Server Outgoing Data Monitoring for Covert Exfiltration Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data loss prevention (DLP) tools have high false positive rates, require significant expertise and maintenance, and are ineffective against new attacker practices, particularly in detecting covert data exfiltration.
Innovation Solution
A method and device that analyze outgoing data from a server, filter out previously sent data, determine the amount of 'pure' information, and perform an action if it exceeds a threshold, using algorithms like LZ-like compression to assess information density and potentially alter or block data to prevent breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional DLP tools use rule-based policies to detect data breaches, then detection capability is improved, but false positive rate increases and implementation complexity increases
Solution Approach 1:
The patent replaces rule-based mechanical detection systems with an information-theoretic approach using entropy calculation and compression algorithms. Instead of relying on complex predefined rules and patterns, the system uses mathematical principles (Shannon entropy) to objectively measure information density in outgoing data, automatically identifying breaches without manual rule configuration.
Solution Approach 2:
The patent transforms the detection parameter from qualitative rule-matching to quantitative information density measurement. By calculating entropy and using compression ratios as objective metrics, the system changes the fundamental parameter being monitored from pattern compliance to information content, enabling automated threshold-based detection that reduces false positives.
2Measurement precision
If DLP tools use preconfigured rules to identify unauthorized data transitions, then detection accuracy is improved, but maintenance effort and cost increase
Solution Approach 1:
The patent implements a self-adjusting system where the information density threshold is automatically determined based on the specific server and data characteristics. The system performs initial analysis to establish baseline entropy values and compression ratios, then autonomously configures detection thresholds without requiring external expert intervention or ongoing manual tuning of rules.
Solution Approach 2:
The system dynamically adapts detection parameters based on the actual data being monitored. By calculating information density metrics specific to each server's outgoing traffic patterns, the threshold automatically adjusts to maintain high detection accuracy while requiring minimal manual maintenance of predefined rules.
3Measurement precision
If DLP tools monitor all outgoing data in detail, then detection capability is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts only the essential characteristic needed for breach detection - information density - from the complete outgoing data stream. By applying compression algorithms and entropy calculation to summarize data content rather than analyzing every byte individually, the system maintains high detection capability while dramatically reducing processing requirements.
Solution Approach 2:
The system applies information density measurement selectively to outgoing data that requires inspection, using compression and entropy calculation only where needed rather than performing exhaustive analysis on all data. This partial action approach maintains detection effectiveness while optimizing processing efficiency.
Data Source
AI summary
A computer implemented method of monitoring data output by a server over a network is provided, in which the server is arranged to store data. The method includes analysing, by a computing device, outgoing data from the server sent over the network; filtering, by the computing device, a portion of the outgoing data to determine a remaining portion of the outgoing data; analysing, by the computing device, the remaining portion of the outgoing data to determine the amount of information in the remaining portion of the outgoing data; and performing, by the computing device, a predetermined action if the amount of information in the remaining portion of the outgoing data is over a threshold.