Data Exfiltration Anomaly Detection on Enterprise Networks using Deep Packet Inspection

Abstrak

Advanced persistent threats (APT) are threat actors with the advanced Technique, Tactic and Procedure (TTP) to gain covert control of the computer network for a long period of time. These threat actors are the highest cyber attack risk factor for enterprise companies and governments. A successful attack by the APT threat Actors has the capabilities to do physical damage. APT groups are typically state-sponsored and are considered the most effective and skilled cyber attackers. The ï¬nal goal for the APT Attack is to exï¬ltrate victims data or sabotage system. This aim of this research is to exercise multiple Machine Learning Approach such as k-Nearest Neighbors and H20 Deep Learning Model and also employ Deep Packet Inspection on enterprise network trafï¬c dataset in order to identify suitable approaches to detect data exï¬ltration by APT threat Actors. This study shows that combining machine learning techniques with Deep Packet Inspection signiï¬cantly improves the detection of data exï¬ltration attempts by Advanced Persistent Threat (APT) actors. The ï¬ndings suggest that this approach can enhance anomaly detection systems, bolstering the cybersecurity defenses of enterprises. Consequently, the research implications could lead to developing more robust strategies against sophisticated and covert cyber threats posed by APTs.