Backend data classifier for facilitating data loss prevention in storage devices of a computer network
An apparatus in one embodiment comprises a processing platform that includes one or more processing devices each comprising a processor coupled to a memory. The processing platform is associated with at least one storage device. The processing platform comprises a backend data classifier configured for communication with a data loss prevention system. The backend data classifier comprises a file analyzer configured to compare characteristics relating to current states of respective files stored in the storage device with information stored in a file history database, and an assignment module configured to assign classifications to respective ones of the files stored in the storage device based at least in part on comparison results from the file analyzer. The data loss prevention system is configured to perform different data loss prevention operations on different ones of the files stored in the storage device based at least in part on their respective assigned classifications.
1. An apparatus comprising:
a processing platform comprising at least one processing device having a processor coupled to a memory;
the processing platform being associated with at least one storage device;
the processing platform comprising:
a backend data classifier configured for communication with a data loss prevention system;
the backend data classifier comprising:
a file analyzer configured to compare characteristics relating to current states of respective files stored in the storage device with information stored in a file history database; and
an assignment module configured to assign classifications to respective ones of the files stored in the storage device based at least in part on comparison results from the file analyzer;
wherein the data loss prevention system is configured to perform different data loss prevention operations on different ones of the files stored in the storage device based at least in part on their respective assigned classifications;
wherein the backend data classifier is controllably switchable between a plurality of different operating modes, the operating modes comprising:
a transparent processing mode in which the backend data classifier processes the files in a manner transparent to the storage device as the files are provided to the storage device for storage therein, with the backend data classifier (i) being placed in-line with a data path between a user device and the storage device or (ii) being configured to receive copies of the files via a tap from the data path; and
one or more additional operating modes comprising at least one of a real-time processing mode and a scheduled processing mode; and
wherein the file analyzer and the assignment module of the backend data classifier are executed by the at least one processing device.
2. The apparatus of claim 1 wherein the assignment module in assigning classifications to respective ones of the files labels the respective files with the assigned classifications in metadata of those respective files and further wherein the metadata is made accessible to the data loss prevention system.
3. The apparatus of claim 1 wherein the backend data classifier is implemented externally to the storage device.
4. The apparatus of claim 1 wherein the backend data classifier is implemented at least in part internally to the storage device.
5. The apparatus of claim 1 wherein the storage device is accessible to at least one user device over a network and further wherein the backend data classifier operates out-of-band relative to the user device such that no component of the backend data classifier is implemented on the user device.
6. The apparatus of claim 1 wherein the backend data classifier is co-located with the storage device.
7. The apparatus of claim 1 wherein the backend data classifier is implemented in cloud infrastructure remote from the storage device.
8. The apparatus of claim 1 wherein the file analyzer of the backend data classifier processes the files substantially contemporaneously with the files being stored in the storage device by one or more user devices coupled to the storage device over a network.
9. The apparatus of claim 1 wherein the real-time processing mode comprises a real-time processing mode in which the backend data classifier receives copies of respective ones of the files from the storage device in conjunction with the respective ones of the files being stored in the storage device.
10. The apparatus of claim 1 wherein the scheduled processing mode comprises a scheduled direct access processing mode in which the backend data classifier accesses the storage device to identify and analyze at least a subset of the files that have been modified since a previous access by the backend data classifier to the storage device.
11. The apparatus of claim 1 wherein the file analyzer in comparing characteristics relating to the current states of the files with information stored in the file history database applies a plurality of evaluation criteria to a given one of the files to obtain individual comparison results for respective ones of the evaluation criteria for the given file.
12. The apparatus of claim 1 wherein the file analyzer in comparing characteristics relating to the current states of the files with information stored in the file history database performs combined analysis over multiple ones of the files and generates one or more combined comparison results for the multiple files.
