NAS Credential Misuse Detection via Audit Event De-duplication

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for detecting ransomware and unauthorized access in file systems are inadequate, as signature-based detection can be evaded, behavioral analysis is resource-intensive, and status-based detection systems do not provide real-time notification or identify affected users or unauthorized actors.

Innovation Solution

A Network Attached Storage (NAS) system that captures, de-duplicates, and analyzes file system audit events to identify anomalous activity, such as ransomware infections, insider threats, and credential misappropriation by processing unique file operations and comparing patterns to normal behavior, generating alerts for abnormal activity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If signature-based ransomware detection is used, then detection simplicity is maintained, but detection effectiveness deteriorates because ransomware can avoid detection by using different signatures

Engineering Contradiction:

Improvedetection simplicityVSAvoiddetection effectiveness

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The system transitions from detecting static file signatures to monitoring dynamic file operation parameters such as read/write frequencies, access patterns, and operation sequences. This parameter change enables detection of ransomware behavior regardless of the specific malware signature, maintaining simplicity while improving effectiveness

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces the mechanical signature-matching approach with a behavioral analysis system that monitors file system operations and detects anomalies based on operational patterns. This substitution allows detection without relying on known malware signatures, addressing the evasion problem

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If behavioral analysis-based approaches are used, then detection accuracy is improved, but computational resource consumption increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidcomputational resource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system applies behavioral analysis selectively to files and operations that exhibit suspicious patterns rather than continuously analyzing all file operations. This partial application maintains high detection accuracy for targeted threats while reducing overall computational resource consumption

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The monitoring system segments file operations into categories and applies different analysis depths to different segments. Routine operations receive minimal analysis while operations matching anomaly patterns trigger deeper behavioral analysis, balancing accuracy with resource efficiency

Inventive Principle:

Principle #1Segmentation

3Use of energy by moving object

If status-based detection systems are used, then system resource consumption is reduced, but real-time detection capability deteriorates because they look for system changes at specified time intervals

Engineering Contradiction:

Improvesystem resource consumptionVSAvoiddetection speed

Core Design Contradiction:

Use of energy by moving objectVSSpeed

Solution Approach 1:

The system implements continuous feedback loops that monitor file operations in real-time and immediately trigger alerts when anomalous patterns are detected. This feedback mechanism enables rapid detection without requiring intensive continuous resource allocation, as the system only activates full analysis when suspicious activity is indicated

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system uses periodic sampling of file operations combined with event-driven triggering. Normal operations are sampled at intervals to conserve resources, while specific trigger events initiate real-time monitoring, achieving both resource efficiency and fast detection when needed

Inventive Principle:

Principle #19Periodic action

4Use of energy by moving object

If status-based detection systems are used, then resource consumption is minimized, but ability to identify affected users or unauthorized actors deteriorates

Engineering Contradiction:

Improveresource consumptionVSAvoididentification information

Core Design Contradiction:

Use of energy by moving objectVSLoss of information

Solution Approach 1:

The system introduces audit event logs as an intermediary that captures user identification information and operation details without requiring continuous active monitoring. These logs serve as a record that can be analyzed to identify affected users and unauthorized actors while maintaining low resource consumption during normal operation

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11550901B2Real-time detection of misuse of system credentials

Publication Date: 2023.01.10 RUBRIK INC

AI summary

A process for detecting a threat for a file system is described. Audit events in the file system may be accessed, which may include unique file operations and duplicative file operations. The audit events may be de-duplicated to remove the duplicative file operations. Time series data may be generated that includes the unique file operations but not the duplicative file operations, and the time series data may be analyzed to determine whether a subset of the unique file operations includes file-access instructions. An observed pattern of the file-access instructions may be compared to a normal pattern of file-access instructions to determine whether the observed file-access instructions are abnormal. If the observed file-access instructions are abnormal, an alert may be generated.