Method and system for detecting and preventing data exfiltration attacks

A method of detecting and preventing data exfiltration attacks in a network, the method comprising:

• detecting downloads made at one or more endpoint devices comprising a first memory unit coupled to a first processing unit using a Simple Network Management Protocol (SNMP) proxy module within the first memory unit, wherein the SNMP proxy module detects download activity based on management information base (MIB) data;
• mirroring network traffic associated with the downloads;
• identifying access to potential blacklisted websites at the endpoint device using the SNMP proxy module;
• receiving the MIB data streams associated with the downloads from the SNMP proxy and mirrored network traffic streams associated with the downloads by a reception module of a manager device comprising a second memory unit coupled to a second processing unit, wherein the memory unit comprises a plurality of modules;
• providing the mirrored network traffic streams as an input to a malware detection module for detecting presence of malware in the downloads using a deep learning model;
• generating and sending an alert to one or more devices to prevent, recover, or mitigate data exfiltration attacks, by an alert module of the manager device;
• receiving the generated alert by an attack prevention device comprising a third memory unit coupled to a third processing unit, wherein the memory unit comprises a plurality of modules;
• accessing URL contents associated with accessed websites using web scraping tools by a content-aggregation module of the attack prevention device;
• providing the contents of the web scraped URLs by a blacklisting module to the deep learning model, wherein the deep learning model determines if a website is blacklisted or blacklisting the website if it needs to be potentially blacklisted;
• and
• preventing the endpoint devices from accessing the blacklisted websites by the blacklisting module.