APPARATUS AND METHODS FOR DETECTING DATA ACCESS

摘要

The following abstract is not intended as a limiting description of the invention. Apparatus and methods are provided for detecting in real-time, data access in an information or file system and generating an alert to indicate a type of access. File activity is monitored on a network device over discrete, uninterrupted time periods. A determination is made whether a minimum number of files within a group of files were accessed during at least one of the time periods. If enough files were accessed during the time period a determination is made whether they were all accessed by a single action. The pattern of the file access is analyzed and compared to known patterns of access and an alert may be generated to indicate the results of the comparison.

主权项

1. A method for detection of data access in a storage device, the method comprising:
a processor monitoring access to a set of data stored on said storage device; and said processor detecting access, within a time period, to an amount of said data that exceeds a threshold amount of said set of data, wherein at least a portion of said set of data was stored on said storage device prior to said time period.