Machine learning as a support for data exfiltration attacks: an integrated architecture for reducing detection risks

Abstract

This article aims to propose an integrated

architecture for optimizing data exfiltration

actions using open data sources and machine

learning techniques. The application flow

provides for the detection of artifacts of greater

interest to the executing agent through target

selection and the consequent reduction in the

volume of data involved in the data exfiltration

action, thus allowing to speed up the pace and

reduce the risk of attack detection. The

proposed architecture is composed of three

components: a crawler that uses search engines

known on the web to search and collect files in

PDF format; a topic modeling component that

classifies collected files; and a machine learning

component that uses classified documents to

train an algorithm to identify similar documents.

With the implementation of a proof of concept,

this article demonstrates that it is possible to

achieve the intended objectives, resulting in a

90% reduction in the volume of data involved in

a data exfiltration action with the proposed

architecture, reducing the execution time and

the risks of detecting the action.