METHOD AND APPARATUS FOR AUTHENTICATION OF FILE READ EVENTS

• US 20170199890A1
• Filed: 03/26/2017
• Published: 07/13/2017
• Est. Priority Date: 01/24/2012
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Goldestein, Doron, Bass, David, FAITELSON, Yakov, Kaysar, Yzhar, David, Oren, Korkus, Ohad
• Granted Patent: US 10,642,791 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 3/0614 Improving the reliability of storage systems
• CPC Class Codes: G06F 3/0653 Monitoring storage devices or systems
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

A computerized method and apparatus for distinguishing between false positive read events and true positive events of reading a file, comprising determining an amount of date read from the file, in case the amount of data exceeds a threshold generating a true positive read event, otherwise generating a false positive read event in case a decision condition is met, and an apparatus to carry out the same.

Claims

1. A computerized method for distinguishing between false positive read events and true positive events of reading a file, comprising:

determining an amount of data read from the file; and

in case the amount of data read from the file exceeds a threshold generating a true positive read event, otherwise generating a false positive read event in case a decision condition is met.

2. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, wherein the decision condition comprises one or more of:

a specific predeternined number of readings from the file, a determined number of readings from the file, a specific predetermined time lapse from the first reading of the file, a determined time lapse from the first reading of the file, or any combination thereof.

3. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, wherein the threshold is determined according to at least the size of the file.

4. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, wherein the threshold is determined according to a formula, a lookup table, or a combination thereof.

5. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 4, wherein the formula is:

T=max(1,min(32,32−

16*log(K₂/K)*S/K))

Wherein;

T is the threshold in KB,

K is the minimum size of file for which the entire file is read in KB;

K₂ is the minimum size of the file for which half of the file is read in KB; and

S is the actual size of the file in KB.

6. The computerized method for distinguishing between false positive read events and true positive events of reading a file according to claim 1, further comprising generating the true positive read event if sequential segments of the file were read, otherwise generating the false positive read event.

7. A computerized method for distinguishing between false positive read events and true positive events of reading a file, comprising:

generating a true positive read event in case sequential segments of the file were read, otherwise generating a false positive read event.

8. A computerized apparatus for distinguishing between false positive read events and true positive events of reading a file, comprising:

a data storage device storing the file therein; and

a controller linked to the data storage device, the controller configured to generate false positive read events and true positive events of reading the file responsive to an amount of data read from the file.

9. The computerized apparatus for distinguishing between false positive read events and true positive events of reading a file according to claim 8, wherein the controller determines false positive read events and true positive events responsive to whether the amount of data read from the file exceeds a threshold, respectively.

10. The computerized apparatus for distinguishing between false positive read events and true positive events of reading a file according to claim 8, wherein the controller determines false positive read events in case a decision condition is met.

11. The computerized apparatus for distinguishing between false positive read events and true positive events of reading a file according to claim 8, wherein the controller determines false positive read events and true positive events responsive to whether data is eventually read sequentially, respectively.