Data exfiltration detector
AssigneeRapid7, Inc.
InventorsDustin Myers, Vasudha Shivamoggi, Roy Hodgman
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting a data exfiltration event on a network. The method includes receiving traffic data and applying a transformation to transform the traffic data at least closer to a normal distribution. The method further includes selecting at least one outlier identification technique based on a property of the transformed data, and then executing the at least one selected identification technique to determine whether the traffic data is indicative of a data exfiltration event.
Claims19
A method for detecting a data exfiltration event on a network, the method comprising:
- receiving traffic data regarding outgoing traffic from a source associated with the traffic data;
- applying a normalizing transformation to the received traffic data resulting in transformed data;
- selecting at least one outlier identification technique based on a property of the transformed data;
- executing the at least one selected outlier identification technique on the transformed data to determine whether the traffic data regarding the outgoing traffic is indicative of an exfiltration event;
- and
- performing at least one remedial action upon determining the traffic data regarding the outgoing traffic is indicative of an exfiltration event.
A system for detecting a data exfiltration event, the system comprising:
- an interface for receiving traffic data regarding outgoing traffic from a source associated with the traffic data;
- a processor executing instructions stored on a memory to:
- apply a normalizing transformation to the received traffic data resulting in transformed data;
- select at least one outlier identification technique based on a property of the transformed data;
- execute the at least one selected outlier identification technique on the transformed data to determine whether the traffic data regarding the outgoing traffic is indicative of an exfiltration event;
- and
- perform at least one remedial action upon determining the traffic data regarding the outgoing traffic is indicative of an exfiltration event.
A method for detecting a data exfiltration event on a network, the method comprising:
- receiving traffic data regarding outgoing traffic from a source associated with the traffic data;
- performing a logarithmic transformation on the received traffic data resulting in transformed data;
- calculating the interquartile range and the standard deviation of the transformed data;
- selecting at least one outlier identification technique based on the calculated interquartile range and the standard deviation of the transformed data;
- executing the at least one selected outlier identification technique on the transformed data to determine whether the traffic data regarding the outgoing traffic is indicative of an exfiltration event;
- and
- performing at least one remedial action upon determining the traffic data regarding the outgoing traffic is indicative of an exfiltration event.
Dependencies are inferred from the claim text.