Network Traffic Profiling for Abnormal Data Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network monitoring systems struggle to detect deliberate or inadvertent subversion of data storage policies, particularly in distributed environments, where sensitive data may escape and go undetected due to transient nature of policy violations.
Innovation Solution
Implement a network monitoring system that generates profiles based on network traffic patterns, identifies similar profiles, and classifies locations to detect abnormal data access by comparing access policies, using summarization and recognition models to identify inconsistencies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network monitoring methods are used, then the monitoring system is simple to implement, but it cannot detect transient policy violations where sensitive data escapes storage locations
Solution Approach 1:
The monitoring system is segmented into multiple specialized components: profile generation module that creates access patterns, profile matching module that compares actual access against profiles, policy retrieval module that stores access policies, and violation detection module that identifies anomalies. This segmentation allows each component to specialize in one aspect of detection, improving overall reliability while managing complexity through modular design.
Solution Approach 2:
The system performs preliminary actions by pre-generating access profiles for sensitive data before any potential policy violations occur. These profiles capture expected access patterns, locations, and policies. When actual access occurs, the system simply compares it against the pre-established profiles, enabling rapid detection of transient violations without complex real-time analysis.
2Measurement precision
If comprehensive network traffic monitoring is implemented to detect all policy violations, then detection accuracy improves, but the time required to process and analyze traffic increases
Solution Approach 1:
The system creates simplified copies of access patterns in the form of profiles that capture essential characteristics of sensitive data access. Instead of analyzing complete network traffic packets, the system works with these condensed profile representations that contain only the critical access attributes needed for violation detection, dramatically reducing processing time while maintaining detection accuracy.
Solution Approach 2:
The system changes the parameters of analysis by transforming detailed network traffic into standardized profile parameters such as access location, data sensitivity level, expected access pattern, and associated policies. This parameter transformation enables efficient comparison and matching operations that are much faster than analyzing raw traffic data while preserving the essential information needed for accurate violation detection.
3Reliability
If the system monitors all data access locations throughout the network, then it can detect policy subversion, but the complexity of managing and classifying all locations increases
Solution Approach 1:
The system extracts only the essential location characteristics needed for policy compliance detection rather than managing complete information about all network locations. It identifies and extracts key attributes such as location identifiers, associated access policies, and data sensitivity classifications, discarding extraneous details. This extraction approach enables effective monitoring while reducing the complexity of location management.
4Measurement precision
If the system generates detailed profiles for every data access event, then detection precision improves, but the computational resources and storage requirements increase
Solution Approach 1:
The system applies partial action by generating detailed profiles only for accesses involving sensitive data identified through policy associations, rather than creating profiles for all data access events. This selective approach maintains high detection precision for critical violations while significantly reducing the overall volume of profile data that must be processed and stored, optimizing the balance between detection capability and resource consumption.
Data Source
AI summary
Embodiments are directed monitoring network traffic using network monitoring computers. Activity associated with a document in a network may be determined based on the network traffic. A profile may be generated based on a summarization of the activity associated with the document such that the profile may be stored in a data store that stores other profiles. Similar profiles may be determined based on a classification of each profile in the data store based on similarities between the profile and the other profiles in the data store. In response to determining similar profiles, locations in the network associated with documents that correspond to the similar profiles may be determined. Locations may be classified based on the activity, the similar profiles and access policies. In response to portions of the locations being classified as inconsistent with the access policies may be reported.