System and method for monitoring network activity for detecting data exfiltration events

Patent metadata

Field	Value
Publication number	US-12101342-B2
Application number	US-202117336593-A
Country	US
Kind code	B2
Filing date	Jun 2, 2021
Priority date	Feb 27, 2019
Publication date	Sep 24, 2024
Grant date	Sep 24, 2024

Abstract

Disclosed herein are methods, systems, and processes for detecting data exfiltration. A data exfiltration event in a network is detected. Traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event is received. A logarithmic transformation is applied to the traffic data to generate transformed data. An outlier identification technique is selected based on the transformed data and is executed on the transformed data to determine that the outgoing traffic is indicative of the data exfiltration event. An alert is generated in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

First claim

What is claimed is:

1. A method comprising:
detecting a data exfiltration event in a network;
receiving traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event;
applying a logarithmic transformation to the traffic data to generate transformed data;
selecting at least one outlier identification technique from among a plurality of outlier identification techniques including a uniform method, a Z-score method, and an inter-quantile range (IQR) method, wherein the selection is made based on a standard deviation or an inter-quartile range of the transformed data, and the uniform method is selected when the transformed data has a standard deviation of zero;
executing the at least one selected outlier identification technique on the transformed data;
applying one or more contextual filters to result of the at least one outlier identification technique, wherein the one or more contextual filters include one or more of:
(a) a minimum size contextual filter that filters outgoing traffic data based on a minimum size threshold the outgoing traffic, and
(b) a magnitude contextual filter that filters outgoing traffic data based on an amount of incoming traffic data to a same source;

determining based on the application of the one or more contextual filters to the result of the at least one outlier identification technique that the outgoing traffic is indicative of the data exfiltration event; and
generating an alert in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

2. The method of claim 1 , further comprising:
detecting a second data exfiltration event in the network;
receiving second traffic data regarding additional outgoing traffic of the source;
applying the logarithmic transformation to the second traffic data to generate second transformed data;
executing a second outlier identification technique on the second transformed data to determine that the additional outgoing traffic is not indicative of the second data exfiltration event; and
responsive to the determination that the additional outgoing traffic is not indicative of the second data exfiltration event, filtering out the second data exfiltration event as a false positive so that the second data filtration event does not cause a second alert to be generated.

3. The method of claim 1 , wherein receiving the traffic data includes selecting a subset of network activity data based on at least one of time, timeframe, and source associated with the network activity data.

4. The method of claim 1 , wherein:
the traffic data indicates one or more amounts of the outgoing traffic generated from the source in one or more time frames; and
the logarithmic transformation is applied to the one or more amounts of the outgoing traffic.

5. The method of claim 1 , wherein:
applying the logarithmic transformation to the traffic data reduces a skew associated with the traffic data, so that the transformed data is more closely approximates a normal distribution than the traffic data.

6. The method of claim 1 , wherein:
the alert is generated via a user interface of a computer, wherein the computer is configured to display network activity of the network via the user interface.

7. The method of claim 6 , further comprising:
performing one or more remedial or mitigation actions on the network according to user input received via the user interface.

8. The method of claim 6 , wherein the alert indicates that an amount of the outgoing traffic generated by the source in a particular time frame is excessively large.

9. The method of claim 6 , wherein the alert indicates that an amount of outgoing traffic generated by the source is anomalous based on a historical behavior of the source.

10. The method of claim 6 , wherein the alert indicates that an amount of outgoing traffic generated by the source is anomalous based on behavior of one or more other computers in the network.

11. A system comprising:
one or more computers that implement a data exfiltration detector, configured to:
detect a data exfiltration event in a network;
receive traffic data regarding outgoing traffic of a source in the network associated with the data exfiltration event;
apply a logarithmic transformation to the traffic data to generate transformed data;
select at least one outlier identification technique from among a plurality of outlier identification techniques including a uniform method, a Z-score method, and an inter-quantile range (IQR) method, wherein the selection is made based on a standard deviation or an inter-quartile range of the transformed data, and the uniform method is selected when the transformed data has a standard deviation of zero;
execute the at least one selected outlier identification technique on the transformed data;
apply one or more contextual filters to result of the at least one outlier identification technique, wherein the one or more contextual filters include one or more of:
(a) a minimum size contextual filter that filters outgoing traffic data based on a minimum size threshold the outgoing traffic, and
(b) a magnitude contextual filter that filters outgoing traffic data based on an amount of incoming traffic data to a same source;

determine based on the application of the one or more contextual filters to the result of the at least one outlier identification technique that the outgoing traffic is indicative of the data exfiltration event; and
generate an alert in response to the determination that the outgoing traffic is indicative of the data exfiltration event.

12. The system of claim 11 , wherein the data exfiltration detector is configured to:
detect a second data exfiltration event in the network;
receive second traffic data regarding additional outgoing traffic of the source;
apply the logarithmic transformation to the second traffic data to generate second transformed data;
execute a second outlier identification technique on the second transformed data to determine that the additional outgoing traffic is not indicative of the second data exfiltration event; and
responsive to the determination that the additional outgoing traffic is not indicative of the second data exfiltration event, filter out the second data exfiltration event as a false positive so that the second data filtration event does not cause a second alert to be generated.

13. The system of claim 11 , wherein the data exfiltration detector is configured to select the IQR method when the transformed data contain one or more network events that are classified as extreme outliers with respect to a baseline behavior.

14. The system of claim 11 , wherein the data exfiltration detector is configured to determine that the outgoing traffic is indicative of the data exfiltration event based on a comparison of the transformed data against a baseline generated based on the at least one selected outlier identification technique.

15. The system of claim 11 , wherein the data exfiltration detector is configured to apply a classifier model to result of the at least one outlier identification technique, wherein the classifier model identifies items of data indicative of data exfiltration events in the network.

16. The system of claim 15 , wherein the classifier model trained using user feedback indicating outgoing traffic that is indicative of actual exfiltration events.

17. One or more non-transitory computer-readable media storing program instructions storing program instructions that when executed on or across one or more processo

Assignees

• Rapid7 Inc

Inventors

• Myers Dustin
• Shivamoggi Vasudha
• Hodgman Roy

Classifications

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L43/067

  using time frame reporting · CPC title

• H04L43/065

  related to network devices · CPC title

• H04L43/062

  related to network traffic · CPC title

• H04L43/16

  Threshold monitoring · CPC title