File System Event Tracking via Pattern Aggregation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file system tracking applications do not efficiently compress or aggregate file operations, nor do they track user accounts making changes or identify specific file events effectively.
Innovation Solution
Implementing a method to intercept and record file system events before and after execution, allowing for aggregation of predefined patterns into single events, and tracking user account information for improved reporting and security change history.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If file system events are tracked in detail without aggregation, then complete event history is recorded, but the number of logged events becomes excessively large and difficult to analyze
Solution Approach 1:
The patent applies preliminary action by defining and configuring aggregation rules beforehand that automatically group related file system events. The system pre-establishes patterns for identifying related events (such as multiple file accesses by the same user within a time window) and automatically applies these patterns to aggregate events before reporting, thus reducing the volume of data for analysis while preserving meaningful information.
Solution Approach 2:
The patent changes parameters by dynamically adjusting aggregation criteria based on user-defined parameters such as time windows, user accounts, file paths, and event types. By modifying these parameters, the system can flexibly control the degree of aggregation to balance between information completeness and report readability, allowing users to customize the level of detail in generated reports.
2Reliability
If all file system events are logged individually, then detailed security audit trail is maintained, but storage requirements and processing overhead increase significantly
Solution Approach 1:
The patent applies merging by combining multiple individual file system events into single aggregated event records when they match predefined patterns. For example, multiple file access events by the same user account within a specified time period are merged into one aggregated event that preserves the essential security audit information while significantly reducing the total number of records stored.
Solution Approach 2:
The patent applies discarding and recovering by selectively discarding redundant event details that are already captured in aggregated form, while recovering and preserving the essential security-relevant information through aggregation metadata such as event counts, time ranges, and affected file lists. This allows the system to maintain security audit accuracy without storing every individual event detail.
3Reliability
If file system tracking monitors every user action, then comprehensive security monitoring is achieved, but system performance and responsiveness deteriorate
Solution Approach 1:
The patent applies preliminary action by pre-configuring aggregation rules and filters that determine which events should be tracked and how they should be grouped. This allows the system to efficiently process events by applying predetermined logic rather than analyzing every event in real-time, thus maintaining comprehensive security monitoring coverage while preserving system performance.
Solution Approach 2:
The patent applies partial action by selectively monitoring and aggregating only those file system events that match predefined criteria such as specific user accounts, file paths, or event types. This approach provides comprehensive security monitoring for critical areas while reducing the overall processing burden, thereby maintaining system responsiveness.
Data Source
AI summary
Automated file system event tracking and reporting techniques are described in which file system events requested by a user application are intercepted and recorded prior to the request being permitted to pass to the file system for execution. Similarly, file system responses to a prior captured file system event are also intercepted and recorded. Predefined patterns of file system event may be aggregated and reported as a single event.