An integrated data exfiltration monitoring tool for a large organization with highly confidential data source

摘要

Data security in a highly confidential large network is of paramount importance. Confidential data networks belonging to secret agencies and government organizations are common targets for data exfiltration. This has become a growing concern in such networks. Present day intrusion detection and prevention systems and firewalls cannot possibly prevent an insider exfiltrating vital data for ulterior purposes. Hence developing an exfiltration detection tool that exclusively detects data exfiltration is of much importance. In this paper, we present an integrated monitoring tool that detects data exfiltration. This tool employs twofold approach in detecting exfiltration 1) Profiling traffic — in/out correlation 2) Estimating FTP Server access.