Detecting and managing abnormal data behavior

1. A method performed by one or more processors, the method comprising: continuously:

identifying one or more normal data movements performed by a particular computing device over a network;

determining a current data movement profile for the particular computing device based on one or more identified data transfers during a particular time period, the current data movement profile including one or more current data movement attributes associated with the particular computing device and defining normal data movement for the particular computing device;

updating data stored that represents the current data movement profile such that the stored data represents the current data movement profile that is regularly updated;

identifying a data movement rule associated with the particular computing device, the data movement rule including a deviation amount representing a difference between an attribute of a detected data movement by the particular computing device outbound to a particular location, wherein the deviation amount specifying a percentage deviation from an amount of data transferred that triggers the data movement rule, and a corresponding current data movement attribute included in the current data movement profile for the particular computing device that indicates a violation of the data movement rule, and the data movement rule including one or more actions to be performed in response to a violation;

detecting a data movement associated with the particular computing device;

determining that the detected data movement represents an abnormal data movement in violation of the current data movement profile data movement rule; and

performing the one or more actions associated with the data movement rule upon determining that the detected data movement represents a violation of the current data movement profile data movement rule.

2. The method of claim 1 , wherein:

the current data movement profile includes an amount of data transferred during the particular time period,

the deviation amount specifies a percentage deviation from the amount of data transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an amount of data associated with the data movement is greater than the amount of data transferred by more than the deviation amount.

3. The method of claim 1 , wherein:

the current data movement profile includes a data transfer type distribution for the particular time period,

the deviation amount specifies a percentage deviation from the data transfer type distribution that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an observed data transfer type distribution associated with the data movement differs from the data transfer type distribution by more than the deviation amount.

4. The method of claim 3 , wherein the data transfer type distribution includes a ratio of Universal Datagram Protocol (UDP) transfers to Transmission Control Protocol (TCP) transfers.

5. The method of claim 1 , wherein:

the current data movement profile includes a number of simultaneous data destinations for the particular time period,

the deviation amount specifies a percentage deviation from the number of simultaneous data destinations transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that the number of simultaneous data destinations for the particular computing device is greater than the number of simultaneous data destinations by more than the deviation amount.

6. The method of claim 1 , wherein:

the current data movement profile includes a data rate for the particular time period,

the deviation amount specifies a percentage deviation from the data rate that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that a data rate for the particular computing device is greater than the data rate by more than the deviation amount.

7. The method of claim 1 , wherein detecting the data movement includes determining an amount of data being moved and determining a destination to which the data is being moved.

8. The method of claim 7 , wherein determining the destination to which the data is being moved includes geo-locating an IP address to which the data is being moved.

9. The method of claim 1 , wherein the data movement occurs from a private network to a public network.

10. The method of claim 1 , wherein the data movement occurs from a first private network to a second private network.

11. The method of claim 1 , wherein the data movement includes at least one of data being transferred from the particular computing device or data being transferred to the particular computing device.

12. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:

continuously:

identifying one or more normal data movements performed by a particular computing device over a network;

determining a current data movement profile for the particular computing device based on one or more identified data transfers during a particular time period, the current data movement profile including one or more current data movement attributes associated with the particular computing device and defining normal data movement for the particular computing device;

updating data stored that represents the current data movement profile such that the stored data represents the current data movement profile that is regularly updated;

identifying a data movement rule associated with the particular computing device, the data movement rule including a deviation amount representing a difference between an attribute of a detected data movement by the particular computing device outbound to a particular location, wherein the deviation amount specifying a percentage deviation from an amount of data transferred that triggers the data movement rule, and a corresponding current data movement attribute included in the current data movement profile for the particular computing device that indicates a violation of the data movement rule, and the data movement rule including one or more actions to be performed in response to a violation;

detecting a data movement associated with the particular computing device;

determining that the detected data movement represents an abnormal data movement in violation of the current data movement profile data movement rule; and

performing the one or more actions associated with the data movement rule upon determining that the detected data movement represents a violation of the current data movement profile data movement rule.

13. The computer-readable medium of claim 12 , wherein:

the current data movement profile includes an amount of data transferred during the particular time period,

the deviation amount specifies a percentage deviation from the amount of data transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an amount of data associated with the data movement is greater than the amount of data transferred by more than the deviation amount.

14. The computer-readable medium of claim 12 , wherein:

the current data movement profile includes a data transfer type distribution for the particular time period,

the deviation amount specifies a percentage deviation from the data transfer type distribution that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an observed data transfer type distribution associated with the data movement differs from the data transfer type distribution by more than the deviation amount.

15. The computer-readable medium of claim 14 , wherein the data transfer type distribution includes a ratio of Universal Datagram Protocol (UDP) transfers to Transmission Control Protocol (TCP) transfers.

16. The computer-readable medium of claim 12 , wherein:

the current data movement profile includes a number of simultaneous data destinations for the particular time period,

the deviation amount specifies a percentage deviation from the number of simultaneous data destinations transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that the number of simultaneous data destinations for the particular computing device is greater than the number of simultaneous data destinations by more than the deviation amount.

17. The computer-readable medium of claim 12 , wherein:

the current data movement profile includes a data rate for the particular time period,

the deviation amount specifies a percentage deviation from the data rate that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that a data rate for the particular computing device is greater than the data rate by more than the deviation amount.

18. The computer-readable medium of claim 12 , wherein detecting the data movement includes determining an amount of data being moved and determining a destination to which the data is being moved.

19. The computer-readable medium of claim 18 , wherein determining the destination to which the data is being moved includes geo-locating an IP address to which the data is being moved.

20. A system comprising:

memory for storing data; and

one or more hardware processors operable to perform operations comprising:

continuously:

identifying one or more normal data movements performed by a particular computing device over a network;

determining a current data movement profile for the particular computing device based on one or more identified data transfers during a particular time period, the current data movement profile including one or more current data movement attributes associated with the particular computing device and defining normal data movement for the particular computing device;

updating data stored that represents the current data movement profile such that the stored data represents the current data movement profile that is regularly updated;

identifying a data movement rule associated with the particular computing device, the data movement rule including a deviation amount representing a difference between an attribute of a detected data movement by the particular computing device outbound to a particular location, wherein the deviation amount specifying a percentage deviation from an amount of data transferred that triggers the data movement rule, and a corresponding current data movement attribute included in the current data movement profile for the particular computing device that indicates a violation of the data movement rule, and the data movement rule including one or more actions to be performed in response to a violation;

detecting a data movement associated with the particular computing device;

determining that the detected data movement represents an abnormal data movement in violation of the current data movement profile data movement rule; and

performing the one or more actions associated with the data movement rule upon determining that the detected data movement represents a violation of the current data movement profile data movement rule.