An integrated network behavior and policy based data exfiltration detection framework

Abstract

There is a growing concern of exfiltration of sensitive data over the network, with the attackers employing variety of new techniques over wired, wireless networks, distributed platforms and handheld devices. This poses greater challenge for researchers to devise effective detection and mitigation techniques to thwart these attacks. This paper presents an integrated behavior and policy based data-exfiltration detection framework for detecting data exfiltration in the network environment. Firstly, we extend the existing taxonomy for data-exfiltration by including distributed platforms and handheld devices. Secondly we propose an integrated behavior and policy based data-exfiltration detection framework for detecting data exfiltration in the network environment using multiple inputs pertaining to hosts, network and known vulnerabilities. Finally, we present our analysis results that brings out the efficiency of our framework.