Determining trusted file awareness via loosely connected events and file attributes
Disclosed in some examples are methods, systems, devices, and machine-readable mediums which monitor for file system element transfers to and from both the endpoint and authorized accounts on network-based service providers (e.g., cloud-based storage). The system uses the capabilities of monitoring both the network-based service and the client computing device to filter out legitimate uploads to authorized network-based services and legitimate downloads to authorized computing devices. By matching events, it filters out events that are likely legitimate, the system may provide more accurate information, notifications, awareness, and unmatched event indications.
1. A method for detecting file system element exfiltration to or from a network-based service, the method comprising:
receiving a first file system element event from a first source type, the first file system element event describing events associated with a file system element of a file system on the first source type, the first source type a client computing device or the network-based service;
determining whether the first file system element event from the first source type matches any file system element events in a set of previously received file system element events from a second source type, the second source type being the client computing device when the first source type is the network-based service and the network-based service when the first source type is the client computing device;
responsive to determining that the first file system element event from the first source type does not match any file system element events in the set of previously received file system element events from the second source type, tagging the first file system element event as unmatched; and
transmitting, over a network, an indication that the first file system element event is unmatched to a computing device.
2. The method of claim 1 , wherein responsive to determining that the first file system element event from the first source type does not match any file system element events in the set of previously received file system element events from the second source type, tagging the first file system element event as unmatched further comprises determining that a timestamp associated with the first file system element event has exceeded a specified threshold.
3. The method of claim 1 , further comprising, raising an alert based upon the indication that the first file system element event is unmatched, the indication indicates that a file system element was uploaded to an unauthorized network-based service account if the first source type is the client computing device or that the file system element was downloaded to an unauthorized client computing device if the first source type is the network-based service.
4. The method of claim 1 , wherein determining whether the first file system element event from the first source type matches any file system element events in the set of previously received file system element events from the second source type further comprises:
for a second file system element event in the set of previously received file system element events determine whether the first and second file system element events match based upon whether metadata of file system elements associated with the first and second file system element events match.
5. The method of claim 1 , wherein determining whether the first file system element event from the first source type matches any file system element events in the set of previously received file system element events from the second source type further comprises:
for a second file system element event in the set of previously received file system element events determine whether the first and second file system element events match based upon whether metadata of file system elements associated with the first and second file system element events match and based upon a confidence score calculated using the first and second file system element events.
6. The method of claim 5 , wherein the confidence score is calculated based upon one or more of a difference of when the first and second file system element events occurred, a determination that the first and second file system element events correspond to a same network-based service, or a determination that a parent folder id of the first and second file system element events match.
7. The method of claim 4 , wherein the metadata of file system elements is a file hash.
8. The method of claim 1 , wherein the set of previously received file system element events are file system element events that were received within a specified time period.
9. A device for detecting file system element exfiltration to or from a network-based service, the device comprising:
a processor;
a memory, the memory storing instructions, which when executed by the processor, causes the device to perform operations comprising:
receiving a first file system element event from a first source type, the first file system element event describing events associated with a file system element of a file system on the first source type, the first source type a client computing device or the network-based service;
determining whether the first file system element event from the first source type matches any file system element events in a set of previously received file system element events from a second source type, the second source type being the client computing device when the first source type is the network-based service and the network-based service when the first source type is the client computing device;
responsive to determining that the first file system element event from the first source type does not match any file system element events in the set of previously received file system element events from the second source type, tagging the first file system element event as unmatched; and
transmitting, over a network, an indication that the first file system element event is unmatched to a computing device.
10. The device of claim 9 , wherein the operations of, responsive to determining that the first file system element event from the first source type does not match any file system element events in the set of previously received file system element events from the second source type, tagging the first file system element event as unmatched further comprises determining that a timestamp associated with the first file system element event has exceeded a specified threshold.
11. The device of claim 9 , wherein the operations further comprise raising an alert based upon the indication that the first file system element event is unmatched, the indication indicates that a file system element was uploaded to an unauthorized network-based service account if the first source type is the client computing device or that the file system element was downloaded to an unauthorized client computing device if the first source type is the network-based service.
12. The device of claim 9 , wherein the operations of determining whether the first file system element event from the first source type matches any file system element events in the set of previously received file system element events from the second source type further comprises:
for a second file system element event in the set of previously received file system element events determine whether the first and second file system element events match based upon whether metadata of file system elements associated with the first and second file system element events match.
13. The device of claim 9 , wherein the operations of determining whether the first file system element event from the first source type matches any file system element events in the set of previously received file system element events from the second source type further comprises:
for a second file system element event in the set of previously received file system element events determine whether the first and second file system element events match based upon whether metadata of file system elements associated with the first and second file system element events match and based upon a confidence score calculated using the first and second file system element events.
14. The device of claim 13 , wherein the confidence score is calculated based upon one or more of a difference of when the first and second file system element events occurred, a determination that the first and second file system element events correspond to a same network-based service, or a determination that a parent folder id of the first and second file system element events match.
15. The device of claim 12 , wherein the metadata of file system elements is a file hash.
16. The device of claim 9 , wherein the set of previously received file system element events are file system element events that were received within a specified time period.
17. A non-transitory machine-readable medium, storing instructions for detecting file system element exfiltration to or from a network-based service, the instructions, when executed by a machine, cause the machine to perform operations comprising:
receiving a first file system element event from a first source type, the first file system element event describing events associated with a file system element of a file system on the first source type, the first source type a client computing device or the network-based service;
determining whether the first file system element event from the first source type matches any file system element events in a set of previously received file system element events from a second source type, the second source type being the client computing device when the first source type is the network-based service and the network-based service when the first source type is the client computing device;
responsive to determining that the first file system element event from the first source type does not match any file system element events in the set of previously received file system element events from the second source type, tagging the first file system element event as unmatched; and
transmitting, over a network, an indication that the first file system element event is unmatched to a computing device.
18. The non-transitory machine-readable medium of claim 17 , wherein the operations of, responsive to determining that the first file system element event from the first source type does not match any file system element events in the set of previously received file system element events from the second source type, tagging the first file system element event as unmatched further comprises determining that a timestamp associated with the first file system element event has exceeded a specified threshold.
19. The non-transitory machine-readable medium of claim 17 , wherein the operations further comprise raising an alert based upon the indication that the first file system element event is unmatched, the indication indicates that a file system element was uploaded to an unauthorized network-based service account if the first source type is the client computing device or that the file system element was downloaded to an unauthorized client computing device if the first source type is the network-based service.
20. The non-transitory machine-readable medium of claim 17 , wherein the operations of determining whether the first file system element event from the first source type matches any file system element events in the set of previously received file system element events from the second source type further comprises:
for a second file system element event in the set of previously received file system element events determine whether the first and second file system element events match based upon whether metadata of file system elements associated with the first and second file system element events match.