## 1 Introduction  
Data exfiltration is a common cyberattack in which information is removed, stolen, or copied from a computer without prior authorization or approval. There have been several high-profile cases of data exfiltration attacks, such as the 2017 Equifax data breach, in which the personal identifiable information (PII) of 143 million Americans was exfiltrated through an Apache Struts exploit [1]. Information such as credit card numbers, Social Security numbers, birthdays, passwords, addresses, and financial records are all examples of PII held in systems that, if not adequately protected, are at risk of being attacked and compromised. The cost of the global data exfiltration protection market is estimated to reach USD 99.3 billion by 2024, according to some reports [2]. Studies have demonstrated that such attacks are detectable using network anomaly detection techniques [3; 4; 5; 6; 7; 8; 9; 10]. Few of these use graph approaches as a way to better inform detection models [11]. Most approaches focus on global characteristics as features used in detection models than the nature of links and associated traffic between devices in a network [6] (i.e., local characteristics). In our past work, we have demonstrated that network topology and associated local characteristics between devices can be incorporated in statistical models for graphs that then can be used in such a manner to detect DNS exfiltration attacks [11]. The approach used past week information to predict daily anomalies in DNS traffic. However, DNS exfiltration is unique in the effect that it has on network traffic. It can be detected heuristically because the size of each DNS request is limited to about 253 bytes [12] and, as such, large data exfiltrations will create large amounts of DNS requests. This is different from more \"regular\" traffic such as HTTP where volumes of data can be transferred via a single TCP connection or through multiple connections. This paper aims to expand the previous body of work by demonstrating the efficacy of such a technique on data exfiltration over (a) HTTP traffic and (b) hourly baselines. The latter further highlights that the technique can be fine-tuned reliably in various time windows depending on the context and traffic that is utilized in. The contributions of this approach build upon our past work [11] and are as follows:  
* The method utilizes topology information based on the graph representation of network traffic to summarize a network's structural properties and to use such information in the statistical detection of an anomaly. This is different from detecting anomalies using global network indicators such as single node or whole network gigabytes of traffic. We achieve this by using exponential random graph models. * The method requires netflow data that are already collected as a common security practice in the industry. * The method aims to be an intuitive alert indicator that analyst can use to triangulate information about potential anomalies in the network. * The method can be configured to detect anomalies in various types of traffic and over variable time windows that can be used as baselines for network anomalies. In particular, an hourly time window allows for a much quicker incident response compared to daily time windows. The rest of the paper is organized as follows. In Section 2, we outline related work in the field of network anomaly detection related to our method. Section 3 describes our proposed method from processing packet capture data to running graph models and the time series analysis used for anomaly detection. Section 4 describes the experimental design, delving into finer detail on the configuration of the different components, as well as our data collection process and experimental procedure that focuses on HTTP traffic over hourly intervals. Section 5 provides a statistical analysis and interpretation of our experimental results, as well as details the computational requirements of our method. Section 6 discusses known and expected limitations of this method.