System and method for real time data awareness

• US 9,584,535 B2
• Filed: 08/03/2015
• Issued: 02/28/2017
• Est. Priority Date: 03/11/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Roesch, Martin Frederick
• Primary Examiner(s): ASPINWALL, EVAN S
• Application Number:
  US14/816,604
• Publication Number:
  US 20150341378A1
• Time in Patent Office: 575 Days
• Field of Search: 707/756
• US Class Current: 1/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

A system includes a sensor and a processor. The sensor is configured to passively read data in packets as the packets are in motion on a network. The processor is cooperatively operable with the sensor. The processor is configured to receive the read data from the sensor; and originate map profiles of files and file data, both from the read data from the sensor, as the passively read packets are in motion on the network. The processor is also configured to infer a user role for a user who is using the file and the file data and how the user is transferring or accessing the file and the file data. Inappropriate usage being performed by the user can then be detected from the user role and the read data to control access to particular files.

Claims

1. A system comprising:

a sensor configured to;

passively read data in packets as the packets are in motion on a network; and

a processor cooperatively operable with the sensor, the processor being a hardware processor, and configured to;

receive the read data from the sensor;

originate map profiles of files and file data, both from the read data from the sensor, as the packets are in motion on the network, wherein the map profile is a topographical map of locations of the files on the network, and wherein the map profile further designates users who have accessed the files, changes made to content of the files, and at least one of;

hosts which contain the files;

destinations to where the files were transferred; and

file directories of the files on the hosts and the destinations;

infer a user role for a user based on the files and the file data being used by the user and how the user is transferring or accessing the files and the file data;

detect when the user is performing an inappropriate usage from the user role and the read data from the sensor; and

control access to particular files based on the detecting and the changes made to the files.

2. The system of claim 1, wherein the processor is further configured to:

catalog attributes of the files and the file data, all from the read data in the packets in motion on the network.

3. The system of claim 2, wherein the attributes which are cataloged for a particular file of the files include at least some of:

file name, file size, time stamp, file hash, block hashes, server identifier (ID) that contained the particular file, host ID which contains the particular file, user ID of the user that sent the particular file, user ID for the user receiving the particular file, destination the particular file is transferred to, content of the particular file, where the file data is, who has access to the file data or the particular file, what device has the file data, how the particular file was transferred, and how the particular file was transformed.

4. The system of claim 1, wherein the changes made to content of the files are determined by analyzing the files and the file data for keywords or hashes in the files and the file data.

5. The system of claim 3, wherein the processor is further configured to:

create a user access map associating user identity with the files, file hashes, and databases the user has actually touched.

6. The system of claim 1, wherein the sensor is further configured to:

embed a honeytoken into voids inside the files contained in the passively read packets when the files have a file format predetermined to have dead data that can be overwritten, and to use the honeytoken to aid tracking of movement of the files around and outside the network.

7. The system of claim 6, wherein the honeytoken that is embedded in the files is one of a main hash of an entire particular file, and a block hash of an individual block within the files.

8. The system of claim 1, wherein the processor is further configured to:

examine the read data from the sensor for the files and the file data, when the read data is a conversation between users, a page being downloaded, an e-mail attachment, a file download, a file repository access, and a file transfer via the network.

9. The system of claim 8, wherein the file repository access is a download, a File Transfer Protocol (FTP) transfer, a file share access, or an Network File System (NFS) access.

10. The system of claim 1, wherein the processor is further configured to:

extract metadata from the read data in the passively read packets to generate passively discovered metadata, as the packets are in motion on the network, the read data including at least some of the following attributes;

a main hash of an entire particular file, a block hash of individual blocks within the particular file, a directory listing of the files with file names, dates, time stamps, size, and file owners, the hash being a cryptographic hash unique to the particular file.

11. The system of claim 10, wherein the processor is further configured to:

store the passively discovered metadata, the attributes of the files, and the file data, in a relational database.

12. The system of claim 11, wherein the relational database is based around the files and indicates where each file has been transferred and who transferred each file.

13. The system of claim 11, wherein the relational database is implemented as a postprocessor to the sensor.

14. The system of claim 1, wherein the processor is further configured to:

report on how the content of a particular file of the files has changed, including changes of location reflected in the file data, changes in ownership reflected in the file data, changes in the file data itself, and changes in the particular file itself.

15. A method comprising:

in a sensor, passively reading data in packets as the packets are in motion on a network;

in a processor, the processor being a hardware processor;

receiving the read data from the sensor;

originating map profiles of files and file data both from the read data from the sensor, as the packets are in motion on the network, wherein the map profile is a topographical map of locations of the files on the network, and wherein the map profile further designates users who have accessed the files, changes made to content of the files, and at least one of;

hosts which contain the files;

destinations to where the files were transferred; and

file directories of the files on the hosts and the destinations;

inferring a user role for a user from who is using the files and the file data and how the user is transferring or accessing the file and the file data;

detecting when the user is performing an inappropriate usage from the user role and the read data from the sensor; and

controlling access to particular files based on the detecting and the changes made to the files.

16. The method of claim 15, further comprising:

cataloging attributes of the files and the file data, all from the read data in the packets in motion on the network.

17. The method of claim 15, further comprising:

creating a user access map associating user identity with the files, file hashes, and databases the user has actually touched.

18. The method of claim 15, further comprising:

embedding a honeytoken into voids inside the files contained in the passively read packets when the files have a file format predetermined to have dead data that can be overwritten, and using the honeytoken to aid tracking of movement of the files around and outside the network.

19. The method of claim 18, wherein the honeytoken that is embedded in the files is one of a main hash of an entire particular file, and a block hash of an individual block within the files.

20. A non-transitory computer-readable storage medium comprising computer-executable instructions for performing the steps of:

passively reading, from a sensor, data in packets as the packets are in motion on a network;

receiving, in a processor, the read data from the sensor;

originating map profiles of files and file data, both from the read data from the sensor, as the packets are in motion on the network, wherein the map profile is a topographical map of locations of the files on the network, and wherein the map profile further designates users who have accessed the files, changes made to content of the files, and at least one of;

hosts which contain the files;

destinations to where the files were transferred; and

file directories of the files on the hosts and the destinations;

inferring a user role for a user from who is using the files and the file data and how the user is transferring or accessing the file and the file data;

detecting when the user is performing an inappropriate usage from the user role and the read data from the sensor; and

controlling access to particular files based on the detecting and the changes made to the files.

21. The non-transitory computer-readable storage medium of claim 20, further comprising instructions operable for:

cataloging attributes of the files and the file data, all from the read data in the packets in motion on the network.

22. The non-transitory computer-readable storage medium of claim 20, further comprising instructions operable for:

creating a user access map associating user identity with the files, file hashes, and databases the user has actually touched.

23. The non-transitory computer-readable storage medium of claim 20, further comprising instructions operable for:

extracting metadata from the read data in the packets to generate passively discovered metadata, as the packets are in motion on the network, the read data including at least some of the following attributes;

a main hash of the entire particular file, a block hash of individual blocks within the particular file, a directory listing of the files with file names, dates, time stamps, size, and file owners, the hash being a cryptographic hash unique to the particular file.

24. The non-transitory computer-readable storage medium of claim 20, further comprising instructions operable for:

embedding a honeytoken into voids inside the files contained in the passively read packets when the files have a file format predetermined to have dead data that can be overwritten, and using the honeytoken to aid tracking of movement of the files around and outside the network.

25. The non-transitory computer-readable storage medium of claim 24, wherein the honeytoken that is embedded in the files is one of a main hash of an entire particular file, and a block hash of an individual block within the files.