| 主权项 |
1. A method for halting an unauthorized bulk data copy operation, comprising:
maintaining a repository of fingerprints, each fingerprint in the repository of fingerprints corresponding to a specific bulk data copy operation and indicative of one or more characteristics of the specific bulk copy operation corresponding to that fingerprint, wherein, for at least one fingerprint in the repository of fingerprints, the at least one fingerprint indicates a characteristic related to a file system traversal performed by the bulk data copy operation corresponding to the at least one fingerprint or the at least one fingerprint indicates a characteristic related to a number of files copied by the bulk data copy operation corresponding to the at least one fingerprint; receiving, from a user, a request, the request specifying a particular operation that, when executed, accesses a file system; determining whether the particular operation is a bulk data copy operation by matching a characteristic of the particular operation against one or more of the fingerprints in the repository; upon determining, based on the matching, that particular operation is a bulk data copy operation, detecting whether the particular operation exceeds a threshold associated with a permitted data copy operation; and halting the particular operation by the user in response to determining that the request is determined to be a bulk data copy operation and that the threshold is exceeded. |
