Data Exfiltration Threats and Prevention Techniques: Machine Learning and Memory-Based Data Security

Description

DATA EXFILTRATION THREATS AND PREVENTION TECHNIQUES Comprehensive resource covering threat prevention techniques for data exfiltration and applying machine learning applications to aid in identification and prevention Data Exfiltration Threats and Prevention Techniques provides readers the knowledge needed to prevent and protect from malware attacks by introducing existing and recently developed methods in malware protection using AI, memory forensic, and pattern matching, presenting various data exfiltration attack vectors and advanced memory-based data leakage detection, and discussing ways in which machine learning methods have a positive impact on malware detection. Providing detailed descriptions of the recent advances in data exfiltration detection methods and technologies, the authors also discuss details of data breach countermeasures and attack scenarios to show how the reader may identify a potential cyber attack in the real world. Composed of eight chapters, this book presents a better understanding of the core issues related to the cyber-attacks as well as the recent methods that have been developed in the field. In Data Exfiltration Threats and Prevention Techniques, readers can expect to find detailed information on: Sensitive data classification, covering text pre-processing, supervised text classification, automated text clustering, and other sensitive text detection approachesSupervised machine learning technologies for intrusion detection systems, covering taxonomy and benchmarking of supervised machine learning techniquesBehavior-based malware detection using API-call sequences, covering API-call extraction techniques and detecting data stealing behavior based on API-call sequencesMemory-based sensitive data monitoring for real-time data exfiltration detection and advanced time delay data exfiltration attack and detection Aimed at professionals and students alike, Data Exfiltration Threats and Prevention Techniques highlights a range of machine learning methods that can be used to detect potential data theft and identifies research gaps and the potential to make change in the future as technology continues to grow. Cover Title Page Copyright Contents About the Authors Acknowledgments Acronyms Abstract Chapter 1 Introduction 1.1 Data Exfiltration Methods 1.1.1 State‐of‐the‐Art Surveys 1.1.2 Malicious Behavior Detection Methods 1.1.3 RAM‐Based Data Exfiltration Detection Methods 1.1.4 Temporal Data Exfiltration Methods 1.2 Important Questions 1.3 Book Scope 1.4 Book Summary 1.4.1 Data Security Threats 1.4.2 Use Cases 1.4.3 Survey 1.4.4 Sub‐Curve HMM 1.4.5 Fast Lookup Bag‐of‐Words (FBoW) 1.4.6 Temporary Memory Bag‐of‐Words (TMBoW) 1.5 Book Structure References Chapter 2 Background 2.1 Hidden Markov Model 2.1.1 Definition 2.1.2 HMM Applications 2.1.3 HMM Training Method 2.1.4 HMM Testing Method 2.2 Memory Forensics 2.2.1 Memory Acquisition Strategies 2.2.2 Memory Analysis Tool 2.3 Bag‐of‐Words Model 2.4 Sparse Distributed Representation 2.5 Summary References Chapter 3 Data Security Threats 3.1 Data Security 3.1.1 Confidentiality 3.1.2 Integrity 3.1.3 Availability 3.2 Security vs. Protection vs. Privacy 3.3 Advanced Persistent Threats Attacks 3.4 Cybersecurity Threats 3.4.1 Malware 3.4.1.1 Ransomware 3.4.1.2 Fileless Malware 3.4.1.3 Spyware 3.4.1.4 Adware 3.4.1.5 Keyloggers 3.4.1.6 Trojan Horse 3.4.1.7 Viruses 3.4.1.8 Worms 3.4.2 Emotet (Malspam) 3.4.3 Denial of Service Attack (DoS) 3.4.4 Distributed Denial of Service (DDoS) Attack 3.4.5 Man in the Middle Attack (MITM) 3.4.6 Social Engineering Attacks and Phishing 3.4.6.1 Phishing 3.4.6.2 Baiting 3.4.6.3 Scareware 3.4.6.4 Pretexting 3.4.7 SQL Injection Attack 3.4.8 Password Attacks 3.5 Conclusion References Chapter 4 Use Cases Data Leakage Attacks 4.1 Most Significant Attacks 4.1.1 Ransomware 4.1.2 Server Access 4.1.3 Business Email Compromise (BEC) 4.2 Top Infection Vectors 4.3 Top Threats of Recent Years 4.4 Malware Development Trends 4.4.1 Malware Focus on Docker 4.4.2 Ransomware Focus on ESXi 4.4.3 Nim Is In 4.4.4 Linux Threats Continue to Evolve 4.4.5 Threat Actors Target Cloud Environments 4.4.6 Fileless Malware in the Cloud 4.5 Geographic Trends 4.5.1 Asia 4.5.2 Europe 4.5.3 North America 4.5.4 Middle East and