Malicious User Identification in Data Storage Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-attached storage (NAS) systems face challenges in identifying and managing malicious users who inadvertently or intentionally inject malware, leading to potential system infections and the need for cumbersome and error-prone manual processes to detect and prevent such threats.
Innovation Solution
Implementing a data storage system with a file tracking component to record user identities modifying files, a user monitor component to increment malware counts for users detected with malware, and an access control component to restrict usage when a user's malware count exceeds a threshold, thereby identifying and controlling malicious users and preventing further infections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual processes are used to detect and prevent malware, then system security can be maintained, but the process becomes cumbersome and error-prone
Solution Approach 1:
The system automatically tracks user identities, monitors malware infections, increments malware counts, and restricts access without human intervention. The access control component autonomously enforces security policies by comparing malware counts against thresholds and automatically restricting malicious users, eliminating the need for cumbersome manual security management processes
Solution Approach 2:
The system continuously monitors file modifications, scans for malware, and provides feedback by incrementing malware counts for infected users. This feedback loop enables the system to automatically adjust access restrictions based on real-time infection data, creating a dynamic security response that reduces manual intervention while maintaining high reliability
2Reliability
If malware scanning is performed on all files, then system security is improved, but resource usage increases
Solution Approach 1:
Instead of uniformly scanning all files, the system applies scanning selectively to files modified by users with existing malware counts or those exceeding thresholds. The access control component targets security resources locally at the level of specific users and files based on their infection history, reducing overall computational resource usage while maintaining security effectiveness
Solution Approach 2:
The system segments the scanning process by user identity and file modification history. The file tracking component and user monitor component divide the security workload into discrete user-specific segments, allowing the system to scan only relevant files for each user rather than performing exhaustive full-system scans, thereby reducing resource consumption
3Reliability
If user access is restricted based on malware count, then system integrity is improved, but user convenience deteriorates
Solution Approach 1:
The system dynamically changes user access parameters based on their malware count. Users start with normal access privileges, and as their malware count increases through infections, the access control component automatically adjusts their access parameters by restricting privileges or blocking access entirely. This parameter-based approach maintains user convenience for clean users while protecting system integrity through automated restrictions for malicious users
Data Source
AI summary
Identification and control of malicious users on a data storage system is described herein. A data storage system as described herein can include a file tracking component that records identities of users that have made at least one modification to a file stored on the data storage system, resulting in a set of recorded users; a user monitor component that increments respective malware counts associated with respective users of the set of recorded users in response to a malware scan of the file indicating that the file contains malware; and an access control component that restricts usage of the data storage system by a first user of the set of recorded users in response to a malware count associated with the first user exceeding a first threshold.