Data Source
AI summary
A computer sets an access time for a set of files to an initial value. Upon accessing a file by a set of executables, the computer sets the access time of the file to a new value. The computer identifies, from the set of files, a subset of files accessed by the set of executables based on the access time of files in the subset being different from the initial value. The computer provides an output representing the subset of files.