Browser File Exfiltration Detection via OS Event Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting file exfiltration, especially through browser-based interfaces, are ineffective due to the obscuring nature of browser activity and the difficulty in distinguishing exfiltration from normal file system events, and existing solutions like browser plugins and person-in-the-middle software face issues with development, reliability, and privacy concerns.
Innovation Solution
A system that monitors file system element events through operating system interfaces, using a kernel filter or minifilter to detect and filter out normal browser behavior, and employs an exfiltration model to identify potentially malicious activities, gathering context information from the browser to determine if a file system element event indicates exfiltration, and sending alerts to administrators when prohibited sites are accessed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional detection methods are used to monitor file access, then external attacks can be detected, but insider exfiltration cannot be detected because insiders have authorized access
Solution Approach 1:
The patent segments the detection approach by separating traditional authentication-based detection from behavior-based detection. It divides file access monitoring into multiple layers: authentication layer (which allows insiders), behavior analysis layer (which monitors access patterns), and anomaly detection layer (which identifies exfiltration). This segmentation enables detection of insider threats without compromising authorized access.
Solution Approach 2:
The patent introduces an intermediary behavior analysis system that sits between the authorized access system and the files. This intermediary monitors and analyzes access patterns, file operations, and user behavior without blocking authorized access. It acts as a mediator that allows legitimate insider activity while detecting malicious exfiltration behaviors.
2Reliability
If browser plugins or person-in-the-middle software are used to detect exfiltration, then detection capability is improved, but development complexity and reliability issues increase
Solution Approach 1:
The patent extracts the detection functionality from complex browser plugins and person-in-the-middle software into a separate, dedicated behavior analysis component. This extracted component communicates with the browser through standardized interfaces, simplifying both the browser implementation and the detection system. The complex detection logic is isolated in a manageable module rather than embedded in the browser or network infrastructure.
Solution Approach 2:
The patent creates a universal detection system that works across different browsers and platforms through standardized interfaces. The behavior analysis component can monitor multiple browsers simultaneously and adapt to different browser architectures without requiring separate implementations for each browser, reducing overall system complexity.
3Reliability
If all file system events are monitored to detect exfiltration, then detection coverage is improved, but false positives increase due to normal browser activity
Solution Approach 1:
The patent implements dynamic monitoring that adapts to normal browser behavior patterns. The system learns and adapts to legitimate file access patterns associated with browser operations, adjusting its sensitivity accordingly. This dynamic approach allows the system to maintain high detection coverage while reducing false positives by distinguishing between normal and abnormal behavior in real-time.
Solution Approach 2:
The patent applies partial monitoring selectively - it monitors all file system events but applies detailed analysis only to suspicious patterns. Rather than analyzing every single file event in depth, the system uses filtering to identify potentially problematic events first, then applies comprehensive analysis only to those cases, reducing computational overhead and false positives while maintaining detection coverage.
4Measurement precision
If detailed context information is gathered from browsers to improve detection accuracy, then exfiltration detection is improved, but privacy concerns and administrative burden increase
Solution Approach 1:
The patent applies local quality by gathering detailed context information only where necessary for detection - specifically around file access events that exhibit suspicious patterns. Rather than continuously collecting all possible browser data, the system focuses information gathering locally on relevant events, minimizing privacy intrusion while maintaining detection accuracy for critical cases.
Data Source
AI summary
Disclosed in some examples are methods, systems, and machine readable mediums for applications that detect indicators of data exfiltration through applications such as browser-based interfaces. The disclosed system monitors file system element events related to one or more target applications (such as browsers) through operating system interfaces. Once an event of interest is detected, the system interfaces with the browser to determine a context for the event of interest that may include a URL of a website that the user was visiting corresponding to the file system element event. If the URL is directed towards a prohibited site, a notification may be generated that may be used as a signal to alert an administrator. As used herein, a file system element may include a file, directory, folder, archive, blob, raw storage, metadata, or the like. File system element events may include copying, deleting, modifying, or moving a file system element. A file system element event may be detected by monitoring Input/Output requests of a computing device to write to a file; move a file; delete a file; or the like.