Enhanced data leakage detection in cloud services

• US 9,998,470 B1
• Filed: 09/19/2017
• Issued: 06/12/2018
• Est. Priority Date: 03/31/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hockings, Christopher J., Mulyono, Budi, Narasipur, Sumana S., Pranam, Codur S.
• Primary Examiner(s): Okeke, Izunna
• Application Number:
  US15/708,167
• Time in Patent Office: 266 Days
• Field of Search: 726 1, 726 2, 726 3, 726 4, 726 22, 726 26, 726 27
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Embodiments describing an approach to receiving user data, and monitoring a user data transaction. Monitoring a user data transaction. Identifying a plurality of attribute elements associated with the user data and the user data transaction. Creating benchmark data based on one or more identified attributes and user data gathered from a user data transaction, and storing, by the one or more processors, benchmark data.

Claims

1. A method for creating benchmark data to enhance data leakage protection in cloud based services, the method comprising:

receiving, by one or more processors, user data;

monitoring, by the one or more processors, a user data transaction;

identifying, by the one or more processors, a plurality of attribute elements associated with the user data and the user data transaction, wherein attribute elements comprise;

user data information, user data usage, user location, file name, file size, file time stamp, file location, user name, IP address, and user behavioral patterns;

monitoring, by the one or more processors, the plurality of attribute elements, wherein the plurality of attribute elements comprises dynamic content and variable lengths;

creating, by the one or more processors, benchmark data based on the identified plurality of attribute elements and the user data gathered from the user data transaction;

determining, by the one or more processors, there are no discrepancies between the user data transaction and the benchmark data;

creating, by the one or more processors, policy attributes based on flagging one or more attribute elements associated with the user data and the user data transaction wherein the flagged attribute elements influence security policy;

sending, by the one or more processors, the policy attributes to an administrator for policy creation;

storing, by the one or more processors, the benchmark data; and

restricting, by the one or more processors, entry into a cloud system based on an authentication request credentials.