Abstract: A routing platform coupled to a data network maintains, on local storage of the routing platform, a reflected file system structure corresponding to that of a file system on a network file share. The file system includes a file system object including file system object data, and the reflected file system structure includes a copy of the file system object lacking the file system object data. The routing platform presents, as a proxy, the network file share to a client node communicatively coupled to the routing platform via the data network. The routing platform routes file system protocol traffic between the client node and the network file share, and, if needed, does so by reference to the reflected file system structure.

Abstract: A processor establishes time-based file access limits that are concurrently applicable to file access requests associated with a user ID and detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets communicating file access requests. Applying statistical process control includes comparing a number of file access requests by the user ID observed in an observation interval to file access limits including one based on periodicity of file access requests and/or a second one based on age of accessed files. Based on the comparing, the processor generates an event based on each time-based file access limit that is satisfied, and based on one or more events, detects the abnormal file system access pattern. The processor initiating an action based on detection of the abnormal file system access pattern.

Abstract: Techniques are disclosed to detect, isolate, and/or mitigate an attack on a file system, for example, by malicious software, human actors, and/or compromised Internet-connected devices (bots). A processor of a data processing system detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets. Based on detecting the abnormal file system access pattern, the processor temporarily suspends file system access by at least one user ID contributing to the abnormal file system access pattern. The processor provides a notification identifying one or more file system object accessed in the abnormal file system access pattern.

Abstract: Techniques are disclosed to detect, isolate, and/or mitigate an attack on a file system, for example, by malicious software, human actors, and/or compromised Internet-connected devices (bots). A processor of a data processing system detects an abnormal file system access pattern to a file system by applying statistical process control to network layer packets. Based on detecting the abnormal file system access pattern, the processor temporarily suspends file system access by at least one user ID contributing to the abnormal file system access pattern. The processor provides a notification identifying one or more file system object accessed in the abnormal file system access pattern.