Search

Mestrado de dupla diplomação com a Kuban State Agrarian University Content of modern Web sites could be vulnerable to the data leaks, but could also already contain data leaks in itself, especially in the content of large institution’s Web sites, where a lot of users have an access to large, constantly processed huge amounts of data, which can include sensitive data. Unlike content of databases the content of such Web sites are much less structured and therefore less trackable and even more vulnerable to leaks that could happen due to the human factor. Most existing Data Leak Detection Systems are designed to detect data leaks on networks or in highly organized and structured systems like, for example, databases. During this work we will describe the process of creation of the multi-user Data Leak Detection System which will be capable of detecting critical types of data inside different institution’s Web sites by using descriptive entities of such types received from users. With this work we make a contribution to solving the problem of data leakage from educational institutions’ Web sites by analyzing the problem and developing a Data Detection System capable of collecting data from Web sites independently of search engines and, with help of users, of detecting critical data types in the collected data, providing a user, on the end of detection process, with the basic type of the report, giving him the opportunity for further observation of the detected data in order to decide whether to remove those data from the corresponding Web pages or not. O conteúdo de sites modernos pode ser vulnerável a fugas de dados, mas pode conter já fugas concretizadas, principalmente quando se trata do conteúdo de sites de grandes instituições, onde grandes quantidades de dados são frequentemente manipuladas e onde existe um grande número de utilizadores, e que geralmente processam dados confidenciais. Ao contrário, e.g das bases de dados, o conteúdo desses sites é muito menos estruturado e, menos rastreável e, portanto, ainda mais propicio a fugas de informação, que podem ocorrer não apenas devido a falhas técnicas, mas também por causa do fator humano. A maioria dos sistemas de deteção de fugas de dados existentes é projetado para detetar fugas em sistemas altamente organizados e estruturados, como bases de dados ou redes. Neste trabalho, descreveremos o processo de criação de um sistema de deteção de fugas de dados multi-utilizador, capaz de detetar tipos críticos de dados em páginas de sites utilizando objetos descritivos desses tipos descritos pelos utilizadores. Este trabalho contribui para a resolução do problema de fuga de dados dos sites de instituições de ensino, analisando o problema e desenvolvendo um sistema de deteção de dados que possa agregar dados de sites independentemente dos mecanismos de pesquisa e identificar dados críticos com a ajuda do utilizador - com a deteção de tipos críticos dados nos dados recolhidos, fornecendo no final um relatório do processo de descoberta, e criando a oportunidade de monitorizar ainda mais os dados detetados, com a finalidade de decidir se deve ou não remove-los das páginas da Web em que foram encontrados.

We present PANIC, a certified data leak detection tool, implemented as a plugin for the Camunda Modeler. With the help of our tool, process designers can detect data leaks instantaneously and interactively. The current prototype supports arbitrary BPMN processes with data logic implemented as inline scripts of a Groovy subset.

Program attacks are one of the oldest and fundamental cyber threats. They compromise the confidentiality of data, the integrity of program logic, and the availability of services. This threat becomes even severer when followed by other malicious activities such as data exfiltration. The integration of primitive attacks constructs comprehensive attack vectors and forms advanced persistent threats. Along with the rapid development of defense mechanisms, program attacks and data leak threats survive and evolve. Stealthy program attacks can hide in long execution paths to avoid being detected. Sensitive data transformations weaken existing leak detection mechanisms. New adversaries, e.g., semi-honest service provider, emerge and form threats. This thesis presents theoretical analysis and practical detection mechanisms against stealthy program attacks and data leaks. The thesis presents a unified framework for understanding different branches of program anomaly detection and sheds light on possible future program anomaly detection directions. The thesis investigates modern stealthy program attacks hidden in long program executions and develops a program anomaly detection approach with data mining techniques to reveal the attacks. The thesis advances network-based data leak detection mechanisms by relaxing strong requirements in existing methods. The thesis presents practical solutions to outsource data leak detection procedures to semi-honest third parties and identify noisy or transformed data leaks in network traffic. Ph. D.

The leak of sensitive data on computer systems poses a serious threat to organizational security. Organizations need to identify the exposure of sensitive data by screening the content in storage and transmission, i.e., to detect sensitive information being stored or transmitted in the clear. However, detecting the exposure of sensitive information is challenging due to data transformation in the content. Transformations (such as insertion, deletion) result in highly unpredictable leak patterns. Existing automata-based string matching algorithms are impractical for detecting transformed data leaks, because of its formidable complexity when modeling the required regular expressions. We design two new algorithms for detecting long and transformed data leaks. Our system achieves high detection accuracy in recognizing transformed leaks compared to the state-of-the-art inspection methods. We parallelize our prototype on graphics processing unit and demonstrate the strong scalability of our detection solution required by a sizable organization.

The exposure of sensitive data in storage and transmission poses a serious threat to organizational and personal security. Data leak detection aims at scanning content (in storage or transmission) for exposed sensitive data. Because of the large content and data volume, such a screening algorithm needs to be scalable for a timely detection. Our solution uses the MapReduce framework for detecting exposed sensitive content, because it has the ability to arbitrarily scale and utilize public resources for the task, such as Amazon EC2. We design new MapReduce algorithms for computing collection intersection for data leak detection. Our prototype implemented with the Hadoop system achieves 225 Mbps analysis throughput with 24 nodes. Our algorithms support a useful privacy-preserving data transformation. This transformation enables the privacy-preserving technique to minimize the exposure of sensitive data during the detection. This transformation supports the secure outsourcing of the data leak detection to untrusted MapReduce and cloud providers. This work has been supported in part by Security and Software Engineering Research Center (S2ERC), a NSF sponsored multi-university Industry/University Cooperative Research Center (I/UCRC), and ARO YIP W911NF-14-1-0535.