Online detection of users' anomalous activities on confidential file sharing platform

点击翻译按钮获取中文摘要

TitanFile is a platform for exchanging confidential documents with authorized parties outside of the**organization. The external sharing of confidential documents raises the risk of data exfiltration to unauthorized**parties, whether maliciously or unintentionally due to human error. To mitigate this risk, we ask the following**question: "is it possible to detect user activities that have symptoms of fraudulent or unintended behavior in**real time based on the user's activity pattern and available metadata describing the transaction?"**The goal of the project is to construct a system for online detection of malicious, spurious or erroneous activity**of TitanFile's users. The targeted activities to be detected include: data theft, data exfiltration, external**correspondence and file sharing. Those events can occur as a result of user mistakes or intentional actions.**The result of the project will be an analytical model that will generate typical profiles across customers and**identify anomalies in their behaviour. Sample activities include: employees sending company data to**unauthorized persons, accidentally communicating with the wrong person and sending confidential data to**personal accounts. The system will be designed work in real time analyzing log streams of TitanFile - for each**logged event the classifier will output a binary decision along with a confidence level. The solution will be**provided with a Python module API for an easy integration with the existing TitanFile's infrastructure.