Malicious data access as highlighted graph visualization

Patent metadata

Field	Value
Publication number	US-2022414210-A1
Application number	US-202117362700-A
Country	US
Kind code	A1
Filing date	Jun 29, 2021
Priority date	Jun 29, 2021
Publication date	Dec 29, 2022
Grant date	—

Abstract

One example method includes monitoring a data access pattern, registering a data access request directed to data, comparing metadata associated with the data access request to a rule, based on a result of the comparing, sending a trigger to a graph service, and using information in the trigger to generate a visual representation of the data access request, wherein the visual representation indicates an extent to which the data access request is considered to constitute a potential threat to the data.

First claim

What is claimed is:

1 . A method, comprising:
monitoring a data access pattern; registering a data access request directed to data; comparing metadata associated with the data access request to a rule; based on a result of the comparing, sending a trigger to a graph service; and using information in the trigger to generate a visual representation of the data access request, wherein the visual representation indicates an extent to which the data access request is considered to constitute a potential threat to the data.

2 . The method as recited in claim 1 , wherein the monitoring and the sending are performed by a malicious behavior service.

3 . The method as recited in claim 1 , wherein generation of the visual representation of the data access request is performed by the graph service.

4 . The method as recited in claim 1 , wherein the visual representation of the data access request comprises a graph that indicates a group to which a user, that generated the data access request, belongs.

5 . The method as recited in claim 1 , wherein the visual representation of the data access request comprises a graph that indicates data access attempts directed to various data assets by one or more users.

6 . The method as recited in claim 1 , wherein the metadata comprises metadata of a user who originated the data access request.

7 . The method as recited in claim 1 , wherein the visual representation of the data access request is generated based in part on user metadata of a user who made the data access request, group metadata of a group to which the user belongs, and data asset metadata of the data with which the data access request is concerned.

8 . The method as recited in claim 1 , wherein the trigger is based on the data access request in combination with another data access request that also concerns the data, and the another data access request is made by a same user that made the data access request or is made by a different user than the user that made the data access request.

9 . The method as recited in claim 1 , wherein, in the visual representation, a data access request that is considered a potential threat to the data is visually distinguishable from another data access request that is not considered to be a potential threat to the data.

10 . The method as recited in claim 1 , further comprising taking an action regarding the data based on information presented in the visual representation.

11 . A computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
monitoring a data access pattern; registering a data access request directed to data; comparing metadata associated with the data access request to a rule; based on a result of the comparing, sending a trigger to a graph service; and using information in the trigger to generate a visual representation of the data access request, wherein the visual representation indicates an extent to which the data access request is considered to constitute a potential threat to the data.

12 . The computer readable storage medium as recited in claim 11 , wherein the monitoring and the sending are performed by a malicious behavior service.

13 . The computer readable storage medium as recited in claim 11 , wherein generation of the visual representation of the data access request is performed by the graph service.

14 . The computer readable storage medium as recited in claim 11 , wherein the visual representation of the data access request comprises a graph that indicates a group to which a user, that generated the data access request, belongs.

15 . The computer readable storage medium as recited in claim 11 , wherein the visual representation of the data access request comprises a graph that indicates data access attempts directed to various data assets by one or more users.

16 . The computer readable storage medium as recited in claim 11 , wherein the metadata comprises metadata of a user who originated the data access request.

17 . The computer readable storage medium as recited in claim 11 , wherein the visual representation of the data access request is generated based in part on user metadata of a user who made the data access request, group metadata of a group to which the user belongs, and data asset metadata of the data with which the data access request is concerned.

18 . The computer readable storage medium as recited in claim 11 , wherein the trigger is based on the data access request in combination with another data access request that also concerns the data, and the another data access request is made by a same user that made the data access request or is made by a different user than the user that made the data access request.

19 . The computer readable storage medium as recited in claim 11 , wherein, in the visual representation, a data access request that is considered a potential threat to the data is visually distinguishable from another data access request that is not considered to be a potential threat to the data.

20 . The computer readable storage medium as recited in claim 11 , further comprising taking an action regarding the data based on information presented in the visual representation.

Assignees

• Emc Ip Holding Co Llc

Inventors

• El Rouby Ahmad Refaat Abdel Fadeel Ahmad
• Abdulaal Omar
• Reineke Nicole
• Christner Joel
• Shafik Farida
• Beshara Shary

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06T11/206

  Physics · mapped topic

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title