Entropy-Based Data Exfiltration Detection Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus and intrusion detection systems have difficulty detecting new types of polymorphic malicious threats, leading to delayed identification of data breaches, which can cause significant damage and financial loss, as they typically take over 200 days to detect and over two months to contain.
Innovation Solution
A method and system that identifies malicious data exfiltration behaviors by calculating entropy values for network features, building a profile based on benign and malicious behaviors, and flagging activities with high entropy values in live network traffic, regardless of prior recognition, using a network traffic analyzer, memory, and processor.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional anti-virus and intrusion detection systems are used to detect data breaches, then the detection process is simple and straightforward, but the detection time exceeds 200 days and containment takes over two months
Solution Approach 1:
The patent transforms the detection approach by changing the parameter being measured from traditional security signatures to entropy values of network traffic. By calculating entropy for different network traffic parameters and comparing them against baseline entropy values, the system can rapidly identify anomalous data exfiltration attempts without relying on known threat signatures, thus reducing detection time while maintaining effectiveness against polymorphic threats
Solution Approach 2:
The patent replaces the mechanical signature-matching mechanism of traditional IDS with an information-theoretic entropy analysis system. Instead of mechanically comparing traffic against known threat patterns, the system uses entropy calculations to statistically identify deviations from normal traffic behavior, enabling faster detection of zero-day and polymorphic threats that lack known signatures
2Reliability
If traditional intrusion detection systems are used, then the system complexity is low, but the ability to detect polymorphic malicious threats is extremely difficult
Solution Approach 1:
The patent segments the network traffic analysis into multiple entropy calculations for different traffic parameters (packet size, timing, protocol distribution, etc.). Each parameter is analyzed independently to calculate its entropy, and the results are combined to form a comprehensive detection model. This segmentation allows the system to detect polymorphic threats through multiple independent indicators rather than relying on a single complex pattern-matching engine
Solution Approach 2:
The entropy-based detection system serves multiple functions simultaneously: it detects known threats, identifies zero-day attacks, analyzes polymorphic malware, and adapts to new threat patterns without requiring system reconfiguration. The universal entropy metric can be applied to any network traffic type, making the system highly reliable across diverse threat landscapes while maintaining manageable complexity
3Productivity
If entropy-based detection is implemented for all network features, then detection capability improves, but computational complexity and processing requirements increase
Solution Approach 1:
The patent applies entropy calculation selectively to the most informative network traffic parameters rather than all possible features. By identifying and focusing on key parameters that provide the highest detection value (such as packet timing intervals, size distributions, and protocol patterns), the system achieves effective threat detection with reduced computational overhead compared to analyzing every possible traffic feature in exhaustive detail
Data Source
AI summary
A method for identifying data exfiltration attempts on a computer network comprising the following steps: identifying malicious data exfiltration behaviors (DEBs) for known adversary tactics in a knowledge base; identifying benign DEBs; comparing the malicious DEBs with the benign DEBs to identify network features that indicate malicious DEB; calculating, with a network analyzer, an entropy value for each identified network feature; establishing a threshold based on the calculated entropy values; building a complete profile of DEB based on the benign and malicious DEBs; adding every network feature having an entropy value greater than the threshold to a model; comparing the model to live network traffic; and flagging behavior in the live network traffic as a malicious DEB if such behavior includes a network feature that has an entropy value greater than the threshold regardless of whether or not the flagged behavior was previously recognized as a malicious DEB.