CoDex: Cross-Tactic Correlation System for Data Exfiltration Detection

Advanced Persistence Threats (APTs) have become one of the major threats to enterprise security. In the past three years, over 70% of APT campaigns involved Data Exfiltration for double and even triple extortion, causing tremendous financial lost. The data exfiltration tactic illustrated in the MITRE Cybersecurity Framework are often detected based on a large amount of data being transferred. However, the malicious behaviors of Data Exfiltration are similar to either web browsing or system backups, leading to a high false positive rate for conventional detection methods. In this paper, we proposed a cross-tactic correlation system for Data Exfiltration detection, named CoDex, which detects and correlates potential cross-tactics malicious behaviors related to Data Exfiltration, such as Discovery and Data Collection. In our experiments, we reproduced 3 popular APT campaigns to evaluate the detection accuracy. On average, CoDex achieved 98.5% of detection accuracy, increased 60% of F1 score, and reduced the false positive rate from 7.1% to 0.5%.