Detecting data exfiltration and compromised user accounts in a computing network
Aspects of the disclosure relate to monitoring a computing network to determine data exfiltration. A computing platform may use time-series modeling to determine anomalous network activity with respect to outgoing data. Additional aspects of this disclosure relate to analysis of web activities associated with a user to determine compromised user accounts/devices. The computing platform may use domain categorization to determine if web activity associated with a user is anomalous.
1. A system comprising:
a user device in communicate via a communication network; and
a network monitoring platform communicatively coupled to the user device and the communication network, the network monitoring platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the network monitoring platform to:
monitor outgoing data associated with the user device and communicated via the communication network;
predict, based on a seasonal autoregressive integrated moving average (SARIMA) model of data volumes of the outgoing data associated with the user device, expected data volumes of outgoing data for a first set of time intervals;
measure, without inspecting content, data volumes of outgoing data for the first set of time intervals;
based on the expected data volumes for the first set of time intervals and the measured data volumes for the first set of time intervals, identify anomalies in the measured data volumes for the first set of time intervals; and
send, via the communication interface and based on the identification of anomalies, one or more notifications indicating the user device.
2. The system of claim 1 , wherein the computer-readable instructions, when executed by the at least one processor, cause the network monitoring platform to:
measure data volumes of outgoing data for a second set of time intervals; and
build, based on the measured data volumes for the second set of time intervals, the SARIMA model of data volumes.
3. The system of claim 2 , wherein the instructions, when executed by the at least one processor, cause the network monitoring platform to build the SARIMA model of data volumes by causing determining one or more hyperparameters of the SARIMA model that result in a best fit between the measured data volumes for the second set of time intervals and expected data volumes for the second set of time intervals, wherein the expected data volumes for the second set of time intervals are determined based on the SARIMA model.
4. The system of claim 1 , wherein the instructions, when executed by the at least one processor, cause the network monitoring platform to identify the anomalies by causing identifying the anomalies based on a difference between a measured data volume and an expected data volume for a time interval in the first set of time intervals being greater than a threshold value.
5. The system of claim 4 , wherein the threshold value is a multiple of a standard deviation of the expected data volumes for the first set of time intervals.
6. The system of claim 4 , wherein the threshold value is a multiple of a standard deviation of differences between the expected data volumes and the measured data volumes for the first set of time intervals.
7. The system of claim 1 , wherein the one or more notifications cause blocking the user device from communicating via the communication network.
8. The system of claim 1 , wherein the instructions, when executed by the at least one processor, cause the network monitoring platform to, based on the identification of anomalies, perform at least one of:
initiate a scan of the user device;
send packet captures of the data associated with the user device; or
perform profile analysis of a destination of the data associated with the user device.
9. A method comprising:
monitoring outgoing data associated with a user device and communicated via a communication network;
predicting, based on a seasonal autoregressive integrated moving average (SARIMA) model of data volumes of the outgoing data associated with the user device, expected data volumes of outgoing data for a first set of time intervals;
measuring, without inspecting content, data volumes of outgoing data for the first set of time intervals;
based on the expected data volumes for the first set of time intervals and the measured data volumes for the first set of time intervals, identifying anomalies in the measured data volumes for the first set of time intervals; and
sending, based on the identification of anomalies, one or more notifications indicating the user device.
10. The method of claim 9 , further comprising:
measuring data volumes of outgoing data for a second set of time intervals; and
building, based on the measured data volumes for the second set of time intervals, the SARIMA model of data volumes.
11. The method of claim 10 , wherein the building the SARIMA model of data volumes comprises determining one or more hyperparameters of the SARIMA model that result in a best fit between the measured data volumes for the second set of time intervals and expected data volumes for the second set of time intervals, wherein the expected data volumes for the second set of time intervals are determined based on the SARIMA model.
12. The method of claim 9 , wherein the identifying the anomalies is based on a difference between a measured data volume and an expected data volume for a time interval in the first set of time intervals being greater than a threshold value.
13. The method of claim 12 , wherein the threshold value is a multiple of a standard deviation of the expected data volumes for the first set of time intervals.
14. The method of claim 12 , wherein the threshold value is a multiple of a standard deviation of differences between the expected data volumes and the measured data volumes for the first set of time intervals.
15. The method of claim 9 , wherein the one or more notifications cause blocking the user device from communicating via the communication network.
16. The method of claim 9 , further comprising: based on the identification of anomalies, performing at least one of:
initiating a scan of the user device;
sending packet captures of the data associated with the user device; or
performing profile analysis of a destination of the data associated with the user device.
17. A non-transitory computer readable medium storing instructions that, when executed, cause:
monitoring outgoing data associated with a user device and communicated via a communication network;
predicting, based on a seasonal autoregressive integrated moving average (SARIMA) model of data volumes of the outgoing data associated with the user device, expected data volumes of outgoing data for a first set of time intervals;
measuring, without inspecting content, data volumes of outgoing data for the first set of time intervals;
based on the expected data volumes for the first set of time intervals and the measured data volumes for the first set of time intervals, identifying anomalies in the measured data volumes for the first set of time intervals; and
sending, based on the identification of anomalies, one or more notifications indicating the user device.
18. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause:
measuring data volumes of outgoing data for a second set of time intervals; and
building, based on the measured data volumes for the second set of time intervals, the SARIMA model of data volumes.
19. The non-transitory computer readable medium of claim 18 , wherein the instructions, when executed, cause the building the SARIMA model of data volumes by causing determining one or more hyperparameters of the SARIMA model that result in a best fit between the measured data volumes for the second set of time intervals and expected data volumes for the second set of time intervals, wherein the expected data volumes for the second set of time intervals are determined based on the SARIMA model.
20. The non-transitory computer readable medium of claim 17 , wherein the instructions, when executed, cause the identifying the anomalies based on a difference between a measured data volume and an expected data volume for a time interval in the first set of time intervals being greater than a threshold value.