A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a set of files from the codebase, transferring the data within from the network share to their local development machine. For convenience purposes, the company allows its developers administrator access to their local development machines, and USB port access is unrestricted.
In this environment, a malicious developer could read every file from the network share, and store those files on an external drive locally, which is (obviously) a security risk. If the company wanted to be notified of suspicious data access patterns on the network share, using only tools on the server hosting the share, how would they go about doing this?
Ideally, this system would eventually be extendable to any large set of files hosted on a network share. In one example, the server would recognize that the .h and .cpp files for a particular part of the code are frequently accessed together, and no red flags would be thrown if they're both accessed in a short interval. However, if a large number of unrelated files are accessed in a short period of time, that should throw a red flag.