A method for detecting electronic data theft from computer networks is described, capable of recognizing patterns of remote exfiltration occurring over days to weeks. Normal traffic flow data, in the form of a host’s ingress and egress bytes over time, is used to train an ensemble of one-class learners. The detection ensemble is modular, with individual classifiers trained on different traffic features thought to characterize malicious data transfers. We select features that model the egress to ingress byte balance over time, periodicity, short timescale irregularity, and density of the traffic. The features are most efficiently modeled in the frequency domain, which has the added benefit that variable duration flows are transformed to a fixed-size feature vector, and by sampling the frequency space appropriately, long-duration flows can be tested. When trained on days or weeks worth of traffic from individual hosts, our ensemble achieves a low false-positive rate (<2%) on a range of different system types. Simulated exfiltration samples with a variety of different timing and data characteristics were generated and used to test ensemble performance on different kinds of systems: When trained on a client workstation’s external traffic, the ensemble was generally successful at detecting exfiltration that is not simultaneously ingress-heavy, connection-sparse, and of short duration—a combination that is not optimal for attackers seeking to transfer large amounts of data. Remote exfiltration is more difficult to detect from egress-heavy systems, like web servers, with normal traffic exhibiting timing characteristics similar to a wide range of exfiltration types.

中文翻译：

---

恶意的泛音

描述了一种用于检测从计算机网络中窃取电子数据的方法，该方法能够识别在数天到数周内发生的远程泄露模式。正常的流量数据，以主机的入口和出口字节的形式随时间变化，用于训练一类学习器的集合。检测集成是模块化的，各个分类器针对不同的流量特征进行训练，这些流量特征被认为是恶意数据传输的特征。我们选择了模拟出口到入口字节平衡随时间、周期性、短时间尺度不规则性和流量密度的特征。这些特征在频域中被最有效地建模，其额外的好处是将可变持续时间的流转换为固定大小的特征向量，并且通过适当地对频率空间进行采样，可以测试长持续时间的流。当对来自单个主机的数天或数周的流量进行训练时，我们的集成在一系列不同的系统类型上实现了低误报率 (<2%)。生成了具有各种不同时间和数据特征的模拟渗出样本，并用于测试不同类型系统上的集成性能：当在客户端工作站的外部流量上进行训练时，集成通常成功地检测到不同时存在大量入口的渗出、连接稀疏且持续时间短——对于寻求传输大量数据的攻击者来说，这种组合并不是最佳选择。远程渗透更难从出口密集型系统（如 Web 服务器）中检测到，因为正常流量表现出与各种类型的渗透相似的时序特征。