DATA LOSS PROTECTION THROUGH APPLICATION DATA ACCESS CLASSIFICATION

• US 20100115614A1
• Filed: 10/31/2008
• Published: 05/06/2010
• Est. Priority Date: 10/31/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Barile, Ian, Kessler, Dirk, Upadhyay, Rajesh, Wootton, Bruce
• Granted Patent: US 8,695,090 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A method and apparatus for classifying behavior of an application based on its data access pattern is described. In one embodiment, the method includes monitoring file access events associated with an application, and determining whether at least one of the file access events indicates the application'"'"'s attempt to manipulate data of a file. If at least one file access event indicates the application'"'"'s attempt to manipulate the data within the file, then at least one action is caused to be performed.

Claims

1. A computer-implemented method comprising:

monitoring file access events associated with an application;

determining whether at least one of the file access events indicates an attempt by an application to manipulate data of a file; and

if the at least one file access event indicates the attempt to manipulate the data of the file, causing at least one action to be performed.

2. The method of claim 1 wherein the application is any one of a compact disk (CD) burning application, a digital video disk (DVD) burning application, a data compression application, a browser application, and a cloud storage application.

3. The method of claim 1 further comprising:

receiving the file access events from a filter driver or a network-based application sniffing network traffic.

4. The method of claim 1 wherein the file access event identifies the file and specifies a read block size.

5. The method of claim 4 wherein the file access event specifies a read offset.

6. The method of claim 1 wherein manipulating the file data comprises at least one of modifying the file data, copying the file data and displaying the file data.

7. The method of claim 1 wherein determining whether at least one of the file access events indicates an attempt by an application to manipulate data of a file comprises:

determining whether a read block size pertaining to the file access event exceeds a threshold block size parameter.

8. The method of claim 1 wherein determining whether at least one of the file access events indicates an attempt by an application to manipulate data of a file comprises:

determining whether a number of the file access events over a time interval exceeds a threshold access request number.

10. The method of claim 1 wherein causing at least one action to be performed comprises:

scanning the file data for confidential information; and

upon detecting confidential information in the file, restricting the file read request.

11. The method of claim 1 further comprising:

determining that the file access event indicates the attempt to access file metadata; and

allowing the file access event to proceed if the attempt is determined to be an attempt to access the file metadata.

12. A system comprising:

an application request analyzer to monitor file access events associated with an application, and to determine whether at least one of the file access events indicates an attempt by an application to manipulate data of a file; and

an action manager, coupled to the application request analyzer, to perform at least one action if the at least one file access event indicates the attempt to manipulate the file data.

13. The system of claim 12 wherein the application is any one of a compact disk (CD) burning application, a digital video disk (DVD) burning application, a data compression application, a browser application, and a cloud storage application.

14. The system of claim 12 further comprising:

a filter driver to generate the file access events.

15. The system of claim 12 wherein the file access event identifies the file and specifies a read block size and optionally a read offset.

16. The system of claim 12 wherein the application request analyzer is to determine whether at least one of the file access events indicates an attempt by an application to manipulate data of a file by:

determining whether a read block size pertaining to the file access event exceeds a threshold block size parameter; and

determining whether a number of the file access events over a time interval exceeds a threshold access request number.

17. The system of claim 12 wherein the action manager is further to determine that the file access event indicates the attempt to access file metadata, and to allow the file access event to proceed if the attempt is determined to be an attempt to access the file metadata.

18. A computer readable storage medium that provides instructions, which when executed on a processing system cause the processing system to perform a method comprising:

monitoring file access events associated with an application;

determining whether at least one of the file access events indicates an attempt by an application to manipulate data of a file; and

if the at least one file access event indicates the attempt to manipulate the data of the file, causing at least one action to be performed.

19. The computer readable storage medium of claim 18 wherein the file access event identifies the file and specifies a read block size and optionally a read offset.

20. The computer readable storage medium of claim 18 wherein determining whether at least one of the file access events indicates an attempt by an application to manipulate data of a file comprises:

determining whether a read block size pertaining to the file access event exceeds a threshold block size parameter; and

determining whether a number of the file access events over a time interval exceeds a threshold access request number.