13. The apparatus of claim 1 wherein the processing platform further comprises at least one of a ransomware detector, a malware detector and a virus detector wherein the at least one of the ransomware detector, the malware detector, and the virus detector, is configured to generate a detection score for one or more sets of files stored in the storage device, a given such detector being configured to generate an alert if the detection score for the one or more sets of files exceeds a specified threshold, wherein the alert is transmitted by the processing platform over a network to a processing device of a network security system, and wherein said at least one of the ransomware detector, the malware detector and the virus detector are each executed by the at least one processing device.
14. A method comprising:
associating a backend data classifier with at least one storage device;
comparing in the backend data classifier characteristics relating to current states of respective files stored in the storage device with information stored in a file history database;
assigning in the backend data classifier classifications to respective ones of the files stored in the storage device based at least in part on results of the comparing;
performing different data loss prevention operations on different ones of the files stored in the storage device based at least in part on their respective assigned classifications; and
controllably switching the backend data classifier between a plurality of different operating modes, the operating modes comprising:
a transparent processing mode in which the backend data classifier processes the files in a manner transparent to the storage device as the files are provided to the storage device for storage therein, with the backend data classifier (i) being placed in-line with a data path between a user device and the storage device or (ii) being configured to receive copies of the files via a tap from the data path; and
one or more additional operating modes comprising at least one of a real-time processing mode and a scheduled processing mode;
wherein the backend data classifier is implemented by at least one processing device comprising a processor coupled to a memory; and
wherein the file analyzer and the assignment module of the backend data classifier are executed by the at least one processing device.
15. The method of claim 14 wherein the storage device is accessible to at least one user device over a network and further wherein the backend data classifier operates out-of-band relative to the user device such that no component of the backend data classifier is implemented on the user device.
16. The method of claim 14 wherein
the real-time processing mode comprises a real-time processing mode in which the backend data classifier receives copies of respective ones of the files from the storage device in conjunction with the respective ones of the files being stored in the storage device; and
the scheduled direct access processing mode comprises a scheduled processing mode in which the backend data classifier accesses the storage device to identify and analyze at least a subset of the files that have been modified since a previous access by the backend data classifier to the storage device.
17. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by a processing platform comprising at least one processing device causes said processing platform:
to associate a backend data classifier with at least one storage device;
to compare in the backend data classifier characteristics relating to current states of respective files stored in the storage device with information stored in a file history database;
to assign in the backend data classifier classifications to respective ones of the files stored in the storage device based at least in part on results of the comparing;
to perform different data loss prevention operations on different ones of the files stored in the storage device based at least in part on their respective assigned classifications; and
to controllably switch the backend data classifier between a plurality of different operating modes, the operating modes comprising:
a transparent processing mode in which the backend data classifier processes the files in a manner transparent to the storage device as the files are provided to the storage device for storage therein, with the backend data classifier (i) being placed in-line with a data path between a user device and the storage device or (ii) being configured to receive copies of the files via a tap from the data path; and
one or more additional operating modes comprising at least one of a real-time processing mode and a scheduled processing mode; and
wherein the file analyzer and the assignment module of the backend data classifier are executed by the at least one processing device.
18. The computer program product of claim 17 wherein the storage device is accessible to at least one user device over a network and further wherein the backend data classifier operates out-of-band relative to the user device such that no component of the backend data classifier is implemented on the user device.
19. The computer program product of claim 17 wherein
the real-time processing mode comprises a real-time processing mode in which the backend data classifier receives copies of respective ones of the files from the storage device in conjunction with the respective ones of the files being stored in the storage device; and
the scheduled direct access processing mode comprises a scheduled processing mode in which the backend data classifier accesses the storage device to identify and analyze at least a subset of the files that have been modified since a previous access by the backend data classifier to the storage device.
20. The computer program product of claim 17 wherein the assignment module in assigning classifications to respective ones of the files labels the respective files with the assigned classifications in metadata of those respective files and further wherein the metadata is made accessible to the data loss prevention system.