Temporal‐Based Data Exfiltration Detection Methods
Zahir Tari, Nasrin Sohrabi, Yasaman Samadi, Jakapan Suaboot · 2023
This chapter deals with one of the long discovered sophisticated data exfiltration threats, temporal data exfiltration; yet, not many research works have proposed solution to this problem. This chapter describes TMBoW – Temporary Memory Bag-of Words – to capture time-delay data exfiltration activities. The design of TMBoW is based on Bag-of-Words (BoW) and sparse distributed representation (SDR) to represent textual sensitive documents. TMBoW allows many sensitive documents to be added to the detection model. This is because the SDR and BoW shrink unique words that appear in the sensitive database to only one-bit-per-word frequency. The sensitive data matching process is performed via multiple bit-wise operations. Its design enables parallel programming to be done on a modern system with a multicore processor. As a result, TMBoW can more quickly match sensitive data that appear in the memory with a multicore CPU system.