Patent ID: 11966470
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A computer-implemented method for detecting and preventing distributed data exfiltration attacks, the method comprising:
retrieving and analyzing security information, data from an organization asset database, and data from a configuration management database;
building an inventory of the service, based on the security information and the data from the organization asset database, and the data from the configuration management database;
calculating historical usage statistics for a service in an infrastructure, instances of the service, and clients requesting the instances, wherein calculating historical usage statistics is based on the security information, the data from the organization asset database, and the data from the configuration management database;
generating a baseline of normal usage activities for respective ones of the instances, based on the historical usage statistics;
monitoring current usage activities of the clients to build signatures of the instances, over sliding windows of the queries, wherein the signatures are anomalies in the current usage activities compared to the baseline of the normal usage activities;
determining whether a data exfiltration attack to one of the instances is in progress, wherein the data exfiltration attack is distributed among the instances of the service instances to disguise the data exfiltration attack as a legitimate activity;
in response to determining that the data exfiltration attack is in progress, increasing a risk score of the one of the instances;
calculating an overall risk score of the service, based on risk scores of the instances of the service; and
in response to determining that the overall risk score of the service exceed a predetermined threshold, generating an alert of the data exfiltration attack.