US 12,438,895 B2
Detecting security threats to data on a storage controller
Mandar Jayant Vaidya, Pune (IN); Nilesh Prabhakar Bhosale, Pune (IN); Joseph W. Dain, Tucson, AZ (US); and Thomas Keith Clark, Tucson, AZ (US)
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Dec. 1, 2021, as Appl. No. 17/457,064.
Prior Publication US 2023/0171273 A1, Jun. 1, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/101 (2013.01); H04L 63/105 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A computer implemented method (CIM) for use with a storage network that includes a storage controller that controls data communications to, in and from the storage network, the CIM comprising:
receiving a request to store a first file in the storage network;
responsive to the receipt of the request, performing deep inspection on data making up the first file to extract a plurality of metadata values;
determining, by machine logic and based at least in part upon the plurality of metadata values that the first file is characterized by at least one of the following security types: sensitive and critical;
based on the determination that the first file is characterized by at least one of the security types, tagging the first file, at a data source of the first file, with one or more tags indicating a classification of the data associated with the first file and a security level, and further indicating a priority level for processing a data access event associated with the first file based on the classification and the security level;
receiving a plurality of audit logs on files in the storage network of at least one of the security types based on the classification and the security level associated with each file, wherein the plurality of audit logs further comprises an audit log associated with the first file;
prioritizing, by applying an artificial intelligence algorithm, the plurality audit logs based on the one or more tags associated with each file and indicating the priority level such that different audit logs are enqueued to different priority queues for processing at different processing rates;
determining, based on the plurality of audit logs, that the data access event associated with the first file represents a potential threat to the storage network; and
based on the determination that the data access event associated with the first file represents a potential threat to the storage network, tagging the first file with additional tags indicating a specific threat detected with respect to accessing the first file and indicating a specific preventive action.