Patent ID: 8695090

Claim:
A computer-implemented method comprising: monitoring, by a monitoring application of a computing device, file access events associated with a monitored application; detecting the occurrence of a file access event by the monitored application; identifying an iteration number of the file access event over a time interval, a read block size of the file access event, and a read offset of the file access event; classifying the file access event as a file data read pattern when at least one of the iteration number of the file access event over the time interval exceeds a threshold iteration number, the read block size exceeds a threshold block size, or the read offset exceeds a threshold read offset; classifying the file access event as a metadata read pattern when the iteration number of the file access event over the time interval is less than the threshold iteration number, the read block size is less than the threshold block size, and the read offset is less than the threshold read offset, wherein the iteration number is incremented when the read block size is less than the threshold block size and the read offset is less than the threshold read offset; when the file access event is classified as the file data read pattern, performing, by the monitoring application, at least one action to prevent loss of confidential data; and when the file access event is classified as the metadata read pattern, ignoring, by the monitoring application, the file access event at the monitoring application.