Behavior model for detecting data exfiltration in network environment

Abstract

There is a growing concern across the globe about exfiltration of sensitive data over network. This coupled with the increase in other insider threats pose greater challenge. Present day perimeter security solutions such as Intrusion detection & prevention system, firewall are not capable of detecting data-exfiltration. Also existing behavior models that can detect intrusions and worms do not incorporate mechanims to detect data-exfiltration. Devising an exclusive behavior based model is essential to detect data-exfiltration over network by utilizing parameters from both system and network.In this paper, we present a behavior approach based on Kernel Density Estimation (KDE) and co-relation co-efficient methods to detect data-exfiltration. Firstly, during the learning phase, we profile each host in a network and compute KDE values individually for system and network parameters. Secondly, during the detection phase we compute KDEs for the identified parameters and then correlate current KDE values with the learnt KDE values using Carl Pearsons correlation coefficient method to detect data-exfiltration over the network. We present our approach, analysis and the findings based on our model. Results obtained reveal that our approach detect data-exfiltration incidents over the network.Index Terms-Insider attack, data-exfiltration, network anomaly detection and host anomaly detection

Data exfiltration: A review of external attack vectors and countermeasures

“…Some of the data exfiltration detection approaches take into account both the network logs and the host logs to identify abnormal behaviour. For example, Ramachandran et al [156] develop a data exfiltration countermeasure system which relies on building a behaviour model of network traffic. They train their model on correlations between activity on a host (abnormal CPU and memory utilisation) and activity in the network, the grounding principle being that unusually-sized data transmissions are suspicious exfiltration behaviour when not correlated with the other indicators of hosts engaged in productive activity.…”

“…Flood & Keane [155] In use A framework that helps in detection of data exfiltration in multi-cloud system VM level attacks Network + Host-based Anomaly Ramachandran et al [156] In use/in transit Correlates the CPU activity with network activity and any large size data transfer which doesn't correlate with host CPU is considered exfiltration of data SQL Injection attack, XSS attack, Malware attacks, Phishing attack Myers et al [157] In use/in transit A combination of network and host-based analysis to detect exfiltration…”

A Review of Insider Threat Detection: Classification, Machine Learning Techniques, Datasets, Open Challenges, and Recommendations

“…For insider threat detection, Crawford and Peterson [140], Meng et al [141], and Chiu et al [142] used a methodology that is dependent on scanning the memory of running virtual machines, a Bayesian inference-based trust mechanism, and a frequent pattern outlier factor, respectively. The works [143][144][145][146][147] highlighted correlation coefficient methods and kernel density estimation (KDE) to determine CPU usage, a medium access layer MAC based solution, design science research to detect USB usage, a fuzzy multi-criteria aggregation method, and the hidden Markov model (HMM) and Baum-Welch algorithm to model resource misuse, respectively. Jaenisch and Handley [148] analyzed email and text features using the random forest algorithm, which identifies the various behaviors of suspicious users or their abnormal derivatives.…”

Detecting data exfiltration by integrating information across layers

“…Ramachandran et al [23] claim that their behaviorbased model can catch most network data exfiltration scenarios. They first learn the normal behavior of a system by using kernel density estimation methods on system features like memory consumption, CPU utilization and disk usage.…”