Method for identifying potential data exfiltration attacks in at least one software package
AssigneeRobert Bosch GmbH
InventorPaulius Duplys
Life of this patent
Estimating the term…
Abstract
A method for identifying potential data exfiltration attacks in at least one software package. The method includes: tracking at least one change to the software package; and detecting a manipulation suitable for data exfiltration on the changed software package.
Claims14
A method for identifying potential data exfiltration attacks in at least one software package, comprising the following steps:
- tracking at least one change to the software package;
- performing a first inspection method on the changed software package to generate a first probability indicating a likelihood of a manipulation suitable for data exfiltration;
- performing a second inspection method, different from the first inspection method, on the changed software package to generate a second probability indicating a likelihood of the manipulation suitable for data exfiltration;
- detecting the manipulation suitable for data exfiltration based on at least the first probability exceeding a first probability threshold and the second probability exceeding a second probability threshold;
- and
- outputting a manipulation result based on the detecting and according to a predefined policy indicating a threshold number of inspection methods required to output the manipulation result.
A non-transitory computer-readable medium on which is stored a computer program including commands for identifying potential data exfiltration attacks in at least one software package, the commands, when executed by a computer, causing the computer to perform the following steps:
- tracking at least one change to the software package;
- performing a first inspection method on the changed software package to generate a first probability indicating a likelihood of a manipulation suitable for data exfiltration;
- performing a second inspection method, different from the first inspection method, on the changed software package to generate a second probability indicating a likelihood of the manipulation suitable for data exfiltration;
- detecting the manipulation suitable for data exfiltration based on at least the first probability exceeding a first probability threshold and the second probability exceeding a second probability threshold;
- and
- outputting a manipulation result based on the detecting and according to a predefined policy indicating a threshold number of inspection methods required to output the manipulation result.
A device configured for data processing for identifying potential data exfiltration attacks in at least one software package, the device comprising a processor configured to:
- track at least one change to the software package;
- perform a first inspection method on the changed software package to generate a first probability indicating a likelihood of a manipulation suitable for data exfiltration;
- perform a second inspection method, different from the first inspection method, on the changed software package to generate a second probability indicating a likelihood of the manipulation suitable for data exfiltration;
- detect the manipulation suitable for data exfiltration based on at least the first probability exceeding a first probability threshold and the second probability exceeding a second probability threshold;
- and
- output a manipulation result based on the detecting and according to a predefined policy indicating a threshold number of inspection methods required to output the manipulation result.
Dependencies are inferred from the claim text.