A method of preventing malicious data exfiltration from a secure network, comprising: receiving at a device of a first network zone, a first internet protocol, IP, packet; determining, by a processor of the device, that a first protocol above a network layer and a first size of the first IP packet matches a predetermined policy of a plurality of predetermined policies; inspecting (412, 420, 426), by deep packet inspection of the processor, a first payload of the first IP packet based on the predetermined policy to identify a first source, a first destination, and a first format of the first IP packet; determining (414, 422, 428), by the processor, that one of the first source, the first destination, or the first format is improper based on the predetermined policy by determing an unsilicited DNS response, an improper ICMP response or a not conform SNTP or NTP protocol; flagging, by the processor, the first IP packet as suspect based on the determination; receiving, at the device, a second IP packet; determining (448, 458, 464), by the processor, that a second protocol above the network layer and a second size of the second IP packet matches the predetermined policy; inspecting (450, 460, 466), by deep packet inspection of the processor, a second payload of the second IP packet based on the predetermined policy to identify a second source, a second destination, and a second format of the second IP packet; determining (452, 462, 468) by the processor, that each of the second source, the second destination, and the second format is proper based on the predetermined policy; transmitting, by the processor, the second IP packet based on the determination and modifying the payload of the first IP packet responsive to the flagging of the first IP packet as suspect. receiving at a device of a first network zone, a first internet protocol, IP, packet; determining, by a processor of the device, that a first protocol above a network layer and a first size of the first IP packet matches a predetermined policy of a plurality of predetermined policies; inspecting (412, 420, 426), by deep packet inspection of the processor, a first payload of the first IP packet based on the predetermined policy to identify a first source, a first destination, and a first format of the first IP packet; determining (414, 422, 428), by the processor, that one of the first source, the first destination, or the first format is improper based on the predetermined policy by determing an unsilicited DNS response, an improper ICMP response or a not conform SNTP or NTP protocol; flagging, by the processor, the first IP packet as suspect based on the determination; receiving, at the device, a second IP packet; determining (448, 458, 464), by the processor, that a second protocol above the network layer and a second size of the second IP packet matches the predetermined policy; inspecting (450, 460, 466), by deep packet inspection of the processor, a second payload of the second IP packet based on the predetermined policy to identify a second source, a second destination, and a second format of the second IP packet; determining (452, 462, 468) by the processor, that each of the second source, the second destination, and the second format is proper based on the predetermined policy; transmitting, by the processor, the second IP packet based on the determination and modifying the payload of the first IP packet responsive to the flagging of the first IP packet as suspect.