Method and protection apparatus to prevent malicious information communication in ip networks by exploiting benign networking protocols

A system for preventing malicious data exfiltration from a secure network, comprising:

• a device associated with a first network zone comprising a processor and a network interface;
• wherein the network interface is configured to receive a first internet protocol (IP) packet and receive a second IP packet;
• wherein the processor is configured to:
• determine that a first protocol above a network layer and a first size of the first IP packet matches a predetermined policy of a plurality of predetermined policies;
• inspect a first payload of the first IP packet based on the predetermined policy to identify a first source, a first destination, and a first format of the first IP packet,
• determine that one of the first source, the first destination, or the first format is improper based on the predetermined policy,
• flag the first IP packet as suspect based on the determination,
• determine that a second protocol above the network layer and a second size of the second IP packet matches the predetermined policy,
• inspect a second payload of the second IP packet based on the predetermined policy to identify a second source, a second destination, and a second format of the second IP packet, and
• determine that each of the second source, the second destination, and the second format is proper based on the predetermined policy;
• and
• wherein the network interface is further configured to transmit the second IP packet based on the determination.