Network Data Movement Profiling for Unauthorized Transfer Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting unauthorized data movement in networks is challenging due to the labor-intensive and error-prone manual entry of normal data transfer parameters, especially in large networks with diverse computers, and the difficulty in monitoring encrypted data.
Innovation Solution
Automatically creating a normal data movement profile for each computing device based on observed behavior and defining rules with acceptable deviation amounts, allowing for automatic detection and mitigation of unauthorized data transfers by quarantining or alerting administrators when deviations exceed specified thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual entry of normal data transfer parameters is used for each computing device, then detection accuracy can be maintained, but the process becomes labor-intensive and error-prone in large networks
Solution Approach 1:
The system automatically creates data movement profiles by observing and learning normal data transfer behavior from computing devices without requiring manual configuration. The profiler monitors data movements and autonomously establishes baseline profiles, eliminating the need for labor-intensive manual parameter entry while maintaining accurate detection capabilities
Solution Approach 2:
The system performs preliminary learning and observation phases where the profiler collects data on normal computing device behavior before actual security detection begins. This preliminary action establishes accurate baseline profiles in advance, enabling subsequent automated detection without manual intervention
2Measurement precision
If strict detection rules with low deviation thresholds are applied, then unauthorized data movement is detected more accurately, but false positives increase and normal operations are disrupted
Solution Approach 1:
The system uses dynamic deviation thresholds that adapt to the specific data movement patterns learned during the profiling phase. Rather than applying static low thresholds that cause false positives, the thresholds are customized for each computing device based on its observed normal behavior, allowing accurate detection while minimizing operational disruption
Solution Approach 2:
The system applies customized detection parameters and deviation thresholds specific to each computing device's observed behavior patterns. This local customization ensures that detection rules are tailored to individual device characteristics, improving accuracy without causing widespread false positives that would disrupt normal operations
3Measurement precision
If data content is examined to detect unauthorized transfers, then detection accuracy improves, but encrypted data cannot be monitored
Solution Approach 1:
The system extracts and monitors metadata characteristics of data movements such as volume, frequency, timing, and destination patterns without examining the actual data content. This extraction approach enables detection of unauthorized transfers based on behavioral anomalies while maintaining the ability to monitor encrypted data that cannot be decrypted for content analysis
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for providing destination-specific network management are described. One example method includes determining a normal data movement profile for a computing device based on observed normal data transfer behavior by the computing device; identifying a data movement rule associated with the computing device, the data movement rule including a deviation amount, and one or more actions to take when the computing device deviates from the normal data movement profile by more than the deviation amount; detecting a data movement associated with the computing device; determining that the detected data movement exceeds the deviation amount included in the data movement rule relative to the normal data movement profile for the computing device; and performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule.