Method, system, and apparatus for probabilistic identification of encrypted files

1. A computer-implemented method for identifying encrypted files in a security analytics environment, the method comprising:

building a file size table, the building comprising:

performing a size comparison between an encrypted file and entries in the file size table to determine whether the encrypted file corresponds to a file listed in the file size table, when the encrypted file corresponds to the file listed in the file size table then classifications associated with the file in the file size table are used to determine whether to restrict transfer of the encrypted file;

when the encrypted file does not correspond to a file listed in the file size table, then storing information related to identification of the encrypted file, an original size of the encrypted file and compression information in the file size table, the compression information including a range of compression sizes of the encrypted file, the information related to identification of the encrypted file, the original size of the encrypted file and the compression information in the file size table being used to determine whether to restrict transfer of the encrypted file;

determining whether one or more entries in the file size table matches a size of the encrypted file wherein each entry in the file size table comprises a file size and a range of compressed file sizes for an unencrypted file in a set of files, the range of compressed file sizes being bound by a minimum compressed file size and a maximum compressed file size;

determining a probability that a matching entry uniquely identifies the encrypted file;

controlling a transfer of the encrypted file according to one or more rules associated with a file associated with the matching entry when the probability is high that the matching entry uniquely identifies the encrypted file and when there are the one or more rules associated with the file, the controlling the transfer handling an event involving the encrypted file in a same manner as for a corresponding original, unencrypted file, the controlling the transfer permitting transferring the encrypted file when the corresponding original, unencrypted file does not contain sensitive data, the controlling the transfer restricting transfer of the encrypted file when the original, unencrypted file contains sensitive data.

2. The method of claim 1 further comprising:

monitoring a first plurality of electronically-observable actions of a user entity operating within the security analytics environment, wherein the first plurality of electronically-observable actions of the user entity correspond to a respective plurality of events enacted by the user entity; and

determining whether an action of the first plurality of electronically-observable actions of the user entity comprises a transfer of the encrypted file.

3. The method of claim 1 further comprising:

determining whether a size of the encrypted file is greater than a threshold size prior to said determining whether one or more entries of the file size table match the size of the encrypted file; and

performing said determining whether one or more entries of the file size table match the size of the encrypted file only if the size of the encrypted file is greater than the threshold size.

4. The method of claim 3 wherein the threshold size is one gigabyte.

5. The method of claim 3 wherein the threshold size corresponds to a size greater than two standard deviations from a mean file size of a log-normal distribution of file sizes in the set of files.

6. The method of claim 3 further comprising:

enforcing a first default transfer rule on the encrypted file when the size of the encrypted file is less than the threshold size.

7. The method of claim 6 wherein the default rule comprises one of permitting the transfer of the encrypted file or halting the transfer of the encrypted file.

8. The method of claim 6 further comprising:

receiving the default rule, wherein the default rule is predetermined by administration of the security analytics environment.

9. The method of claim 6 further comprising:

enforcing a second default transfer rule on the encrypted file when there is not a matching file size or file-size range in the file size table, wherein

the second default rule is predetermined by administration of the security analytics environment, and

the second default rule comprises a rule that is the same as or different from the first default rule.

10. The method of claim 1 , wherein

the file size table comprises one or more entries corresponding to a set of files stored in the security analytics environment, and

each entry of the file size table comprises a file size, a maximum compressed file size, a minimum compressed file size, and an identifier of the associated file.

11. The method of claim 10 wherein the file size table comprises entries corresponding to files having a file size above a second threshold.

12. The method of claim 11 wherein the second threshold is the same as the first threshold.

13. The method of claim 11 wherein the file size table comprises entries corresponding to files having a maximum compressed size above a third threshold.

14. The method of claim 13 wherein the third threshold is the same as the second threshold.

15. The method of claim 10 wherein the maximum compressed size and the minimum compressed size are adjusted to comprise an increase in file size due to encryption.

16. A node in a security analytics environment comprising:

a processor;

a network interface, coupled to the processor and communicatively coupled to a remote network node in the security analytics environment via a network;

a first non-transitory, computer-readable storage medium, coupled to the processor and storing a plurality of files in a file set; and

a second non-transitory, computer-readable storage medium, coupled to the processor, and storing instructions executable by the processor and configured to:

generate a file size table comprising one or more entries corresponding to a subset of the plurality of files in the file set, wherein

the file size table comprises one or more entries, and

each entry of the file size table comprises a file size, a range of compression sizes, the range of compression sizes comprising a maximum compressed file size and a minimum compressed file size, and an identifier of the associated file,

determine whether an action executed on the node comprises a transfer of an encrypted file,

determine whether one or more entries in the file size table comprise one of a file size or a compressed file size range matching the size of the encrypted file, wherein the file size range is bound by the maximum compressed file size and the minimum compressed file size, and

control the transfer of the encrypted file according to one or more rules associated with a file associated with the matching entry when there are rules associated with the file associated with the matching entry, the one or more rules being associated with an unencrypted version of the file, the controlling the transfer handling an event involving the encrypted file in a same manner as for a corresponding original, unencrypted file, the controlling the transfer permitting transferring the encrypted file when the corresponding original, unencrypted file does not contain sensitive data, the controlling the transfer restricting transfer of the encrypted file when the original, unencrypted file contains sensitive data.

17. The node of claim 16 wherein the second non-transitory, computer-readable storage medium comprises further instructions configured to

determine a probability that a matching entry uniquely identifies the encrypted file; and

perform said controlling the transfer of the encrypted file when the probability is high that the matching entry uniquely identifies the encrypted file.

18. The node of claim 16 wherein said controlling the transfer of the encrypted file comprises one or more of

halting the transfer,

allowing the transfer, and

communicating information regarding the transfer to a security analytics server.

19. A non-transitory, computer-readable storage medium storing computer program code, the computer program code comprising computer executable instructions configured for:

building a file size table, the building comprising:

performing a size comparison between an encrypted file and entries in the file size table to determine whether the encrypted file corresponds to a file listed in the file size table, when the encrypted file corresponds to the file listed in the file size table then classifications associated with the file in the file size table are used to determine whether to restrict transfer of the encrypted file;

when the encrypted file does not correspond to a file listed in the file size table, then storing information related to identification of the encrypted file, an original size of the encrypted file and compression information in the file size table, the compression information including a range of compression sizes of the encrypted file, the information related to identification of the encrypted file, the original size of the encrypted file and the compression information in the file size table being used to determine whether to restrict transfer of the encrypted file;

determining whether one or more entries in a file size table matches a size of an encrypted file wherein each entry in the file size table comprises one or more of a file size, maximum compressed file size, and minimum compressed file size for an unencrypted file in a set of files;

determining a probability that a matching entry uniquely identifies the encrypted file; and

controlling a transfer of the encrypted file according to one or more rules associated with a file associated with the matching entry when the probability is high that the matching entry uniquely identifies the encrypted file, the one or more rules being associated with an unencrypted version of the file, the controlling the transfer handling an event involving the encrypted file in a same manner as for a corresponding original, unencrypted file, the controlling the transfer permitting transferring the encrypted file when the corresponding original, unencrypted file does not contain sensitive data, the controlling the transfer restricting transfer of the encrypted file when the original, unencrypted file contains sensitive data.

20. The non-transitory, computer-readable storage medium storing computer program code of claim 19 further comprising computer executable instructions configured for:

determining whether a size of the encrypted file is greater than a threshold size prior to said determining whether one or more entries of the file size table match the size of the encrypted file; and

performing said determining whether one or more entries of the file size table match the size of the encrypted file only if the size of the encrypted file is greater than the threshold size.