Media transfer protocol file copy detection
A method, system and computer-usable medium for detecting if a file(s) is/are copied to/from a computing device from/to one or more other devices. The computing device or information handling device is connected to other devices using a transfer protocol such as Media Transfer Protocol. File activity is monitored between the computing device and the other devices. Each file activity is entered into a common queue available to the computing device and the other devices. Comparison is made at to the entries in the queue as to entries that the same size and the file activity happens within a time window. Pairs that meet the size and activity time window are determined to be file copy pairs.
1. A computer-implementable method for monitoring and detecting file copy activity between an information handling device and one or more devices attempting to connect with the information handling device over a Media Transfer Protocol (MTP) connection, the method comprising:
the information handling device including a protected endpoint device interacting with an endpoint agent through at least one low-level hook, wherein the endpoint agent implements a security analytics system, and wherein the security analytics system includes a file copy module, an event stream collector, an event queue analytics module, and a storage Application Program Interface (API);
establishing a connection with the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device;
monitoring, by the file copy module, MTP file activities between the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device by:
registering a callback function for each of the one or more devices attempting to connect with the protected endpoint device, wherein the callback function requires monitoring for MTP file copy activities and MTP file read activities;
creating, by the file copy module, a common queue of events for the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device;
gathering, by the file copy module, information related to each occurrence of file activities into the common queue of events;
entering, by the file copy module, the information related to each occurrence of file activities as an entry into the common queue of events, wherein each entry includes a file size, a time stamp, and device information comprising a device name of a device attempting to connect with the protected endpoint device;
detecting, by the file copy module, one or more file copy activities by comparing entries in the common queue of events to determine entry pairs having same file sizes and time stamps within a predetermined time window, wherein each determined entry pair comprises a file read and a file create corresponding to a file copy activity;
subscribing, by the endpoint agent implementing the security analytics system, to events through the at least one low-level hook;
collecting, by the event stream collector of the security analytics system, event and related contextual information associated with one or more user behaviors;
processing, by the event queue analytics module of the security analytics system, the event and the related contextual information to generate enriched user behavior;
generating, by the event queue analytics module of the security analytics system, one or more analytic results by analyzing the enriched user behavior associated with the related contextual information, wherein the related contextual information may include at least one of an entity, a particular resource, or a service;
storing, by the storage API of the security analytics system, the one or more analytic results in one or more datastores.
2. The method of claim 1 , wherein the common queue of events is dynamically updated with entries.
3. The method of claim 1 further comprising providing a list of file activities based on the entry pairs determined to be file copy activities.
4. A system comprising:
a processor;
a data bus coupled to the processor; and
a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations for monitoring and detecting file copy activity between an information handling device and one or more devices attempting to connect with the information handling device over a Media Transfer Protocol (MTP) connection, and comprising instructions executable by the processor and configured for:
the information handling device including a protected endpoint device interacting with an endpoint agent through at least one low-level hook, the endpoint agent implementing a security analytics system, and the security analytics system including a file copy module, an event stream collector, an event queue analytics module, and a storage Application Program Interface (API);
establishing a connection with the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device;
monitoring, by the file copy module, MTP file activities between the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device by:
registering a callback function for each of the one or more devices attempting to connect with the protected endpoint device, wherein the callback function requires monitoring for MTP file copy activities and MTP file read activities;
creating, by the file copy module, a common queue of events for the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device;
gathering, by the file copy module, information related to each occurrence of file activities into the common queue of events;
entering, by the file copy module, the information related to each occurrence of file activities as an entry into the common queue of events, wherein each entry includes a file size, a time stamp, and device information comprising a device name of a device attempting to connect with the protected endpoint device;
detecting, by the file copy module, one or more file copy activities by comparing entries in the common queue of events to determine entry pairs having same file sizes and time stamps within a predetermined time window, wherein each determined entry pair comprises a file read and a file create corresponding to a file copy activity;
subscribing, by the endpoint agent implementing the security analytics system, to events through the at least one low-level hook;
collecting, by the event stream collector of the security analytics system, event and related contextual information associated with one or more user behaviors;
processing, by the event queue analytics module of the security analytics system, the event and the related contextual information to generate enriched user behavior;
generating, by the event queue analytics module of the security analytics system, one or more analytic results by analyzing the enriched user behavior associated with the related contextual information, wherein the related contextual information may include at least one of an entity, a particular resource, or a service;
storing, by the storage API of the security analytics system, the one or more analytic results in one or more datastores.
5. The system of claim 4 , wherein the common queue of events is dynamically updated with entries.
6. The system of claim 4 further comprising providing a list of file copy activities based on the pairs determined to be file copy activities.
7. A non-transitory, computer-readable storage medium embodying computer program code for monitoring and detecting file copy activity between an information handling device and one or more devices attempting to connect with the information handling device over a Media Transfer Protocol (MTP) connection, the computer program code comprising computer executable instructions configured for:
the information handling device including a protected endpoint device interacting with an endpoint agent through at least one low-level hook, the endpoint agent implementing a security analytics system, and the security analytics system including a file copy module, an event stream collector, an event queue analytics module, and a storage Application Program Interface (API);
establishing a connection with the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device;
monitoring, by the file copy module, MTP file activities between the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device by:
registering a callback function for each of the one or more devices attempting to connect with the protected endpoint device, wherein the callback function requires monitoring for MTP file copy activities and MTP file read activities;
creating, by the file copy module, a common queue of events for the protected endpoint device and the one or more devices attempting to connect with the protected endpoint device;
gathering, by the file copy module, information related to each occurrence of file activities into the common queue of events;
entering, by the file copy module, the information related to each occurrence of file activities as an entry into the common queue of events, wherein each entry includes a file size, a time stamp, and device information comprising a device name of a device attempting to connect with the protected endpoint device;
detecting, by the file copy module, one or more file copy activities by comparing entries in the common queue of events to determine entry pairs having same file sizes and time stamps within a predetermined time window, wherein each determined entry pair comprises a file read and a file create corresponding to a file copy activity;
subscribing, by the endpoint agent implementing the security analytics system, to events through the at least one low-level hook;
collecting, by the event stream collector of the security analytics system, event and related contextual information associated with one or more user behaviors;
processing, by the event queue analytics module of the security analytics system, the event and the related contextual information to generate enriched user behavior;
generating, by the event queue analytics module of the security analytics system, one or more analytic results by analyzing the enriched user behavior associated with the related contextual information, wherein the related contextual information may include at least one of an entity, a particular resource, or a service;
storing, by the storage API of the security analytics system, the one or more analytic results in one or more datastores.
8. The non-transitory, computer-readable storage medium of claim 7 , wherein the common queue of events is dynamically updated with entries.
9. The non-transitory, computer-readable storage medium of claim 7 , further comprising providing a list of file copy activities based on the pairs determined to be file copy activities.
10. The non-transitory, computer-readable storage medium of claim 7 , wherein the computer executable instructions are deployable to a client system from a server system at a remote location.
11. The non-transitory, computer-readable storage medium of claim 7 , wherein the computer executable instructions are provided by a service provider to a user on an on-demand basis.