Automatic notifications for inadvertent file events

• US 9,910,968 B2
• Filed: 12/30/2015
• Issued: 03/06/2018
• Est. Priority Date: 12/30/2015
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Eccleston, Matt, Sern, Stacey, von Muhlen, Marcio
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US14/984,729
• Publication Number:
  US 20170193201A1
• Time in Patent Office: 797 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A content management system can detect file events that are suspected to be in error, and notify users having access to files affected by the detected file events of the detected events. The content management system can maintain a log of file events including a plurality of file identifiers. The file identifiers identify files that are associated with a namespace, a file event, and a user account responsible for the file event. An analytics module can analyze the log of file events and notify the user of a suspected error when it may be that the file events were inadvertent. A notification can include a link to restore (undo) the file events if the user confirms that the file events were in error.

Claims

1. A non-transitory computer-readable medium of a content management system for storing files, each file being associated with one of a plurality of namespaces and one or more user accounts, the non-transitory computer-readable medium comprising:

computer executable instructions stored on the computer-readable medium, the computer executable instructions, when executed by a computing device cause a computer to;

maintain a log of file events, the log including a plurality of file identifiers each respectively associated with a namespace, a file event, and a user account responsible for the file event;

analyze the log of file events to identify a total number of compound events associated with a first namespace of the plurality of namespaces and associated with a first user account of the one or more user accounts;

analyze the log of file events to identify a total number of deletion events, excluding the total number of compound events, associated with the first namespace of the plurality of namespaces and associated with the first user account of the one or more user accounts; and

send a notification to the first user when the total number of deletion events, excluding the total number of compound events, is greater than a threshold, the notification identifying the deletion events not associated with the compound events.

2. The non-transitory computer-readable medium of claim 1, wherein the log of file events also includes a timestamp associated with each file event, and the instructions to analyze the log of file events analyze only file events having a timestamp within a time period, and the instructions to send the notification to the first user executes when the total number of deletion events is greater than a threshold in the time period.

3. The non-transitory computer-readable medium of claim 2, wherein the notification includes a link to restore all files associated with deletion events during the time period.

4. The non-transitory computer-readable medium of claim 1, wherein the instructions to analyze the log of file events to identify the total number of deletion events only includes a specific deletion event in the total number of deletion events ifor a recoverable deleted file associated with the deletion event.

5. The non-transitory computer-readable medium of claim 1, wherein the instructions to analyze the log of file events to identify the total number of deletion events only includes a specific deletion event in the total number of deletion events when the file associated with the specific deletion event is not also associated with a specific compound event for the file, wherein the specific compound event is associated with an add event after the specific deletion event.

6. The non-transitory computer-readable medium of claim 1, wherein the threshold is “

y”

number of deletion events when the deletion events are associated with a root namespace, and the threshold is “

x”

number of deletion events when the deletion events are associated with a shared namespace, where x<

y.

7. The non-transitory computer-readable medium of claim 1, wherein the threshold is “

y”

number of deletion events when the deletion events are associated with a root namespace, and the threshold is “

w”

number of deletion events when the deletion events correspond to a whole subdirectory with a shared namespace, where w<

y.

8. The non-transitory computer-readable medium of claim 1, wherein the threshold is “

y”

number of deletion events when the deletion events are associated with a root namespace, and the threshold is “

v”

number of deletion events when the deletion events correspond to all files within a shared namespace, but the shared namespace is not deleted, where v<

y.

9. A method executable by a content management system for storing files, each file being associated with one of a plurality of namespaces and one or more user accounts, the method comprising:

maintaining a log of file events, the log including a plurality of file identifiers each respectively associated with a namespace, a file event, and a user account responsible for the file event;

analyzing the log of file events to identify a total number of compound events associated with a first namespace of the plurality of namespaces and associated with a first user account of the one or more user accounts;

analyzing the log of file events to identify a total number of deletion events, excluding the total number of compound events, associated with the first namespace of the plurality of namespaces and associated with the first user account of the one or more user accounts; and

sending a notification to the first user when the total number of deletion events, excluding the total number of compound events, is greater than a threshold, the notification identifying the deletion events not associated with the compound events.

10. The method of claim 9, wherein the log of file events also includes a timestamp associated with each file event, and analyzing the log of file events only includes file events having a timestamp within a time period, and the notification is sent to the first user when the total number of deletion events is greater than a threshold in the time period.

11. The method of claim 10, wherein the notification includes a link to restore all files associated with deletion events during the time period.

12. The method of claim 9, wherein analyzing the log of file events to identify the total number of deletion events only includes a specific deletion event in the total number of deletion events for a recoverable deleted file associated with the deletion event.

13. The method of claim 9, wherein analyzing the log of file events to identify the total number of deletion events only includes a specific deletion event in the total number of deletion events when the file associated with the specific deletion event is not also associated with a specific compound event for the file, wherein the specific compound event is associated with an add event after the specific deletion event.

14. A content management system for storing files, each file being associated with one of a plurality of namespaces and one or more user accounts, the system comprising:

a file event log, the file event log including a plurality of file identifiers each respectively associated with a namespace, a file event, and a user account responsible for the file event;

an analytics module including a processor and processor executable instructions stored on a non-transitory computer-readable medium comprising, the processor executable instructions effective to cause the analytics module to;

analyze the log of file events to identify a total number of compound events associated with a first namespace of the plurality of namespaces and associated with a first user account of the one or more user accounts;

analyze the log of file events to identify a total number of deletion events, excluding the total number of compound events, associated with the first namespace of the plurality of namespaces and associated with the first user account of the one or more user accounts; and

send a notification to the first user when the total number of deletion events, excluding the total number of compound events, is greater than a threshold, the notification identifying the deletion events not associated with the compound events.

15. The system of claim 14, wherein the file events log also includes a timestamp associated with each file event, and the analytics module including instructions to analyze only file events in the file events log having a timestamp within a time period, and the instructions to send the notification send the notification to the first user when the total number of deletion events is greater than a threshold in the time period.

16. The system of claim 15, wherein the notification includes a link to restore all files associated with deletion events during the time period.

17. The system of claim 14, wherein the instructions to analyze the file events log to identify the total number of deletion events only includes a specific deletion event in the total number of deletion events for a recoverable deleted file associated with the deletion.

18. The system of claim 14, wherein the instructions to analyze the log of file events to identify the total number of deletion events only includes a specific deletion event in the total number of deletion events when the file associated with the specific deletion event is not also associated with a specific compound event for the file, wherein the specific compound event is associated with an add event after the specific deletion event.