Three-dimensional file event representation
Systems and techniques for three-dimensional file event representation are described herein. File event data may be obtained for a file for a time segment. The file event data may include a file system hierarchy for the file. A spatial file operation map may be generated for the file system hierarchy including a file operation map for the file for the time segment. The file operation map for the file may include a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file. It may be determined that a file operation was performed on the file during the time segment based on the file event data. An indication may be generated on a layer of the plurality layers of the file operation map that the file operation was performed. The layer corresponds to a file operation class of the file operation.
1. A system for spatial file operation mapping, the system comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the at least one processor to perform operations to:
obtain file event data for a file for a time segment, the file event data including a file system hierarchy for the file;
generate a spatial file operation map for the file system hierarchy including a file operation map for the file for the time segment, wherein the file operation map for the file includes a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file;
determine that a file operation was performed on the file during the time segment based on the file event data;
generate an indication on a layer of the plurality layers of the file operation map that the file operation was performed, wherein the layer corresponds to a file operation class of the file operation;
generate a file operation anomaly machine learning model;
evaluate the spatial file operation map using the file operation anomaly machine learning model to change a file operation anomaly state from negative to positive; and
prevent access to the file until the file operation anomaly state has changed to negative.
2. The system of claim 1 , wherein the spatial file operation map is divided into segments based on the file system hierarchy.
3. The system of claim 1 , wherein the plurality of layers includes one or more of a read operation layer, a write operation layer, and a modify operation layer.
4. The system of claim 1 , wherein the spatial file operation map includes a plurality of dimensions, wherein each dimension of the plurality of dimensions corresponds to a layer, wherein each dimension includes one or more subsections, and wherein each subsection of the one or more subsections corresponds to a top-level folder in the file system hierarchy.
5. The system of claim 1 , wherein spatial distance between a first entity and a second entity in the spatial file operation map is expressed as a directory distance between a first folder in the file system hierarchy corresponding to the first entity and a second folder in the file system hierarchy corresponding to the second entity.
6. The system of claim 1 , wherein the file operation anomaly machine learning model is generated using the spatial file operation map and a set of training file operations.
7. The system of claim 1 , wherein the file operation anomaly machine learning model is generated by a convolutional neural network.
8. At least one non-transitory machine-readable medium including instructions for spatial file operation mapping that, when executed by at least one processor, cause the at least one processor to perform operations to:
obtain file event data for a file for a time segment, the file event data including a file system hierarchy for the file;
generate a spatial file operation map for the file system hierarchy including a file operation map for the file for the time segment, wherein the file operation map for the file includes a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file;
determine that a file operation was performed on the file during the time segment based on the file event data;
generate an indication on a layer of the plurality layers of the file operation map that the file operation was performed, wherein the layer corresponds to a file operation class of the file operation;
generate a file operation anomaly machine learning model;
evaluate the spatial file operation map using the file operation anomaly machine learning model to change a file operation anomaly state from negative to positive; and
prevent access to the file until the file operation anomaly state has changed to negative.
9. The at least one non-transitory machine-readable medium of claim 8 , wherein the spatial file operation map is divided into segments based on the file system hierarchy.
10. The at least one non-transitory machine-readable medium of claim 8 , wherein the plurality of layers includes one or more of a read operation layer, a write operation layer, and a modify operation layer.
11. The at least one non-transitory machine-readable medium of claim 8 , wherein the spatial file operation map includes a plurality of dimensions, wherein each dimension of the plurality of dimensions corresponds to a laver, wherein each dimension includes one or more subsections, and wherein each subsection of the one or more subsections corresponds to a top-level folder in the file system hierarchy.
12. The at least one non-transitory machine-readable medium of claim 8 , wherein spatial distance between a first entity and a second entity in the spatial file operation map is expressed as a directory distance between a first folder in the file system hierarchy corresponding to the first entity and a second folder in the file system hierarchy corresponding to the second entity.
13. The at least one non-transitory machine-readable medium of claim 8 , wherein the file operation anomaly machine learning model is generated using the spatial file operation map and a set of training file operations.
14. The at least one non-transitory machine-readable medium of claim 8 , wherein the file operation anomaly machine learning model is generated by a convolutional neural network.
15. A method for spatial file operation mapping, the method comprising:
obtaining file event data for a file for a time segment, the file event data including a file system hierarchy for the file;
generating a spatial file operation map for the file system hierarchy including a file operation map for the file for the time segment, wherein the file operation map for the file includes a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file;
determining that a file operation was performed on the file during the time segment based on the file event data;
generating an indication on a layer of the plurality layers of the file operation map that the file operation was performed, wherein the layer corresponds to a file operation class of the file operation;
generating a file operation anomaly machine learning model;
evaluating the spatial file operation map using the file operation anomaly machine learning model to change a file operation anomaly state from negative to positive; and
preventing access to the file until the file operation anomaly state has changed to negative.
16. The method of claim 15 , wherein the spatial file operation map is divided into segments based on the file system hierarchy.
17. The method of claim 15 , wherein the plurality of layers includes one or more of a read operation layer, a write operation layer, and a modify operation layer.
18. The method of claim 15 , wherein the spatial file operation map includes a plurality of dimensions, wherein each dimension of the plurality of dimensions corresponds to a layer, wherein each dimension includes one or more subsections, and wherein each subsection of the one or more subsections corresponds to a top-level folder in the file system hierarchy.
19. The method of claim 15 , wherein spatial distance between a first entity and a second entity in the spatial file operation map is expressed as a directory distance between a first folder in the file system hierarchy corresponding to the first entity and a second folder in the file system hierarchy corresponding to the second entity.
20. The method of claim 15 , wherein the file operation anomaly machine learning model is generated using the spatial file operation map and a set of training file operations.
21. The method of claim 15 , wherein the file operation anomaly machine learning model is generated by a convolutional neural network.