Africa 4.5.5 Latin America 4.6 Industry Trends 4.7 Conclusion References Chapter 5 Survey on Building Block Technologies 5.1 Motivation 5.2 Background 5.2.1 SCADA System 5.2.1.1 SCADA Components 5.2.1.2 SCADA Architecture 5.2.1.3 SCADA Protocols 5.2.2 Different Types of SCADA‐Based IDSs 5.2.2.1 SCADA Network‐Based IDS 5.2.2.2 SCADA Application‐Based IDS 5.2.2.3 Signature‐Based vs. Anomaly‐Based SCADA IDS Methods 5.2.3 SCADA Threats and Vulnerabilities 5.2.3.1 Hardware 5.2.3.2 Software 5.2.3.3 Security Administration and Insider Attacks 5.2.4 Requirements of SCADA‐Based IDSs 5.3 Taxonomy 5.4 Supervised Learning Methods 5.4.1 Overview of Supervised Learning‐Based IDSs 5.4.2 Taxonomy of Supervised Learning Methods 5.4.2.1 Probabilistic Method 5.4.2.2 Divide and Conquer Method 5.4.2.3 Rule‐Based Method 5.4.2.4 Lazy Learning Method 5.4.2.5 Boundary Method 5.4.2.6 Evolutionary Method 5.4.2.7 Unary Classification 5.4.2.8 Density‐Based Method 5.4.2.9 Ensemble‐Based Method 5.5 Systematic Literature Review 5.6 Evaluation of Supervised Learning Methods 5.6.1 Paper Selection Process 5.6.2 Evaluation Criteria 5.6.3 Categories of SCADA‐Based IDS Systems 5.6.3.1 Rule‐Based Method 5.6.3.2 Ensemble‐Based Method 5.6.3.3 Unary Classifier 5.6.3.4 Probabilistic Method 5.6.3.5 Other Methods 5.6.4 Approaches Used to Detect Anomalies 5.6.5 Architectural Design Properties 5.6.6 Data Sources Used for Anomaly Detection 5.6.7 The Feasibility of the Proposed Work 5.7 Key Open Problems 5.7.1 Testbeds and Test Datasets Need Further Research and Development 5.7.2 Resilience and Validation of the Security Design Have Not Yet Been Sufficiently Explored 5.7.3 Prevention and Investigation Are Not Yet Well Studied 5.7.4 Distributed IDS Collaboration for SCADA Systems Is Still in an Early Age of Development 5.8 Summary References Chapter 6 Behavior‐Based Data Exfiltration Detection Methods 6.1 Motivation 6.2 Existing Methods 6.2.1 Static Methods 6.2.2 Dynamic Methods 6.3 Sub‐Curve HMM Method 6.3.1 API Feature Extraction 6.3.2 HMM Training 6.3.3 Sub‐Curve Extraction 6.3.4 Malware Detection 6.3.4.1 Training Detection Classifier 6.3.4.2 Detect Malware 6.4 Evaluation 6.4.1 Datasets 6.4.2 Experimental Settings 6.4.3 Malware Classification Methods 6.4.4 Metrics 6.5 Experimental Results 6.5.1 Results for SC‐HMM Method 6.5.2 Results for ABC‐HMM Method 6.5.3 Results for SABC‐HMM Method 6.5.4 Comparison with Other Antivirus Scanners 6.6 Discussion 6.6.1 Limitations 6.6.2 Performance Overheads 6.7 Summary References Chapter 7 Memory‐Based Data Exfiltration Detection Methods 7.1 Motivation 7.2 Existing Methods 7.2.1 Physical Memory Acquisition Tool 7.2.2 Pattern‐Matching Method 7.2.2.1 Single‐Pattern‐Matching Method 7.2.2.2 Multiple Patterns Matching Method 7.3 Concepts 7.3.1 Notation 7.3.2 Memory Data 7.3.3 Sensitive Documents 7.3.4 Sensitive Data Matching 7.4 Fast Lookup Bag‐of‐Words (FBoW) 7.4.1 Detection Model Generation 7.4.1.1 Extract Bag‐of‐Words from Nonsensitive Dataset 7.4.1.2 Extract Bag‐of‐Words from Sensitive Dataset 7.4.1.3 Generate Detection Model – Dictionary 7.4.1.4 Generate Detection Model – Automaton 7.4.2 Memory Data Extraction 7.4.2.1 Prerequisite 7.4.2.2 BoW Sequence Extraction 7.4.3 Sensitive Data Detection 7.5 Evaluation 7.5.1 Experimental Settings 7.5.2 Benchmarked Methods 7.5.3 Datasets 7.5.4 Implementation 7.5.5 Experimental Results 7.5.5.1 Runtime 7.5.5.2 Memory Footprint 7.5.5.3 Accuracy 7.5.6 Sensitivity Analysis of FBoW 7.5.6.1 Features Comparison 7.6 Summary References Chapter 8 Temporal‐Based Data Exfiltration Detection Methods 8.1 Motivation 8.2 Existing Methods 8.2.1 Fingerprinting 8.2.2 Token or Tagging 8.2.3 Machine Learning (ML) 8.3 Definitions 8.3.1 Sensitive Data 8.3.2 Memory Content 8.3.3 Noise from Multi‐time‐Step Memory Data Extraction 8.3.4 Temporal Data Exfiltration Model 8.4 Temporary Memory Bag‐of‐Words (TMBoW) 8.4.1 System State Diagram 8.4.2 Preparation of Sensitive Database 8.4.3 Sensitive Data Leakage Discovery 8.5 Experimental Results 8.5.1 Experimental Setup 8.5.2 Implementation 8.5.3 Attack Scenario 8.5.4 Results 8.5.4.1 Detection Results 8.5.4.2 Scalability 8.5.4.3 Robustness 8.6 Summary References Chapter 9 Conclusion 9.1 Summary 9.2 What Is Innovative in the Described Methods? 9.3 What Is Next? 9.3.1 Behavior‐Based Method 9.3.2 Memory‐Based Method 9.3.3 Temporal Pattern‐Based Method Index EULA