Detecting target data in network traffic
MetadataShow full item record
Data exfiltration over a network poses a threat to confidential information. Due to the possibility of malicious insiders, this threat is especially difficult to mitigate. Our goal is to contribute to the development of a method to detect exfiltration of many targeted files without incurring the full cost of reassembling flows. One strategy for accomplishing this would be to implement an approximate matching scheme that attempts to determine whether a file is being transmitted over the network by analyzing the quantity of payload data that matches fragments of the targeted file. Ourwork establishes the basic feasibility of such an approach by matching Transmission Control Protocol (TCP) payloads of traffic containing exfiltrated data against a database of MD5 hashes, each representing a fragment of our target data. We tested against a database of 415 million fragment hashes, where the length of the fragments was chosen to be smaller than the payload size expected for most common Maximum Transmission Units (MTUs), and we simulated exfiltration by sending a sample of our targeted data across the network along with other non-target files representing noise. We demonstrate that under these conditions, we are able to detect the targeted content with a recall of 98.3% and precision of 99.1%.
Approved for public release; distribution is unlimited
Showing items related by title, author, creator and subject.
Demurjian, Steven A.; Hsiao, David K. (Monterey, California. Naval Postgraduate School, 1986-02); NPS52-86-011In the past, the design and implementation of a database system has followed a rather conventional approach. First, a specific data model for the database system is chosen. Second, a corresponding model-based data language ...
The activation and testing of the network CODASYL-DML interface of the M_x001B_p2_x001B_sDBMS using the EWIR database Werre, Timothy J.; Diehl, Barry A. (Monterey, California. Naval Postgraduate School, 1996-06);The Electronic Warfare Integrated Reprogramming Database (EWIRDB) is the primary Department of Defense source for technical parametric performance data on non-communications emitters. A problem of the EWIRDB is that the ...
Castro, Victor G. (Monterey, California: Naval Postgraduate School, 2017-06);The Global Combat Support System-Marine Corps (GCSS-MC) system enables the logistics and supply chain management system for the United States Marine Corps. This system allows leaders, operators, maintainers, and suppliers ...