Inflated Files for Network Exfiltration Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection tools in network security suffer from high false-positive alert rates, making it difficult for administrators to detect data exfiltration attempts effectively, as malicious actors can evade detection by encrypting data, randomizing malware, or spreading exfiltration over time and multiple targets.
Innovation Solution
The system employs an iteratively updated network traffic model to create 'inflated files' with arbitrary or random data, making exfiltration attempts more conspicuous by triggering anomaly detection alerts, while minimizing false positives through continuous monitoring and proactive file modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection tools are used to detect data exfiltration attempts, then detection capability is improved, but false-positive alert rates increase
Solution Approach 1:
The system proactively creates inflated files with sensitive data indicators before any exfiltration attempt occurs. These pre-prepared files are strategically placed in the network environment to serve as traps. When malicious actors attempt to exfiltrate what they believe is sensitive data, they actually download these inflated files, triggering anomaly detection alerts with high confidence that genuine exfiltration is occurring, thereby reducing false positives.
Solution Approach 2:
The inflated files act as an intermediary between the actual sensitive data and the anomaly detection system. Instead of directly monitoring for exfiltration of real sensitive data (which is difficult to detect), the system uses these decoy files as mediators that clearly mark exfiltration attempts when downloaded, providing a reliable signal to the detection system.
2Measurement precision
If exfiltration detection methods watch for sensitive terms or known sensitive data, then detection accuracy is improved, but malicious actors can circumvent detection by encrypting data
Solution Approach 1:
The system creates copies of sensitive data files and inflates them with arbitrary data to create decoy files. These copies contain the same sensitive data indicators (such as file headers, metadata, or content signatures) that would be present in real sensitive files, but they are substantially larger due to the added inflation data. This allows the detection system to monitor for these indicators without needing to decrypt or analyze the actual sensitive data content.
3Reliability
If exfiltration detection methods aggressively monitor transfer channels, then detection capability is improved, but malicious actors can circumvent by moving to other channels
Solution Approach 1:
The system proactively places inflated files across multiple network locations and channels before exfiltration attempts occur. By having these decoy files预先 distributed throughout the network infrastructure, the system ensures that regardless of which channel or protocol malicious actors use for exfiltration, they are likely to encounter and download an inflated file, triggering detection.
4Device complexity
If anomaly detection looks for traffic spikes at certain times or specific hosts, then detection simplicity is improved, but malicious actors can circumvent by spreading exfiltration over extended periods and multiple targets
Solution Approach 1:
The system divides the network into multiple segments and places inflated files at various locations across different hosts, departments, and network zones. This segmentation approach transforms the detection problem from monitoring entire network traffic patterns to monitoring individual file downloads at specific locations, simplifying the detection mechanism while maintaining comprehensive coverage against distributed exfiltration attempts.
Data Source
AI summary
Techniques for providing network security and anomaly detection are disclosed. In some embodiments, network traffic may be monitored in order to create a model of network traffic over a first period of time. Based on the model of network traffic, one or more inflated files may be created and stored on a system, wherein the inflated files are of a sufficient file size such that attempts to exfiltrate one or more of the files may be detected based by network monitoring tools. The inflated files may further include one or more indicators of sensitivity, including indicators of the presence of sensitive information that is not actually included in the inflated files. Network traffic characteristics may then be repeatedly or continuously monitored in order to update the size of the one or more inflated files based on changes in network traffic characteristics.