Data Exfiltration Threats and Prevention Techniques: Machine Learning and Memory-Based Data Security

Cover
Title Page
Copyright
Contents
About the Authors
Acknowledgments
Acronyms
Abstract
Chapter 1 Introduction
	1.1 Data Exfiltration Methods
		1.1.1 State‐of‐the‐Art Surveys
		1.1.2 Malicious Behavior Detection Methods
		1.1.3 RAM‐Based Data Exfiltration Detection Methods
		1.1.4 Temporal Data Exfiltration Methods
	1.2 Important Questions
	1.3 Book Scope
	1.4 Book Summary
		1.4.1 Data Security Threats
		1.4.2 Use Cases
		1.4.3 Survey
		1.4.4 Sub‐Curve HMM
		1.4.5 Fast Lookup Bag‐of‐Words (FBoW)
		1.4.6 Temporary Memory Bag‐of‐Words (TMBoW)
	1.5 Book Structure
	References
Chapter 2 Background
	2.1 Hidden Markov Model
		2.1.1 Definition
		2.1.2 HMM Applications
		2.1.3 HMM Training Method
		2.1.4 HMM Testing Method
	2.2 Memory Forensics
		2.2.1 Memory Acquisition Strategies
		2.2.2 Memory Analysis Tool
	2.3 Bag‐of‐Words Model
	2.4 Sparse Distributed Representation
	2.5 Summary
	References
Chapter 3 Data Security Threats
	3.1 Data Security
		3.1.1 Confidentiality
		3.1.2 Integrity
		3.1.3 Availability
	3.2 Security vs. Protection vs. Privacy
	3.3 Advanced Persistent Threats Attacks
	3.4 Cybersecurity Threats
		3.4.1 Malware
			3.4.1.1 Ransomware
			3.4.1.2 Fileless Malware
			3.4.1.3 Spyware
			3.4.1.4 Adware
			3.4.1.5 Keyloggers
			3.4.1.6 Trojan Horse
			3.4.1.7 Viruses
			3.4.1.8 Worms
		3.4.2 Emotet (Malspam)
		3.4.3 Denial of Service Attack (DoS)
		3.4.4 Distributed Denial of Service (DDoS) Attack
		3.4.5 Man in the Middle Attack (MITM)
		3.4.6 Social Engineering Attacks and Phishing
			3.4.6.1 Phishing
			3.4.6.2 Baiting
			3.4.6.3 Scareware
			3.4.6.4 Pretexting
		3.4.7 SQL Injection Attack
		3.4.8 Password Attacks
	3.5 Conclusion
	References
Chapter 4 Use Cases Data Leakage Attacks
	4.1 Most Significant Attacks
		4.1.1 Ransomware
		4.1.2 Server Access
		4.1.3 Business Email Compromise (BEC)
	4.2 Top Infection Vectors
	4.3 Top Threats of Recent Years
	4.4 Malware Development Trends
		4.4.1 Malware Focus on Docker
		4.4.2 Ransomware Focus on ESXi
		4.4.3 Nim Is In
		4.4.4 Linux Threats Continue to Evolve
		4.4.5 Threat Actors Target Cloud Environments
		4.4.6 Fileless Malware in the Cloud
	4.5 Geographic Trends
		4.5.1 Asia
		4.5.2 Europe
		4.5.3 North America
		4.5.4 Middle East and Africa
		4.5.5 Latin America
	4.6 Industry Trends
	4.7 Conclusion
	References
Chapter 5 Survey on Building Block Technologies
	5.1 Motivation
	5.2 Background
		5.2.1 SCADA System
			5.2.1.1 SCADA Components
			5.2.1.2 SCADA Architecture
			5.2.1.3 SCADA Protocols
		5.2.2 Different Types of SCADA‐Based IDSs
			5.2.2.1 SCADA Network‐Based IDS
			5.2.2.2 SCADA Application‐Based IDS
			5.2.2.3 Signature‐Based vs. Anomaly‐Based SCADA IDS Methods
		5.2.3 SCADA Threats and Vulnerabilities
			5.2.3.1 Hardware
			5.2.3.2 Software
			5.2.3.3 Security Administration and Insider Attacks
		5.2.4 Requirements of SCADA‐Based IDSs
	5.3 Taxonomy
	5.4 Supervised Learning Methods
		5.4.1 Overview of Supervised Learning‐Based IDSs
		5.4.2 Taxonomy of Supervised Learning Methods
			5.4.2.1 Probabilistic Method
			5.4.2.2 Divide and Conquer Method
			5.4.2.3 Rule‐Based Method
			5.4.2.4 Lazy Learning Method
			5.4.2.5 Boundary Method
			5.4.2.6 Evolutionary Method
			5.4.2.7 Unary Classification
			5.4.2.8 Density‐Based Method
			5.4.2.9 Ensemble‐Based Method
	5.5 Systematic Literature Review
	5.6 Evaluation of Supervised Learning Methods
		5.6.1 Paper Selection Process
