Systems and methods for using interaction weight when securing files and records
A data security method, including creating an interaction graph, by analyzing collected interaction events between users and between users and files and/or records, where a respective node of the interaction graph represents a specific one of a user, a record, and a file, where a respective edge indicates an interaction between respective users or between a respective user and a respective file and/or record, where an interaction weight assigned to the respective edge indicates an amount of the interaction, monitoring an attempt by a target user to access a target file and/or record, computing a target interaction weight between the target user and the target file and/or record from the interaction graph, and in response to the target interaction weight being below a target threshold, at least one of filtering security alerts, and blocking access by the target user to the target file and/or record.
1. A computer implemented method for securing at least one of files and records, the method comprising:
creating an interaction graph defining interaction events between users and at least one of files and records and between users;
monitoring an attempt by a target user to access at least one of a target file and a target record;
computing a target interaction weight represents contribution interaction weights between the target user and other users that contributed to the at least one of the target file and the target record;
adjusting the contribution interaction weights according to a decay parameter computed as a function of time elapsing from the contributions to the file and the interaction events between the target user and the other users that contributed to the at least one of the target file and the target record;
adjusting the contribution interaction weights according to a decay parameter computed as a function of time elapsing from the contributions to the file to the attempt to access the file;
computing the target interaction weight by summing the contribution interaction weights between the target user and the other users that contributed to the at least one of the target file and the target record;
comparing a target threshold with the target interaction weight; and
in response to the comparison satisfying a rule, at least one of:
(i) raising or filtering a security alert that corresponds to the target user and to at least one of the target file and the target record, and
(ii) blocking access by the target user to the at least one of the target file and the target record.
2. The method of claim 1 , further comprising:
collecting a plurality of interaction events between users and between users and at least one of files and records;
identifying which of the interaction events are active events and which of the interaction events are passive events and assigning a different weight to active events and passive events; and
computing the interaction graph according to an analysis of the plurality of interaction events.
3. The method of claim 2 , wherein collecting the plurality of interaction events is performed using at least one of a group comprising a code sensor, an application programming interfaces (APIs) and a virtual interface, installed on a device operated by the users or on a device in which the at least one of files and records is stored.
4. The method of claim 2 , wherein the interaction events are associated with an interaction contribution date, wherein a weight at least some of the interaction events decreases over time.
5. The method of claim 2 , wherein the plurality of interaction events are selected from a group consisting of: participating in an online meeting, organizing the online meeting, accessing a calendar event, sending email, receiving email, reading a file, sharing a file, creating a file, editing a file, accessing a record, reading a record, sharing a record, creating a record, and editing a record.
6. The method of claim 1 , wherein the target interaction weight between the target user and the at least one of target file and target record is computed as a function of at least one of:
(i) interaction weights between the target user and at least one other user having interaction weights with the at least one of target file and target record above a social connection threshold, and
(ii) interaction weights between the target user at least one of another file and another record having interaction weights with at least one other user above a file connection threshold.
7. The method of claim 1 , wherein monitoring the attempt by analyzing security alerts generated by a security application.
8. The method of claim 1 , further comprising:
identifying at least one similar user that is similar to the target user;
identifying at least one of: similar file that is similar to the target file, and similar record that is similar to the target record;
computing a similar interaction weight for the at least one similar user and at least one of similar file and similar record.
9. The method of claim 1 , further comprising updating the interaction graph with new interactions.
10. The method of claim 1 , wherein the interaction graph comprises nodes representing one of a specific user, a specific record, and a specific file.
11. The method of claim 10 , wherein the interaction graph comprises edges representing at least one of a group comprising an interaction between users, an interaction between a user and a file, an interaction between a user and a record.
12. The method of claim 11 , wherein at least some of the edges have an interaction weight assigned indicates an amount of the interaction.
13. The method of claim 1 , further comprises computing the target interaction weight by accumulating a number of interactions between the other users and the at least one of a target file and a target record.
14. The method of claim 1 , wherein computation of the interaction graph further comprises normalizing the interaction events by combining data logs from different data sources.