System and method for correlating filesystem events into meaningful behaviors

Patent metadata

Field	Value
Publication number	US-12287872-B2
Application number	US-202117446531-A
Country	US
Kind code	B2
Filing date	Aug 31, 2021
Priority date	Aug 31, 2021
Publication date	Apr 29, 2025
Grant date	Apr 29, 2025

Abstract

One example method includes integrating user space applications with kernel space events including primitives. The events are intercepted in kernel space and processed in user space. The events can be stored in a session cache that allows a holistic view of behavior to be determined with regard to resources of the computing system. The events in the session cache can be correlated to user or process behavior by provided a time-based view of the events.

First claim

What is claimed is:

1. A method, comprising:
intercepting an event at a filter driver, wherein the event is associated with a resource of a computing system;
identifying metadata associated with the event by a correlating engine, wherein the correlating engine resides at a user space and not at a kernel space;
storing, by the correlating engine, the metadata associated with the event in a session associated with the resource, wherein the session is included in a session cache of the correlating engine;
performing the event in the computing system;
generating a logical timeline of the session that includes information for each entry in the session; and
determining that a subsequent event causes the session to be finalized,
wherein, when it is determined that the session is to be finalized based on the subsequent event, entries in the session are exported from the session cache to a data store external to the correlating engine.

2. The method of claim 1 , further comprising intercepting the event in a kernel space and providing the event to the correlating engine operating in a user space, wherein the correlating engine includes the session cache.

3. The method of claim 1 , wherein each of the entries corresponds to a respective event.

4. The method of claim 3 , wherein the logical timeline includes a time ordered list of events related to the resource in a graph form, a time series form, a table form, or a relational database form.

5. The method of claim 4 , further comprising storing the logical timeline in the data store such that logical timelines stored in the data store can be queried.

6. The method of claim 1 , further comprising extracting the metadata, wherein the metadata includes a session identifier, a handle, an identity of a user, process metadata including process ID, executable name, resource location, and application name, and timestamps.

7. The method of claim 1 , wherein the resource comprises a file, a bucket, a directory tree, or an object.

8. The method of claim 1 , further comprising applying a policy to the event based on the event and/or entries in the session associated with the resource.

9. The method of claim 8 , further comprising stopping the event, altering data associated with the event, generating notifications based on the event and/or other events related to the resource.

10. The method of claim 1 , further comprising operating the correlating engine in a user space, wherein the correlating engine includes the session cache, a filter driver proxy configured to receive the event from the filter driver, and an implementation engine configured to process the event for storing in the session cache.

11. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
intercepting an event at a filter driver, wherein the event is associated with a resource of a computing system;
identifying metadata associated with the event by a correlating engine, wherein the correlating engine resides at a user space and not at a kernel space;
storing, by the correlating engine, the metadata associated with the event in a session associated with the resource, wherein the session is included in a session cache of the correlating engine;
performing the event in the computing system;
generating a logical timeline of the session that includes information for each entry in the session; and
determining that a subsequent event causes the session to be finalized,
wherein, when it is determined that the session is to be finalized based on the subsequent event, entries in the session are exported from the session cache to a data store external to the correlating engine.

12. The non-transitory storage medium of claim 11 , further comprising intercepting the event in a kernel space and providing the event to the correlating engine operating in a user space, wherein the correlating engine includes the session cache.

13. The non-transitory storage medium of claim 11 , wherein each of the entries corresponds to a respective event.

14. The non-transitory storage medium of claim 13 , wherein the logical timeline includes a time ordered list of events related to the resource in a graph form, a time series form, a table form, or a relational database form.

15. The non-transitory storage medium of claim 14 , further comprising storing the logical timeline in the data store such that logical timelines stored in the data store can be queried.

16. The non-transitory storage medium of claim 11 , further comprising extracting the metadata, wherein the metadata includes a session identifier, a handle, an identity of a user, process metadata including process ID, executable name, resource location, and application name, and timestamps.

17. The non-transitory storage medium of claim 11 , wherein the resource comprises a file, a bucket, a directory tree, or an object.

18. The non-transitory storage medium of claim 11 , further comprising applying a policy to the event based on the event and/or entries in the session associated with the resource.

19. The non-transitory storage medium of claim 18 , further comprising stopping the event, altering data associated with the event, generating notifications based on the event and/or other events related to the resource.

20. The non-transitory storage medium of claim 11 , further comprising operating the correlating engine in a user space, wherein the correlating engine includes the session cache, a filter driver proxy configured to receive the event from the filter driver, and an implementation engine configured to process the event for storing in the session cache.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Christner Joel
• Reineke Nicole
• Shafik Farida

Classifications

• G06F9/545

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F16/2358

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title

• G06F2209/542

  Intercept · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title