US 11,973,779 B2
Detecting data exfiltration and compromised user accounts in a computing network
Kenneth A. Kaye, Highlands Ranch, CO (US); Nikhil Sanil, Tega Cay, SC (US); Dipika Joshi, Waxhaw, NC (US); Colin Murphy, Charlotte, NC (US); and Satyanarayana R. Mandapati, Charlotte, NC (US)
Assigned to Bank of America Corporation, Charlotte, NC (US)
Filed by Bank of America Corporation, Charlotte, NC (US)
Filed on May 11, 2021, as Appl. No. 17/317,257.
Prior Publication US 2022/0368709 A1, Nov. 17, 2022
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/1441 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for detecting and blocking data exfiltration, from a user device, associated with a computing network, to an external network, the system comprising:
the user device configured to send data to one or more devices in the computing network and the external network;
the external network; and
a network monitoring platform communicatively coupled to the user device and the external network, the network monitoring platform comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the network monitoring platform to:
monitor outgoing data from the user device to the external network;
predict, based on a seasonal autoregressive integrated moving average (SARIMA) model of data volumes, expected data volumes of outgoing data for a first set of time intervals;
measure data volumes of outgoing data for the first set of time intervals without inspecting content of the outgoing data for the first set of time intervals;
based on the expected data volumes for the first set of time intervals and the measured data volumes for the first set of time intervals, identify anomalies in the measured data volumes of outgoing data for the first set of time intervals; and
send, via the communication interface and based on the identification of anomalies, a notification to disconnect the user device, wherein disconnecting the user device comprises blocking outgoing data from the user device to the external network.