Method for identifying potential data exfiltration attacks in at least one software package

1 . A method for identifying potential data exfiltration attacks in at least one software package, comprising the following steps:

tracking at least one change to the software package;

performing a first inspection method on the changed software package to generate a first probability indicating a likelihood of a manipulation suitable for data exfiltration;

performing a second inspection method, different from the first inspection method, on the changed software package to generate a second probability indicating a likelihood of the manipulation suitable for data exfiltration;

detecting the manipulation suitable for data exfiltration based on at least the first probability exceeding a first probability threshold and the second probability exceeding a second probability threshold; and

outputting a manipulation result based on the detecting and according to a predefined policy indicating a threshold number of inspection methods required to output the manipulation result.

2 . The method according to claim 1 , wherein the tracking includes at least the following step in order to identify the at least one change in the software package in the form of a source code change:

identifying the at least one change using version management for the software package, using a version history of the version management, wherein for the identifying, the version management is accessed via a network including the Internet.

3 . The method according to claim 1 , wherein the first inspection method and the second inspection method are chosen from of the following inspection methods:

a signature-based inspection, in which the changed software package is searched for at least one code pattern, wherein the at least one code pattern is specific to data exfiltration,

a dynamic inspection, in which different versions of the software package are executed and the executions are compared with one another,

a manifest-based inspection, in which the changed software package is examined using a predefined manifest, wherein the manifest includes a list of permitted functions or permitted outgoing connections of the software package,

an outlier detection, in which a trained model is used for detecting the manipulation,

a model-based inspection, in which the software package is executed and the execution is examined using a predefined model;

wherein a detection result of the detecting indicates the manipulation, by a statement of a probability of the presence of the manipulation or of a suitability for data exfiltration.

4 . The method according to claim 1 , wherein at least one signature-based inspection is carried out as part of the first inspection method or the second inspection method, the signature-based inspection including at least the following steps:

providing at least one code pattern which is specific to data exfiltration and preferably characterizes functions or further software packages that are suitable for initiating an outgoing network connection,

searching a source text of the changed software package for the at least one code pattern,

determining a detection result based on a result of the searching.

5 . The method according to claim 1 , wherein at least one dynamic inspection is carried out as part of the first inspection method or the second inspection method, the dynamic inspection including at least the following steps:

selecting at least two different, successive or random, versions of the changed software package,

executing the different versions in a sandbox environment,

capturing a behavior of the executions of the different versions, wherein the behavior includes generation of outgoing network connections,

comparing the captured behavior of the different versions with one another,

determining a detection result based on the comparing.

6 . The method according to claim 1 , wherein at least one manifest-based inspection is carried out as part of the first inspection method or the second inspection method, the manifest-based inspection including at least the following steps:

providing a predefined manifest that includes a list of permitted functions or permitted outgoing connections of the changed software package, wherein the manifest is machine-readable,

checking the changed software package based on the provided manifest, wherein the checking includes: a static analysis including a comparison of source text with the manifest, or a dynamic analysis including a comparison of a captured behavior of an execution of the changed software package with the manifest,

determining a detection result based on the checking.

7 . The method according to claim 1 , wherein at least one model-based inspection is carried out as part of the first inspection method or the second inspection method, the model-based inspection including at least the following steps:

providing a model for the software package,

executing the changed software package in a sandbox environment,

capturing a behavior of the executed software package, wherein the behavior includes generation of outgoing network connections,

comparing the captured behavior with the provided model,

determining a detection result based on the comparison.

8 . The method according to claim 1 , wherein a prevention is initiated after outputting the manipulation result, the prevention including at least one of the following steps:

recalling an update of the software package for a target system on which the software package is used or is intended for use,

deactivating the target system, and

restricting operation of the target system.

9 . The method according to claim 1 , wherein at least one outlier detection is carried out as part of the first inspection method or the second inspection method, the outlier detection including at least the following steps:

training a model including a classifier and/or artificial neural network, based on different versions of the software package,

using the trained model with the changed software package as input for the trained model,

determining a detection result based on an output of the trained model.

10 . The method according to claim 1 , wherein the manipulation result is output only when a number of inspection methods performed is greater than or equal to the threshold number of inspection methods required to output the manipulation result.

11 . A non-transitory computer-readable medium on which is stored a computer program including commands for identifying potential data exfiltration attacks in at least one software package, the commands, when executed by a computer, causing the computer to perform the following steps:

tracking at least one change to the software package;

performing a first inspection method on the changed software package to generate a first probability indicating a likelihood of a manipulation suitable for data exfiltration;

performing a second inspection method, different from the first inspection method, on the changed software package to generate a second probability indicating a likelihood of the manipulation suitable for data exfiltration;

detecting the manipulation suitable for data exfiltration based on at least the first probability exceeding a first probability threshold and the second probability exceeding a second probability threshold; and

outputting a manipulation result based on the detecting and according to a predefined policy indicating a threshold number of inspection methods required to output the manipulation result.

12 . The non-transitory computer-readable medium according to claim 11 , wherein the manipulation result is output only when a number of inspection methods performed is greater than or equal to the threshold number of inspection methods required to output the manipulation result.

13 . A device configured for data processing for identifying potential data exfiltration attacks in at least one software package, the device comprising a processor configured to:

track at least one change to the software package;

perform a first inspection method on the changed software package to generate a first probability indicating a likelihood of a manipulation suitable for data exfiltration;

perform a second inspection method, different from the first inspection method, on the changed software package to generate a second probability indicating a likelihood of the manipulation suitable for data exfiltration;

detect the manipulation suitable for data exfiltration based on at least the first probability exceeding a first probability threshold and the second probability exceeding a second probability threshold; and

output a manipulation result based on the detecting and according to a predefined policy indicating a threshold number of inspection methods required to output the manipulation result.

14 . The device according to claim 13 , wherein the manipulation result is output only when a number of inspection methods performed is greater than or equal to the threshold number of inspection methods required to output the manipulation result.