Method and apparatus for authentication of file read events

• US 9,639,541 B2
• Filed: 06/11/2014
• Issued: 05/02/2017
• Est. Priority Date: 01/24/2012
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad, Bass, David, Kaysar, Yzhar, Goldstein, Doron, David, Oren
• Primary Examiner(s): ASPINWALL, EVAN S
• Application Number:
  US14/301,351
• Publication Number:
  US 20140297612A1
• Time in Patent Office: 1,056 Days
• Field of Search: 707705
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 3/0614 Improving the reliability of storage systems
• CPC Class Codes: G06F 3/0653 Monitoring storage devices or systems
• CPC Class Codes: G06F 3/0673 Single storage device

Abstract

A computerized method and apparatus for distinguishing between false positive read events and true positive events of reading a file, comprising determining an amount of date read from the file, in case the amount of data exceeds a threshold generating a true positive read event, otherwise generating a false positive read event in case a decision condition is met, and an apparatus to carry out the same.

Claims

1. A computerized method for designating readings from a file stored on a storage device as true positive readings and non-true positive readings, comprising:

mapping the file into sections;

initializing an array of elements wherein each element correspondingly represents a section of the file;

responsive to reading an amount of data from the file, assigning to each element of the array a value that represents if the section corresponding to the element is a read section or an un-read section;

determining by a computerized controller linked to and interacting with the storage device a pattern of sections read from the file based on the elements of the array;

quantifying the pattern by evaluating a number of elements representing read sections and/or a number of elements representing read sections in a consecutive pattern; and

checking if the quantification meets an at least one condition, and responsive to the checking generating an event with a designation of a true positive reading if the quantification meets the at least one condition, otherwise, generating an event with a designation of a non-true positive reading.

2. The method according to claim 1, wherein the at least one condition comprises that the read section form a consecutive pattern without leaving unread sections therebetween.

3. The method according to claim 2, wherein the consecutive pattern was formed although the file was not read consecutively.

4. The method according to claim 1, wherein the at least one condition comprises that a function of the file size has been read.

5. The method according to claim 1, wherein the at least one condition comprises that a specific time lapse did not pass from the first reading of the file.

6. The method according to claim 1, wherein the at least one condition, comprises that a determined time lapse did not pass from the first reading of the file.

7. The method according to claim 1, wherein the at least one condition comprises that a specific number of readings from the file have occurred.

8. The method according to claim 1, wherein at least one condition comprises that a determined number of readings from the file have occurred.

9. The method according to claim 1, wherein the at least one condition comprises that the amount of data read is a factor of the file size, wherein the factor is less than 1.

10. The method according to claim 1, wherein the at least one condition comprises that the amount of data read is less than the file size as a function of the file size.

11. The method according to claim 1, wherein the events with the indications thereof are stored in a storage.

12. The method according to claim 1, wherein the events are generated synchronously as a notification.

13. The method according to claim 1, wherein the events are generated asynchronously as a notification.

14. An apparatus configured to carry out the method according to claim 1.

15. The method according to claim 1, wherein each section of the file is represented by a single bit in the array.

16. The method according to claim 15. wherein the at least one condition comprises calculating the Hamming weight of the array.

17. The method according to claim 1, wherein the at least one condition comprises that the read sections form a consecutive pattern of a certain size regardless of other non-consecutive read sections from the file.