System, method, and computer program product for securing data on a server based on a heuristic analysis

• US 8,776,252 B2
• Filed: 09/28/2012
• Issued: 07/08/2014
• Est. Priority Date: 06/13/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gaddala, Satish Kumar
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US13/631,843
• Publication Number:
  US 20130024943A1
• Time in Patent Office: 648 Days
• Field of Search: 726/26
• US Class Current: 726/26
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A system, method, and computer program product are provided for securing data on a server based on a heuristic analysis. In use, information associated with attempts to access data on a server is recorded. Additionally, the information is heuristically analyzed. Further, the data is secured on the server based on the heuristic analysis.

Claims

1. A method, comprising:

recording information associated with attempts to access data on a server, wherein the attempts are provided remotely over a network to which the server is coupled;

heuristically analyzing the information, which includes comparing a previous attempt to access the data with a latest attempt to access the data in order to identify a pattern associated with data leakage; and

securing the data on the server such that access to the data is prevented for a predefined period of time based on the pattern.

2. The method of claim 1, wherein the data includes a selected one of a group of elements, the group consisting of:

a) an electronic mail message;

b) an access control list;

c) certain data that is particular to a user; and

d) certain data that is accessible utilizing identification data associated with a user.

3. The method of claim 1, wherein an action to secure the data is determined based on a type of access attempted such that different actions are associated with different types of access attempts.

4. The method of claim 3, wherein at least one of the different actions includes securing an access control list based on a number of modifications to the access control list.

5. The method of claim 1, wherein the data is accessible using an identification file that comprises a private key that can be associated with a public key for accessing the data on the server.

6. The method of claim 1, wherein the information describes an attempt to modify the data and identifies an Internet protocol (IP) address associated with a source.

7. The method of claim 1, wherein the attempts include attempts to modify permissions in an access control list.

8. The method of claim 1, wherein the attempts to access the data include a first user attempting to access data particular to a second user.

9. The method of claim 8, wherein the attempts to access data particular to the second user utilizes identification data associated with the second user.

10. The method of claim 9, wherein the identification data includes an identification file.

11. The method of claim 1, wherein the attempts to access the data include an attempt by a first user and an attempt by a second user to access particular data at a substantially simultaneous time.

12. The method of claim 1, wherein heuristically analyzing the information includes determining if access to the data has been attempted a threshold number of times.

13. A server, comprising:

a processor coupled to a memory such that the server is configured to;

record information associated with attempts to access data on the server, wherein the attempts are provided remotely over a network to which the server is coupled;

analyze the information, which includes comparing a previous attempt to access the data with a latest attempt to access the data in order to identify a pattern associated with data leakage; and

secure the data on the server such that access to the data is prevented for a predefined period of time based on the pattern.

14. The server of claim 13, wherein the data includes a selected one of a group of elements, the group consisting of:

a) an electronic mail message;

b) an access control list;

c) certain data that is particular to a user; and

d) certain data that is accessible utilizing identification data associated with a user.

15. The server of claim 13, wherein an action to secure the data is determined based on a type of access attempted such that different actions are associated with different types of access attempts.

16. The server of claim 13, wherein at least one of the different actions includes securing an access control list based on a number of modifications to the access control list.

17. The server of claim 13, wherein the information describes an attempt to modify the data and identifies an Internet protocol (IP) address associated with a source.

18. The server of claim 13, wherein analyzing the information includes heuristically determining if access to the data has been attempted a threshold number of times.

19. A computer program product embodied on a non-transitory computer readable medium for:

recording information associated with attempts to access data on a server, wherein the attempts are provided remotely over a network to which the server is coupled;

heuristically analyzing the information, which includes comparing a previous attempt to access the data with a latest attempt to access the data in order to identify a pattern associated with data leakage; and

securing the data on the server such that access to the data is prevented for a predefined period of time based on the pattern.

20. The non-transitory computer readable medium of claim 19, wherein the data includes a selected one of a group of elements, the group consisting of:

a) an electronic mail message;

b) an access control list;

c) certain data that is particular to a user; and

d) certain data that is accessible utilizing identification data associated with a user.

21. The non-transitory computer readable medium of claim 19, wherein an action to secure the data is determined based on a type of access attempted such that different actions are associated with different types of access attempts.

22. The non-transitory computer readable medium of claim 21, wherein at least one of the different actions includes securing an access control list based on a number of modifications to the access control list.

23. The non-transitory computer readable medium of claim 19, wherein the data is accessible using an identification file that comprises a private key that can be associated with a public key for accessing the data on the server.

24. The non-transitory computer readable medium of claim 19, wherein the information describes an attempt to modify the data and identifies an Internet protocol (IP) address associated with a source.

25. The non-transitory computer readable medium of claim 19, wherein the attempts include attempts to modify permissions in an access control list.

26. The non-transitory computer readable medium of claim 19, wherein the attempts to access the data include a first user attempting to access data particular to a second user.

27. The non-transitory computer readable medium of claim 19, wherein the attempts to access data particular to the second user utilizes identification data associated with the second user.

28. The non-transitory computer readable medium of claim 20, wherein the identification data includes an identification file.

29. The non-transitory computer readable medium of claim 19, wherein the attempts to access the data include an attempt by a first user and an attempt by a second user to access particular data at a substantially simultaneous time.

30. The non-transitory computer readable medium of claim 19, wherein heuristically analyzing the information includes determining if access to the data has been attempted a threshold number of times.