Early Warning System for Data Exfiltration

数据泄露预警系统

• 批准号: 132833
• 金额: $ 8.92万
• 依托单位: CYBEROWL LIMITED
• 依托单位国家: 英国
• 项目类别: Feasibility Studies
• 财政年份: 2017
• 资助国家: 英国
• 起止时间: 2017 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=132833
• 关键词: Early; Warning; System; Data; Exfiltration

Network security monitoring needs an early warning system. Attacks are getting slower, stealthier and more sophisticated. The average detection time of a security breach is lengthening, resulting in the wrong balance of reactive and proactive defence, and driving up the total cost of security and remediation. Existing monitoring tools will simply fail to cope with this. Broadly, the signature- or rule- based tools are very retrospective. This is quickly becoming obsolete, in a world where a specific malware is often only used a small handful of times. By contrast, anomalous behaviour monitoring overwhelms the defender with false positives and struggles to deal with pre-infected environments. There is a need to monitor networks for threat probabilities of indicators associated with early phases of attacks. This is a new approach to network security monitoring. It will shift the advantage back to the defender, by allowing them to “nip attacks in the bud”, before the organisation is exposed to significant costs of data loss. This approach also enables warning of unknown attacks and exploits; a fundamentally different approach to post-incident forensic signature-based methods.

网络安全监测需要预警系统。攻击变得越来越慢，越来越隐蔽，越来越复杂。安全漏洞的平均检测时间正在延长，导致被动防御和主动防御的错误平衡，并推高了安全和补救的总成本。现有的监测工具根本无法科普这一问题。一般来说，基于签名或规则的工具具有很强的追溯性.在一个特定恶意软件通常只使用少数几次的世界里，这很快就过时了。相比之下，异常行为监测会让防御者陷入误报，并难以应对感染前的环境。有必要监测网络中与攻击早期阶段有关的指标的威胁概率。这是一种新的网络安全监控方法。它将把优势转移回防御者，允许他们在组织暴露于数据丢失的重大成本之前“将攻击扼杀在萌芽状态”。这种方法还可以警告未知的攻击和漏洞利用;这是一种与基于事后取证签名的方法完全不同的方法。