Method and apparatus for authentication of file read events

• US 10,642,791 B2
• Filed: 03/26/2017
• Issued: 05/05/2020
• Est. Priority Date: 01/24/2012
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad, Bass, David, Kaysar, Yzhar, Goldstein, Doron, David, Oren
• Primary Examiner(s): Aspinwall, Evan
• Application Number:
  US15/469,529
• Publication Number:
  US 20170199890A1
• Time in Patent Office: 1,136 Days
• Field of Search: 707705
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 3/0614 Improving the reliability of storage systems
• CPC Class Codes: G06F 3/0653 Monitoring storage devices or systems
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

A computerized method and apparatus for distinguishing between false positive read events and true positive events of reading a file, comprising determining an amount of date read from the file, in case the amount of data exceeds a threshold generating a true positive read event, otherwise generating a false positive read event in case a decision condition is met, and an apparatus to carry out the same.

Claims

1. A computerized method for distinguishing between false positive read events and true positive events of reading a file stored on a storage device and made from segments, comprising:

clearing bits of an integer, wherein sequential bits of the integer represent sequential segments of the file;

setting bits of the integer corresponding to segments read from the file;

determining if the read event is true positive or false positive based on if the number of set bits in the integer exceeds a threshold or if a decision condition is met

responsive to said determining initiating an interrupt to perform an application or ignoring the read event; and

wherein the decision condition comprises one or more of;

a specific predetermined number of readings from the file, a determined number of readings from the file, a specific predetermined time lapse from the first reading of the file, a determined time lapse from the first reading of the file, or any combination thereof.

2. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, wherein the threshold is determined according to at least the size of the file.

3. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, wherein the threshold is determined according to a formula, a lookup table, or a combination thereof;

and

wherein the formula is;

T=max(1,min(32,32−

16*log(K₂/K)*S/K))

Wherein;

T is the threshold in KB,

K is the minimum size of file for which the entire file is read in KB;

K₂ is the minimum size of the file for which half of the file is read in KB; and

S is the actual size of the file in KB.

4. The computerized method for distinguishing between false positive read events of reading a file according to claim 1, wherein the decision condition comprises that the segments of the file that were eventually read are consecutive although the file was not read consecutively during the read operations.

5. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, wherein the decision condition comprises that the read segments form a consecutive pattern of a certain size regardless of the other non-consecutive read segments.

6. A computerized apparatus for distinguishing between false positive read events and true positive events of reading a file made up from segments, comprising:

a data storage device storing the file therein;

a controller linked to the data storage device, the controller configured to generate false positive read events and true positive events of reading the file responsive to performing the following;

clearing bits of an integer or other data construct, wherein sequential bits of the integer represent sequential segments of the file;

setting bits of the integer corresponding to segments read from the file;

determining if the read event is true positive or false positive based on if the number of set bits in the integer exceeds a threshold or if a decision condition is met;

responsive to said determining initiating an interrupt to perform an application or ignoring the read event; and

wherein the decision condition comprises one or more of;

a specific predetermined number of readings from the file, a determined number of readings from the file, a specific predetermined time lapse from the first reading of the file, a determined time lapse from the first reading of the file, or any combination thereof.

7. The apparatus according to claim 6, wherein the threshold is determined according to at least the size of the file.

8. The apparatus according to claim 6, wherein the threshold is determined according to a formula, a lookup table, or a combination thereof;

and

wherein the formula is;

T=max(1,min(32,32−

16*log(K₂/K)*S/K))

Wherein;

T is the threshold in KB,

K is the minimum size of file for which the entire file is read in KB;

K₂ is the minimum size of the file for which half of the file is read in KB; and

S is the actual size of the file in KB.

9. The apparatus according to claim 6, wherein the decision condition comprises that the segments of the file that were eventually read are consecutive although the file was not read consecutively during the read operations.

10. The apparatus according to claim 6, wherein the decision condition comprises that the read segments form a consecutive pattern of a certain size regardless of other non-consecutive read segments from the file.