Detecting targeted data exfiltration in encrypted traffic

1. A method comprising:

obtaining, by a service that monitors a network, file characteristic data of a particular file among one or more files stored on a first endpoint in the network, wherein the file characteristic data is indicative of one or more of: a file size of the particular file, a file name of the particular file, a file directory on the first endpoint in which the particular file is stored, a user identifier associated with the first endpoint, and a user identifier associated with a second endpoint in communication with the first endpoint;

inferring, by the service, characteristics of encrypted content within encrypted traffic in the network between the first endpoint and the second endpoint, by applying a machine learning-based classifier to traffic data regarding the encrypted traffic;

detecting, by the service, whether the particular file is included within the encrypted traffic, without decrypting the encrypted traffic, by comparing the file characteristic data to the inferred characteristics of the encrypted content; and

in response to detecting the particular file within the encrypted traffic, enforcing, by the service, a network policy in the network.

2. The method as in claim 1 , wherein enforcing the network policy comprises at least one of: blocking the encrypted traffic in the network, slowing the encrypted traffic in the network, or redirecting the encrypted traffic in the network.

3. The method as in claim 1 , wherein enforcing the network policy comprises at least one of: blocking all traffic in the network associated with the first endpoint or blocking all traffic in the network associated with the second endpoint.

4. The method as in claim 1 , wherein inferring the characteristics of the encrypted content within the encrypted traffic in the network by applying the machine learning-based classifier to the traffic data regarding the encrypted traffic comprises:

using the traffic data to classify a particular application record of the encrypted traffic as including a Hypertext Transfer Protocol (HTTP) data object; and

predicting, by the classifier, a plaintext data size from the HTTP data object.

5. The method as in claim 4 , wherein the file characteristic data is indicative of the file size of the particular file, and wherein comparing the file characteristic data to the inferred characteristics of the encrypted content comprises:

comparing the file size of the particular file to the predicted plaintext data size.

6. The method as in claim 1 , wherein the network policy is enforced based in part on the file characteristic data.

7. The method as in claim 1 , wherein obtaining the file characteristic data comprises:

receiving, at the service, the file characteristic data from a monitoring agent executed by the first endpoint.

8. The method as in claim 1 , wherein enforcing the network policy in the network comprises:

determining, by the service and based on the file characteristics data, whether the particular file includes personally identifiable information.

9. The method as in claim 1 , wherein the traffic data regarding the encrypted traffic comprises one or more of: Transport Layer Security (TLS) record lengths, timing information, or Transmission Control Protocol (TCP) flags.

10. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

obtain file characteristic data of a particular file among one or more files stored on a first endpoint in the network, wherein the file characteristic data is indicative of one or more of: a file size of the particular file, a file name of the particular file, a file directory on the first endpoint in which the particular file is stored, a user identifier associated with the first endpoint, and a user identifier associated with a second endpoint in communication with the first endpoint;

infer characteristics of encrypted content within encrypted traffic in the network between the first endpoint and the second endpoint, by applying a machine learning-based classifier to traffic data regarding the encrypted traffic;

detecting whether the particular file is included within the encrypted traffic, without decrypting the encrypted traffic, by comparing the file characteristic data to the inferred characteristics of the encrypted content; and

in response to detecting the particular file within the encrypted traffic, enforce a network policy in the network.

11. The apparatus as in claim 10 , wherein enforcing the network policy comprises at least one of: blocking the encrypted traffic in the network, slowing the encrypted traffic in the network, or redirecting the encrypted traffic in the network.

12. The apparatus as in claim 10 , wherein enforcing the network policy comprises at least one of: blocking all traffic in the network associated with the first endpoint or blocking all traffic in the network associated with the second endpoint.

13. The apparatus as in claim 10 , wherein inferring the characteristics of the encrypted content within the encrypted traffic in the network by applying the machine learning-based classifier to the traffic data regarding the encrypted traffic comprises:

using the traffic data to classify a particular application record of the encrypted traffic as including a Hypertext Transfer Protocol (HTTP) data object; and

predicting, by the classifier, a plaintext data size from the HTTP data object.

14. The apparatus as in claim 13 , wherein the file characteristic data is indicative of the file size of the particular file, and wherein comparing the file characteristic data to the inferred characteristics of the encrypted content comprises:

comparing the file size of the particular file to the predicted plaintext data size.

15. The apparatus as in claim 10 , wherein the network policy is enforced based in part on the file characteristic data.

16. The apparatus as in claim 10 , wherein the apparatus obtains the file characteristic data by:

receive the file characteristic data from a monitoring agent executed by the first endpoint.

17. The apparatus as in claim 10 , wherein the apparatus enforces the network policy in the network by:

determining whether the first endpoint is infected with malware.

18. The apparatus as in claim 10 , wherein the traffic data regarding the encrypted traffic comprises one or more of: Transport Layer Security (TLS) record lengths, timing information, or Transmission Control Protocol (TCP) flags.

19. A tangible, non-transitory, computer-readable medium storing program instructions that cause a service that monitors a network to execute a process comprising:

obtaining, by the service, file characteristic data of a particular file among one or more files stored on a first endpoint in the network, wherein the file characteristic data is indicative of one or more of: a file size of the particular file, a file name of the particular file, a file directory on the first endpoint in which the particular file is stored, a user identifier associated with the first endpoint, and a user identifier associated with a second endpoint in communication with the first endpoint;

inferring, by the service, characteristics of encrypted content within encrypted traffic in the network between the first endpoint and the second endpoint, by applying a machine learning-based classifier to traffic data regarding the encrypted traffic;

detecting, by the service, whether the particular file is included within the encrypted traffic, without decrypting the encrypted traffic, by comparing the file characteristic data to the inferred content characteristics of the encrypted content; and

in response to detecting the particular file within the encrypted traffic, enforcing, by the service, a network policy in the network.