File System Attack Detection via Statistical Process Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting and mitigating attacks on file systems, such as those by malware, human actors, and bots, are limited in providing real-time notification and often fail to identify affected users or effectively manage false positives, impacting performance and missing novel signatures.
Innovation Solution
A data processing system employs statistical process control to detect abnormal file access patterns by analyzing network-layer traffic, setting file access limits, and building a file access index to temporarily suspend access and provide notifications, while also reverting to prior versions of file system objects to mitigate attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If status-based techniques monitor system changes at regular time intervals, then system security monitoring is provided, but real-time detection and rapid notification of attacks is not achieved
Solution Approach 1:
The patent replaces mechanical status-based monitoring with a statistical process control system that uses mathematical models and algorithms to analyze file access patterns in real-time. The system transforms discrete status checks into continuous statistical analysis, enabling immediate detection of abnormal patterns as they occur rather than waiting for scheduled monitoring intervals.
2Reliability
If signature-based malware detection is used, then malware detection capability is provided, but computational load increases and false positive detections occur
Solution Approach 1:
The patent extracts the detection function from signature-based methods and implements a behavior-based statistical analysis system. Instead of comparing file signatures against known malware databases, the system extracts and analyzes file access pattern behaviors, detecting anomalies through statistical deviations from normal patterns. This extraction eliminates the computational burden of signature matching while maintaining detection effectiveness.
Solution Approach 2:
The patent changes the detection parameter from static file signatures to dynamic access pattern statistics. By monitoring parameters such as access frequency, timing patterns, and user behavior metrics, the system detects malware based on behavioral anomalies rather than signature matching, significantly reducing computational load and false positives.
3Reliability
If signature-based malware detection is used, then malware detection is provided, but detection of novel signatures is not achieved
Solution Approach 1:
The patent implements a self-adapting statistical model that automatically learns and updates normal file access patterns without requiring manual signature updates. The system continuously analyzes file access behaviors and adjusts its statistical parameters to reflect changing normal patterns, enabling automatic detection of novel malware that deviates from learned behaviors without needing pre-defined signatures for each new threat.
4Reliability
If status-based techniques are used, then system monitoring is provided, but identification of affected users is not achieved
Solution Approach 1:
The patent segments the monitoring system to specifically track and identify user-level file access patterns. By creating separate statistical profiles for different users and analyzing their individual access behaviors, the system can identify which specific users are affected by malware or engaged in unauthorized activities, providing granular user-level information that status-based system-wide monitoring cannot provide.
Data Source
AI summary
Techniques are disclosed to detect, isolate, and/or mitigate an attack on a file system, for example, by malicious software, human actors, and/or compromised Internet-connected devices (bots). A processor of a data processing system detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets. Based on detecting the abnormal file system access pattern, the processor temporarily suspends file system access by at least one user ID contributing to the abnormal file system access pattern. The processor provides a notification identifying one or more file system object accessed in the abnormal file system access pattern.