Applying activity actions to frequent activities

摘要

Activities of users of a service often involve one or more resources, such as uploading or downloading files in a file system of an FTP server. The activities of the users may be tracked and recorded in an activity log in order to identify frequently performed activities involving particular resources, and for such frequently performed activities, one or more activity actions may be performed. For example, malicious users may upload or utilize an equivalent set of assets stored in several accounts. The frequency of these undesirable activities may be identified, and an activity action may be automatically applied to the users (e.g., banning accounts), resources (e.g., deleting assets), and/or activities (e.g., blocking access to the resources). Conversely, desirable activities involving particular resources may be similarly detected, and the activity action applied to such desirable activities may involve reporting the desirable activity to an administrator of the service.

主权项

1. A method of evaluating activities of users involving user-accessible resources on a device having a processor and having access to an activity log, the method comprising:
executing, on the processor, instructions that cause the device to: responsive to detecting an instance of an activity performed by a selected user involving at least one user-accessible resource specified by the activity, record, in the activity log, the instance of the activity and the at least one user-accessible resource specified by the activity; evaluate the activity log to: determine a frequency of instances of respective activities performed by the users with at least one user-accessible resource, and among the respective activities, identify a frequent activity where instances of the frequent activity in the activity log have been performed with a frequency above a frequency threshold; and for respective frequent activities, identify an activity action to be applied in response to the frequent activity; and responsive to receiving a request to perform a requested activity specifying a user-accessible resource: compare the requested activity and the user-accessible resource specified by the requested activity with the frequent activity; and responsive to identifying the requested activity and the user-accessible resource specified by the requested activity as the frequent activity, perform the activity action associated with the frequent activity.