Patent ID: 7555482

Claim:
A method for controlling data storage access in an organization having users of a file system, said file system having storage elements, comprising the steps of: recording accesses of said users in said organization to said storage elements of said organization and deriving respective access profiles from said recorded accesses; biclustering said users in said organization and said storage elements of said organization to define corresponding user groups and data groups in a ‘user group-data’ matrix, wherein each matrix cell represents the intersection of a respective user group and data group and indicates for each user which data elements in the data group were accessed by said user and wherein said access profiles of said users in said user groups are mutually similar and define a respective normal access behavior for each of said user groups, and said storage elements in said data groups are accessed by said users having said mutually-similar access profiles; detecting a suspicious access to said storage elements of one of said data groups by one user in said organization in one of said user groups that is inconsistent with said normal access behavior to said one data group by other users in said organization in said one user group; and responsively to said step of detecting a suspicious access, issuing an alert that said one user in said organization has exhibited atypical access behavior.