		5.6.2 Evaluation Criteria
		5.6.3 Categories of SCADA‐Based IDS Systems
			5.6.3.1 Rule‐Based Method
			5.6.3.2 Ensemble‐Based Method
			5.6.3.3 Unary Classifier
			5.6.3.4 Probabilistic Method
			5.6.3.5 Other Methods
		5.6.4 Approaches Used to Detect Anomalies
		5.6.5 Architectural Design Properties
		5.6.6 Data Sources Used for Anomaly Detection
		5.6.7 The Feasibility of the Proposed Work
	5.7 Key Open Problems
		5.7.1 Testbeds and Test Datasets Need Further Research and Development
		5.7.2 Resilience and Validation of the Security Design Have Not Yet Been Sufficiently Explored
		5.7.3 Prevention and Investigation Are Not Yet Well Studied
		5.7.4 Distributed IDS Collaboration for SCADA Systems Is Still in an Early Age of Development
	5.8 Summary
	References
Chapter 6 Behavior‐Based Data Exfiltration Detection Methods
	6.1 Motivation
	6.2 Existing Methods
		6.2.1 Static Methods
		6.2.2 Dynamic Methods
	6.3 Sub‐Curve HMM Method
		6.3.1 API Feature Extraction
		6.3.2 HMM Training
		6.3.3 Sub‐Curve Extraction
		6.3.4 Malware Detection
			6.3.4.1 Training Detection Classifier
			6.3.4.2 Detect Malware
	6.4 Evaluation
		6.4.1 Datasets
		6.4.2 Experimental Settings
		6.4.3 Malware Classification Methods
		6.4.4 Metrics
	6.5 Experimental Results
		6.5.1 Results for SC‐HMM Method
		6.5.2 Results for ABC‐HMM Method
		6.5.3 Results for SABC‐HMM Method
		6.5.4 Comparison with Other Antivirus Scanners
	6.6 Discussion
		6.6.1 Limitations
		6.6.2 Performance Overheads
	6.7 Summary
	References
Chapter 7 Memory‐Based Data Exfiltration Detection Methods
	7.1 Motivation
	7.2 Existing Methods
		7.2.1 Physical Memory Acquisition Tool
		7.2.2 Pattern‐Matching Method
			7.2.2.1 Single‐Pattern‐Matching Method
			7.2.2.2 Multiple Patterns Matching Method
	7.3 Concepts
		7.3.1 Notation
		7.3.2 Memory Data
		7.3.3 Sensitive Documents
		7.3.4 Sensitive Data Matching
	7.4 Fast Lookup Bag‐of‐Words (FBoW)
		7.4.1 Detection Model Generation
			7.4.1.1 Extract Bag‐of‐Words from Nonsensitive Dataset
			7.4.1.2 Extract Bag‐of‐Words from Sensitive Dataset
			7.4.1.3 Generate Detection Model – Dictionary
			7.4.1.4 Generate Detection Model – Automaton
		7.4.2 Memory Data Extraction
			7.4.2.1 Prerequisite
			7.4.2.2 BoW Sequence Extraction
		7.4.3 Sensitive Data Detection
	7.5 Evaluation
		7.5.1 Experimental Settings
		7.5.2 Benchmarked Methods
		7.5.3 Datasets
		7.5.4 Implementation
		7.5.5 Experimental Results
			7.5.5.1 Runtime
			7.5.5.2 Memory Footprint
			7.5.5.3 Accuracy
		7.5.6 Sensitivity Analysis of FBoW
			7.5.6.1 Features Comparison
	7.6 Summary
	References
Chapter 8 Temporal‐Based Data Exfiltration Detection Methods
	8.1 Motivation
	8.2 Existing Methods
		8.2.1 Fingerprinting
		8.2.2 Token or Tagging
		8.2.3 Machine Learning (ML)
	8.3 Definitions
		8.3.1 Sensitive Data
		8.3.2 Memory Content
		8.3.3 Noise from Multi‐time‐Step Memory Data Extraction
		8.3.4 Temporal Data Exfiltration Model
	8.4 Temporary Memory Bag‐of‐Words (TMBoW)
		8.4.1 System State Diagram
		8.4.2 Preparation of Sensitive Database
		8.4.3 Sensitive Data Leakage Discovery
	8.5 Experimental Results
		8.5.1 Experimental Setup
		8.5.2 Implementation
		8.5.3 Attack Scenario
		8.5.4 Results
			8.5.4.1 Detection Results
			8.5.4.2 Scalability
			8.5.4.3 Robustness
	8.6 Summary
	References
Chapter 9 Conclusion
	9.1 Summary
	9.2 What Is Innovative in the Described Methods?
	9.3 What Is Next?
		9.3.1 Behavior‐Based Method
		9.3.2 Memory‐Based Method
		9.3.3 Temporal Pattern‐Based Method
Index
EULA