Anomalous data transfer detection

A method comprising:

• implementing, using one or more hardware processors, anomalous data transfer detection, wherein the implementing comprises:
• determining hotspots for a particular asset of an organization, wherein the hotspots correspond to one or more periods of time in which outbound data from the particular asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity, wherein
• determining the hotspot threshold associated with the particular asset, comprises:
• aggregating outgoing source bytes from the particular asset at different hours of different days to calculate outgoing source byte totals for individual hours of individual days;
• calculating logarithmic values associated with the individual outgoing source byte totals;
• sorting the individual hours of the individual days into a table of rows, in descending order according to the calculated logarithmic values,
• computing, for each individual row in the table, median values based on the calculated logarithmic values for a particular individual row and each higher row in the table;
• calculating, for each individual row in the table, derivative values based on a difference between the computed median value associated with the particular individual row and the computed median value associated with a next higher row in the table;
• identifying all local maxima in the derivative values;
• filtering the local maxima that exceed a derivative value threshold;
• and
• identifying the hotspot threshold associated with the particular asset as a particular local maximum having the largest calculated logarithmic value;
• filtering out, from the outbound data, a subset of data that does not correspond to the hotspots, wherein the remaining data after filtering out the subset of data corresponds to a hotspot dataset associated with the hotspots;
• utilizing the hotspot dataset to detect anomalous data transfer activity associated with the particular asset, wherein detecting the anomalous data transfer activity includes computing one or more statistics on the hotspot dataset;
• and
• responsive to detecting the anomalous data transfer activity, generating an alert associated with the particular asset.

One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a system that implements anomalous data transfer detection and cause the system to:

• determine hotspots for a particular asset of an organization, wherein the hotspots correspond to one or more periods of time in which outbound data from the particular asset satisfies a hotspot threshold determined to be indicative of high outbound data traffic activity, wherein
• determining the hotspot threshold associated with the particular asset, comprises:
• aggregating outgoing source bytes from the particular asset at different hours of different days to calculate outgoing source byte totals for individual hours of individual days;
• calculating logarithmic values associated with the individual outgoing source byte totals;
• sorting the individual hours of the individual days into a table of rows, in descending order according to the calculated logarithmic values,
• computing, for each individual row in the table, median values based on the calculated logarithmic values for a particular individual row and each higher row in the table;
• calculating, for each individual row in the table, derivative values based on a difference between the computed median value associated with the particular individual row and the computed median value associated with a next higher row in the table;
• identifying all local maxima in the derivative values;
• filtering the local maxima that exceed a derivative value threshold;
• and
• identifying the hotspot threshold associated with the particular asset as a particular local maximum having the largest calculated logarithmic value;
• filter out, from the outbound data, a subset of data that does not correspond to the hotspots, wherein the remaining data after filtering out the subset of data corresponds to a hotspot dataset associated with the hotspots;
• utilize the hotspot dataset to detect anomalous data transfer activity associated with the particular asset, wherein, to detect the anomalous data transfer activity, the one or more processors are configured to compute one or more statistics on the hotspot dataset;
• and
• responsive to detecting the anomalous data transfer activity, generate an alert associated with the particular asset.