Method and system for forensic data tracking
The present invention relates to a method and system for tracking the movement of data elements as they are shared and moved between authorized and unauthorized devices and among authorized and unauthorized users.
1. A computing system comprising one or more network devices, the one or more network devices comprising one or more microprocessors and one or more memories that store executable instructions that, when executed by the one or more microprocessors, facilitate performance of operations, comprising:
receiving meta data associated with an endpoint, the meta data comprising:
an endpoint identifier that is indicative of the endpoint with which the meta data is associated, and
one or more of an electronic file name, a user identifier, and one or more data tags;
analyzing the meta data based on one or more of a configured setting and a policy;
determining, based on the analyzing of the meta data, a pattern of data activity that constitutes a deviation from normal behavior, wherein the deviation from normal behavior is determined based on a detected data activity that deviates from an average data activity for one or more of a user, a set of users, the endpoint, and a set of endpoints, wherein the detected data activity is determined by detecting that a significant volume of the meta data, relative to historical behavior, is associated with one or more of the user, the set of users, the endpoint, and the set of endpoints; and
in response to determining the deviation from normal behavior, performing one or more responsive actions.
2. The system of claim 1 , wherein the one or more data tags are capable of being used to determine a data classification associated with one or more of an electronic file and the endpoint.
3. The system of claim 1 , wherein the one or more data tags are indicative of a type of data included within or transmitted from the endpoint and wherein the deviation from normal behavior is based at least in part on the type of data included within an electronic file or transmitted from the endpoint.
4. The system of claim 1 , wherein the configured setting is stored in a settings database, and the configured setting relates to controlling user authorization to download data and user authorization to share data using the computing system.
5. The system of claim 1 , wherein the deviation from normal behavior is determined by the significant volume of the meta data exceeding a predetermined threshold relative to the historical behavior.
6. The system of claim 2 , wherein the data classification is usable to determine, based on the one or more of the configured setting and policy, whether data is unauthorized.
7. The system of claim 1 , wherein the policy comprises one or more of a standard policy, a customized policy, a data protection policy, a policy unique to an enterprise, and a foreign jurisdiction policy.
8. The system of claim 1 , wherein the one or more responsive actions comprises one or more of reporting, alerting, redacting, deleting, encrypting, and archiving.
9. The system of claim 1 , further comprising determining that the endpoint is unauthorized based on the one or more of the configured setting and policy.
10. The system of claim 9 , wherein the determining that the endpoint is unauthorized comprises determining that data associated with the endpoint is unauthorized.
11. The system of claim 10 , wherein the determining that data is unauthorized comprises determining that the data is unauthorized for downloading by a user.
12. The system of claim 10 , wherein the determining that the electronic file is unauthorized comprises determining that data is unauthorized for sharing by a user.
13. The system of claim 1 , wherein the detected data activity is based at least in part on a number of electronic files accessed by one or more of the user, the set of users, the endpoint, and the set of endpoints.
14. The system of claim 1 , wherein the detected data activity is based at least in part on a number of electronic files downloaded by one or more of the user, the set of users, the endpoint, and the set of endpoints.
15. The system of claim 1 , wherein the detected data activity is based at least in part on a number of electronic files shared by one or more of the user, the set of users, the endpoint, and the set of endpoints.
16. The system of claim 1 , wherein the deviation from normal behavior is related to a spike in activity for the user, the set of users, the endpoint, or the set of endpoints.
17. The system of claim 1 , wherein the one or more of the configured setting and the policy is associated with one or more of the user, the set of users, and the endpoint.
18. The system of claim 1 , wherein the endpoint identifier is one of an IP address, a URL, a software identifier and a computing device identifier.
19. A method related to computing forensics, the method comprising:
transmitting machine-executable instructions to one or more network devices comprising one or more processors and one or more memories, wherein the machine-executable instructions are stored in the one or more memories, and wherein the machine-executable instructions when executed by the one or more processors enable the one or more network devices to:
receive meta data associated with an endpoint, the meta data comprising:
an endpoint identifier that is indicative of the endpoint with which the meta data is associated, and
one or more of an electronic file name, a user identifier and one or more data tags;
analyze the meta data based on one or more of a configured setting and a policy;
determine, based on analyzing the meta data, a pattern of data activity that constitutes a deviation from a normal pattern of data activity, wherein the deviation from the normal pattern of data activity is determined by a percentage change of data activity compared to data activity for one or more of a user, a set of users, the endpoint, and a set of endpoints, wherein the percentage change of data activity is determined by detecting that a significant volume of the meta data, relative to historical behavior, is associated with one or more of the user, the set of users, the endpoint, and the set of endpoints; and
perform one or more responsive actions related to determining the pattern of data activity that constitutes the deviation from the normal pattern of data activity.
20. The method of claim 19 , wherein a software agent is resident on the endpoint to facilitate a collection and transmission of the meta data to the one or more network devices.
21. The method of claim 19 , wherein the one or more data tags is used to determine a data classification associated with the endpoint.
22. The method of claim 19 , wherein the one or more data tags is indicative of a type of data associated with the endpoint.
23. The method of claim 19 , wherein the configured setting relates to user authorization to access data stored on the endpoint.
24. The method of claim 19 , wherein the configured setting relates to user authorization to download data from the endpoint.
25. The method of claim 19 , wherein the configured setting relates to user authorization to share data from the endpoint.
26. The method of claim 19 , wherein the one or more responsive actions comprises one or more of a redaction of data, a deletion of data, an encryption of data, and sending an alert regarding the deviation from normal behavior.
27. The method of claim 19 , wherein the one or more responsive actions comprises predicting data breaches based on changes in data topology associated with the endpoint, wherein the change in data topology reflects the deviation from normal behavior.
28. The method of claim 27 , wherein the changes in data topology reflect that data of a specific data classification associated with the endpoint.
29. The method of claim 19 , wherein the percentage change of data activity is based at least in part on one or more of a number of files transmitted to the endpoint, a number of files downloaded from the endpoint, a number of file access attempts, and a number of classified files associated with the endpoint.
30. The method of claim 26 , wherein the alert may be generated based on an anomaly wherein a user has sent or received a number of files that exceeds the average number of files sent or received by the user or exceeds a preestablished threshold of total files sent or received.
31. The method of claim 19 , wherein the deviation from the normal pattern of data activity is determined by the significant volume of the meta data exceeding a predetermined threshold relative to the historical behavior.
32. A computing system comprising one or more network devices, the one or more network devices comprising one or more microprocessors and one or more memories that store executable instructions that, when executed by the one or more microprocessors, facilitate performance of operations, comprising:
receiving meta data associated with an endpoint, the meta data comprising:
an endpoint identifier that is indicative of the endpoint with which the meta data is associated, and
one or more of an electronic file name, a user identifier, an IP address, a URL, a software identifier and a computing device identifier;
determining, based on analyzing the meta data, a pattern of activity that constitutes a deviation from normal behavior, wherein the deviation from normal behavior is determined by detecting that a significant volume of the meta data, relative to historical behavior, is associated with one or more of a user, a set of users, the endpoint, a set of endpoints, the IP address, the URL, the software identifier, and the computing device identifier.