Detection, isolation, and mitigation of attacks on a file system
Techniques are disclosed to detect, isolate, and/or mitigate an attack on a file system, for example, by malicious software, human actors, and/or compromised Internet-connected devices (bots). A processor of a data processing system detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets. Based on detecting the abnormal file system access pattern, the processor temporarily suspends file system access by at least one user ID contributing to the abnormal file system access pattern. The processor provides a notification identifying one or more file system object accessed in the abnormal file system access pattern.
1. A method of data processing in a data processing system including a processor, the method comprising:
a processor establishing, for a user ID, a time-based file system access limit applicable to file system access requests attributed to the user ID and directed to a file system;
the processor detecting, within network layer packets communicated on a communication network, an abnormal file system access pattern directed to the file system, wherein the detecting includes comparing, to the time-based file system access limit, a number of file system access requests in the network layer packets of a given file system protocol that are attributed to the user ID and that are observed within an observation interval;
based on detecting the abnormal file system access pattern, the processor temporarily suspending, at the network layer, file system access by the user ID contributing to the abnormal file system access pattern; and
the processor providing a notification identifying one or more file system objects accessed in the abnormal file system access pattern.
2. The method of claim 1 , wherein establishing the time-based file system access limit includes setting the file system access limit based on an observed number of file system access requests attributed to the user ID during each of one or more prior observation intervals.
3. The method of claim 1 , further comprising:
the processor periodically updating the time-based file system access limit based on changing file system access patterns attributed to the user ID.
4. The method of claim 1 , further comprising:
building a file access index characterizing file system traffic based on file system access requests in network layer packets that are attributed to one or more user IDs including the user ID;
wherein the comparing includes referencing the file access index.
5. The method of claim 1 , further comprising:
based on detecting the abnormal file system access pattern, the processor temporarily suspending file system access by the user ID to the file system through handling of network layer packets attributed to the user ID.
6. The method of claim 1 , further comprising:
based on detecting the abnormal file system access pattern, the processor recovering at least one file system object recently accessed by the user ID by reverting to a prior version of the at least one file system object.
7. A data processing system, comprising:
a processor; and
a storage device coupled to the processor, wherein the storage device includes program code executable by the processor core that causes the data processing system to perform:
establishing, for a user ID, a time-based file system access limit applicable to file system access requests attributed to the user ID and directed to a file system;
detecting, within network layer packets communicated on a communication network, an abnormal file system access pattern directed to the file system, wherein the detecting includes comparing, to the time-based file system access limit, a number of file system access requests in the network layer packets of a given file system protocol that are attributed to the user ID and that are observed within an observation interval;
based on detecting the abnormal file system access pattern, temporarily suspending, at the network layer, file system access by the user ID contributing to the abnormal file system access pattern; and
providing a notification identifying one or more file system objects accessed in the abnormal file system access pattern.
8. The data processing system of claim 7 , wherein establishing the time-based file system access limit includes setting the file system access limit based on an observed number of file system access requests attributed to the user ID during each of one or more prior observation intervals.
9. The data processing system of claim 7 , wherein the program code further causes the data processing system to perform:
periodically updating the time-based file system access limit based on changing file system access patterns attributed to the user ID.
10. The data processing system of claim 7 , wherein the program code further causes the data processing system to perform:
building a file access index characterizing file system traffic based on file system access requests in network layer packets that are attributed to of one or more user IDs including the user ID;
wherein the comparing includes referencing the file access index.
11. The data processing system of claim 7 , wherein the program code further causes the data processing system to perform:
based on detecting the abnormal file system access pattern, temporarily suspending file system access by the user ID to the file system through handling of network layer packets attributed to the user ID.
12. The data processing system of claim 7 , wherein the program code further causes the processor to perform:
based on detecting the abnormal file system access pattern, recovering at least one file system object recently accessed by the user ID by reverting to a prior version of the at least one file system object.
13. A program product, comprising:
a storage device; and
program code, stored within the storage device, which when executed by a processor of a data processing system serving a source host causes the data processing system to perform:
establishing, for a user ID, a time-based file system access limit applicable to file system access requests attributed to the user ID and directed to a file system;
detecting, within network layer packets communicated on a communication network, an abnormal file system access pattern directed to the file system, wherein the detecting includes comparing, to the time-based file system access limit, a number of file system access requests in the network layer packets of a given file system protocol that are attributed to the user ID and that are observed within an observation interval;
based on detecting the abnormal file system access pattern, temporarily suspending, at the network layer, file system access by the user ID contributing to the abnormal file system access pattern; and
providing a notification identifying one or more file system objects accessed in the abnormal file system access pattern.
14. The program product of claim 13 , wherein establishing the time-based file system access limit includes setting the file system access limit based on an observed number of file system access requests attributed to the user ID during each of one or more prior observation intervals.
15. The program product of claim 13 , wherein the program code further causes the data processing system to perform:
periodically updating the time-based file system access limit based on changing file system access patterns attributed to the user ID.
16. The program product of claim 13 , wherein the program code further causes the data processing system to perform:
building a file access index characterizing file system traffic based on file system access requests in network layer packets that are attributed to one or more user IDs including the user ID;
wherein the comparing includes referencing the file access index.
17. The data processing system of claim 13 , wherein the program code further causes the data processing system to perform:
based on detecting the abnormal file system access pattern, temporarily suspending file system access by the user ID to the file system through handling of network layer packets attributed to the user ID.
18. The data processing system of claim 13 , wherein the program code further causes the data processing system to perform:
based on detecting the abnormal file system access pattern, recovering at least one file system object recently accessed by the user ID by reverting to a prior version of the at least one file system object.
19. The method of claim 1 , further comprising:
based on detecting the abnormal file system access pattern, the processor temporarily suspending file system access to one or more file system objects recently accessed by the user ID.
20. The method of claim 1 , wherein the detecting includes detecting at a hardware platform interposed in the communication network between a computing node associated with the user ID and a file server hosting the file system.
21. The method of claim 5 , wherein temporarily suspending file system access by the user ID includes the processor refraining from communicating file system access requests attributed to the user ID to the file system.
22. The method of claim 21 , wherein the refraining includes the processor discarding network layer packets that include file system access requests attributed to the user ID.
23. The method of claim 1 , wherein the file system protocol is one of the following: Server Message Block (SMB), Network File System (NFS), and SSH File Transfer Protocol (SFTP).