SIMPLE MECHANISM FOR POSSIBLE INFORMATION LEAK DETECTION ON DATA NETWORKS

Authors

Keywords:

fuga de información, periodicidad, tráfico de red, desviación estándar

Abstract

The leakage of sensitive information is one of the main problems faced by institutions. Traditional rules-based tools like Snort or Suricata are able to efficiently detect known threats, but are useless against APTs (Advanced Persistent Threats). APTs use unknown vulnerabilities and standard protocols with encryption, simulating normal behavior. In this research a simple method based on the standard deviation of the times between the arrival of flows is proposed. It seeks to detect periodic outgoing connections that can be analyzed by specialists in search of information leakage. Suspicious periodic connections were identified, one of them corresponding to a poorly configured service that reported user data, effectively identifying a case of information leakage.

Downloads

Download data is not yet available.

Downloads

Published

2021-03-12

How to Cite

Alfonso Valdés, J. (2021). SIMPLE MECHANISM FOR POSSIBLE INFORMATION LEAK DETECTION ON DATA NETWORKS. Telemática, 20(1), 27–35. Retrieved from https://revistatelematica.cujae.edu.cu/index.php/tele/article/view/431

Issue

Vol. 20 No. 1 (2021): Vol. 20, Issue 1, 2021

Section

Papers

License

The authors who publish in this journal agree to the following terms:

  1. The authors retain the copyright and guarantee to the journal the right to be the first publication of the work are distributed under a license of use and distribution "Creative Commons Attribution-NonCommercial-NoDerivativeWorks 3.0 Unported" (CC BY-NC-ND 3.0) You can consult from here the informative version and the legal text of the license that allows others to share the work with an acknowledgement of the authorship of the work and the initial publication in this journal.
  2. Authors may separately enter into additional agreements for non-exclusive distribution of the version of the work published in the journal (for example, placing it in an institutional repository or publishing it in a book), with an acknowledgement of its initial publication in this journal.
  3. Authors are allowed and encouraged to disseminate their work electronically (e.g., in institutional repositories or on their own website) before and during the submission process, as this can lead to productive exchanges as well as earlier and greater citation of published work (see The Effect of Open Access).