Real-time detection of system threats

Patent metadata

Field	Value
Publication number	US-12174946-B2
Application number	US-202318497474-A
Country	US
Kind code	B2
Filing date	Oct 30, 2023
Priority date	Jan 31, 2019
Publication date	Dec 24, 2024
Grant date	Dec 24, 2024

Abstract

Some examples relate generally to managing and storing data, and more specifically to the real-time detection of ransomware, system (or insider) threats, or the misappropriation of credentials by using file system audit events.

First claim

The invention claimed is:

1. A method, comprising:
accessing audit events in a file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
de-duplicating the audit events to obtain time series data that comprises the unique file operations and is devoid of the duplicative file operations from the audit events, the unique file operations being operations associated with respective changes in file states for corresponding files of the file system and the duplicative file operations being operations that maintain respective file states for corresponding files of the file system;
comparing a pattern of instructions associated with the unique file operations of the time series data, the pattern of instructions associated with a quantity of the unique file operations occurring within a time period, to a normal pattern of instructions;
determining, based at least in part on the comparing, that the pattern of instructions associated with the unique file operations is abnormal based at least in part on a deviation between the pattern of instructions and the normal pattern of instructions; and
generating an alert based at least in part on determining that the pattern of instructions associated with the unique file operations is abnormal.

2. The method of claim 1 , wherein the audit events include information comprising, for each audit event, a user identity, a file name, a type of access, a timestamp, or any combination thereof.

3. The method of claim 1 , wherein determining that the pattern of instructions is abnormal is further based at least in part on determining that the unique file operations include instructions to encrypt one or more copies of at least one file.

4. The method of claim 1 , wherein determining that the pattern of instructions is abnormal comprises:
determining that the unique file operations comprise a set of delete instructions that deviates from a normal pattern of delete instructions, a set of read instructions that deviates from a normal pattern of read instructions, a set of file access instructions that deviates from a normal pattern of file access instructions, or any combination thereof.

5. The method of claim 4 , wherein the set of delete instructions deviates from the normal pattern of delete instructions based at least in part on a quantity of delete instructions included in the set of delete instructions, the set of read instructions deviates from the normal pattern of read instructions based at least in part on a quantity of read instructions included in the set of read instructions, or the set of file access instructions deviates from the normal pattern of file access instructions based at least in part on a quantity of file access instructions included in the set of file access instructions.

6. The method of claim 4 , further comprising:
identifying a ransomware infection, one or more insider threats, a misappropriation of system credentials, or any combination thereof based at least in part on the set of delete instructions, the set of read instructions, the set of file access instructions, or any combination thereof.

7. The method of claim 1 , wherein de-duplicating the audit events is based at least in part on an identification of successive file operations that do not lead to a change in a file state.

8. The method of claim 1 , further comprising:
identifying the duplicative file operations based at least in part on the duplicative file operations maintaining file states associated with corresponding prior file operations.

9. The method of claim 1 , further comprising:
generating a finite state machine including one or more file states, the one or more file states including a file open state, a file read state, a file write state, a file read or write state, a file close state, or any combination thereof; and
storing the one or more file states in the finite state machine in a key-value object store.

10. The method of claim 9 , wherein de-duplicating the audit events comprises:
identifying, as the unique file operations, file operations that maintain a file system state based at least in part on the finite state machine.

11. The method of claim 1 , wherein determining that the pattern of instructions associated with the unique file operations are abnormal is based at least in part on:
applying a set of machine learning models to the audit events,
wherein the set of machine learning models are trained to determine the pattern of instructions associated with the unique file operations, and to compare the pattern of instructions to the normal pattern of instructions or a normal quantity of instructions based at least in part on features representing a normal or expected behavior of the file system.

12. The method of claim 1 , wherein determining that the pattern of instructions associated with the unique file operations is abnormal is based at least in part on:
applying Seasonal-Trend Decomposition Procedure Based on Loess (STL) decomposition to the unique file operations to remove seasonal and trend components; and
performing an Exploratory Data Analysis (ESD) test on data that is based at least in part on a residue of the STL decomposition.

13. An apparatus, comprising:
at least one processor;
memory coupled with the at least one processor; and
instructions stored in the memory and executable by the at least one processor to cause the apparatus to:
access audit events in a file system for a time interval, the audit events including unique file operations and duplicative file operations within the time interval;
de-duplicate the audit events to obtain time series data that comprises the unique file operations and is devoid of the duplicative file operations from the audit events, the unique file operations being operations associated with respective changes in file states for corresponding files of the file system and the duplicative file operations being operations that maintain respective file states for corresponding files of the file system;
compare a pattern of instructions associated with the unique file operations of the time series data, the pattern of instructions associated with a quantity of the unique file operations occurring within a time period, to a normal pattern of instructions;
determine, based at least in part on the comparing, that the pattern of instructions associated with the unique file operations is abnormal based at least in part on a deviation between the pattern of instructions and the normal pattern of instructions; and
generate an alert based at least in part on determining that the pattern of instructions associated with the unique file operations is abnormal.

14. The apparatus of claim 13 , wherein the audit events include information comprising, for each audit event, a user id, a file name, a type of access, a timestamp, or any combination thereof.

15. The apparatus of claim 13 , wherein the instructions are executable by the at least one processor to cause the apparatus to determine that the pattern of instructions is abnormal based at least in part on determining that the unique file operations include instructions to encrypt one or more copies of at least one file.

16. The apparatus of claim 13 , wherein, to determine that the pattern of instructions is abnormal, the instructions are executable by the at least one processor to cause the apparatus to:
determine that the unique file operations comprise a set of delete instructions that deviates from a normal pattern of delete instructions, a set of read instructions that deviat

Assignees

• Rubrik Inc

Inventors

• Pendyala Shanthi Kiran
• Wu Di
• Noe Matthew Edward

Classifications

• G06F16/1748

  De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641) · CPC title

• G06F9/4498

  Finite state machines · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F16/1734

  Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title