Application-based file exfiltration detection
US12045363B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | May 8, 2023 |
| Grant date | Jul 23, 2024 |
| Priority date | — |
| Expiry date | May 8, 2043 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1416
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Disclosed in some examples are methods, systems, and machine readable mediums for applications that detect indicators of data exfiltration through applications such as browser-based interfaces. The disclosed system monitors file system element events related to one or more target applications (such as browsers) through operating system interfaces. Once an event of interest is detected, the system interfaces with the browser to determine a context for the event of interest that may include a URL of a website that the user was visiting corresponding to the file system element event. If the URL is directed towards a prohibited site, a notification may be generated that may be used as a signal to alert an administrator. As used herein, a file system element may include a file, directory, folder, archive, blob, raw storage, metadata, or the like. File system element events may include copying, deleting, modifying, or moving a file system element. A file system element event may be detected by monitoring Input/Output requests of a computing device to write to a file; move a file; delete a file; or the like.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.