SYSTEMS AND METHODS FOR DETECTING DATA LEAKAGE IN AN ENTERPRISE

• US 20160162522A1
• Filed: 03/03/2015
• Published: 06/09/2016
• Est. Priority Date: 12/08/2014
• Status: Abandoned Application

• Current Assignee: Wipro Limited
• Original Assignee: Wipro Limited
• Inventors: GANATRA, Chetan
• Application Number:
  US14/636,588
• Publication Number:
  US 20160162522A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/164 File meta data generation
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

Systems and methods for detecting data leakage in an enterprise are described. In one implementation, the method comprises receiving files metadata from at least one device associated with the enterprise. The files metadata comprises a plurality of file parameters. Further, the method comprises processing the files metadata to generate indexed metadata. The indexed metadata comprises at least one of the plurality of file parameters. Further, the method comprises analyzing the indexed metadata based on predefined leakage patterns to detect the data leakage.

Claims

8-1. The system of claim 9, wherein the operations further comprise rendering a data leakage report indicating data leakage in the enterprise, wherein the data leakage report comprises detected data leaks, potential data leaks, suspicious activities, and flagged activities.

9. A system for detecting data leakage in an enterprise, the system comprising:

a processor operatively coupled to a memory device, wherein the processor is configured to execute instructions stored in the memory device to perform operations comprising;

receiving files metadata from at least one device associated with the enterprise, wherein the files metadata comprises a plurality of file parameters;

processing the files metadata to generate indexed metadata, wherein the indexed metadata comprises at least one of the plurality of file parameters; and

analyzing the indexed metadata based on predefined leakage patterns to detect the data leakage.

1. A computer-implemented method for detecting data leakage in an enterprise, the method comprising:

receiving, by a processor, files metadata from at least one device associated with the enterprise, wherein the files metadata comprises a plurality of file parameters;

processing, by the processor, the files metadata to generate indexed metadata, wherein the indexed metadata comprises at least one of the plurality of file parameters; and

analyzing, by the processor, the indexed metadata based on predefined leakage patterns to detect the data leakage.

2. The method of claim 1 further comprises rendering a data leakage report indicating data leakage in the enterprise, wherein the data leakage report comprises detected data leaks, potential data leaks, suspicious activities, and flagged activities.

3. The method of claim 1, wherein the plurality of files parameter comprises at least one of type of file, file location, modification date, creation date, access date, timestamps maintained within a file system, file owner, file attributes, flags, or system identifier.

4. The method of claim 1, wherein the predefined leakage patterns comprises data anomalies, unauthorized access to files, deviation from standard activities, detected data leakage incidents, replication of a file in multiple devices and sequence of file system activities on an individual device and across multiple devices.

5. The method of claim 1, wherein receiving the files metadata further comprises:

transmitting authentication parameters to the at least one device;

establishing a connection with the at least one device based on the authentication parameters; and

receiving the files metadata from the at least one device based on analysis parameters.

6. The method of claim 1, wherein analyzing the indexed metadata further comprises:

generating a view of user data activities comprising data timelines and activities; and

mapping the view with the predefined leakage patterns to detect the data leakage.

7. The method of claim 1 further comprises receiving file content, for further analysis, from the at least one device upon detecting the data leakage.

8. The method of claim 1 further comprises:

tracking a data movement pattern, for a user in the enterprise, based on the indexed metadata; and

creating a user profile, based on the data movement pattern, to indicate user behavior in the enterprise.

11. The system of claim 9, wherein the plurality of files parameter comprises at least one of type of file, file location, modification date, creation date, access date, timestamps maintained within a file system, file owner, file attributes, flags, or system identifier.

12. The system of claim 9, wherein the predefined leakage patterns comprises data anomalies, unauthorized access to files, deviation from standard activities, detected data leakage incidents, replication of a file in multiple devices and sequence of file system activities on an individual device and across multiple devices.

13. The system of claim 9, wherein the operations of receiving the files metadata further comprises:

transmitting authentication parameters to the at least one device;

establishing a connection with the at least one device based on the authentication parameters; and

receiving the files metadata from the at least one device based on analysis parameters.

14. The system of claim 9, wherein operations of analyzing the indexed metadata further comprises:

generating a view of user data activities comprising data timelines and activities; and

mapping the view with the predefined leakage patterns to detect the data leakage.

15. The system of claim 9, wherein the operations further comprise receiving file content, for further analysis, from the at least one device upon detecting the data leakage.

16. The system of claim 9, wherein the operations further comprise:

tracking a data movement pattern, for a user in the enterprise, based on the indexed metadata; and

creating a user profile, based on the data movement pattern, to indicate user behavior in the enterprise.

17. A non-transitory computer-readable medium storing instructions for detecting data leakage in an enterprise that, when executed by a processor, cause the processor to perform operations comprising:

receiving files metadata from at least one device associated with the enterprise, wherein the files metadata comprises a plurality of file parameters;

processing the files metadata to generate indexed metadata, wherein the indexed metadata comprises at least one of the plurality of file parameters; and

analyzing the indexed metadata based on predefined leakage patterns to detect the data leakage.

18. The computer-readable medium of claim 17, wherein the operations further comprise rendering a data leakage report indicating data leakage in the enterprise, wherein the data leakage report comprises detected data leaks, potential data leaks, suspicious activities, and flagged activities.

19. The computer-readable medium of claim 17, wherein the plurality of files parameter comprises at least one of type of file, file location, modification date, creation date, access date, timestamps maintained within a file system, file owner, file attributes, flags, or system identifier.

20. The computer-readable medium of claim 17, wherein operations of receiving the files metadata further comprises:

transmitting authentication parameters to the at least one device;

establishing a connection with the at least one device based on the authentication parameters; and

receiving the files metadata from the at least one device based on analysis parameters.

21. The computer-readable medium of claim 17, wherein the operations of analyzing the indexed metadata further comprises:

generating a view of user data activities comprising data timelines and activities; and

mapping the view with the predefined leakage patterns to detect the data leakage.

22. The computer-readable medium of claim 17, wherein the predefined leakage patterns comprises data anomalies, unauthorized access to files, deviation from standard activities, detected data leakage incidents, replication of a file in multiple devices and sequence of file system activities on an individual device and across multiple devices.