Acknowledgments ix Acronyms xi 1 Introduction 5 1.1 Data Exfiltration Methods . 9 1.2 Important Questions . 14 1.3 Book Scope . 18 1.4 Book Summary .

20 1.5 Book Structure . 27 2 Background 29 2.1 Hidden Markov Model . 29 2.2 Memory Forensics . 37 2.3 Bag-of-Words Model .

42 2.4 Sparse Distributed Representation . 43 2.5 Summary . 45 3 Data Security Threats 47 3.1 Data Security . 48 3.2 Security vs.

Protection vs. Privacy . 53 3.3 Advanced Persistent Threats Attacks . 54 v 3.4 Cybersecurity Threats . 58 3.5 Conclusion .

89 4 Use Cases Data Leakage Attacks 91 4.1 Most Significant Attacks . 91 4.2 Top Infection Vectors . 98 4.3 Top Threats of Recent Years . 101 4.4 Malware Development Trends .

103 4.5 Geographic Trends . 108 4.6 Industry Trends . 114 4.7 Conclusion . 116 5 Survey on Building Block Technologies 117 5.1 Motivation .

118 5.2 Background . 123 5.3 Taxonomy . 137 5.4 Supervised Learning Methods . 140 5.5 Systematic Literature Review .

155 5.6 Evaluation of Supervised Learning Methods . 156 5.7 Key Open Problems . 175 5.8 Summary . 178 6 Behavior-based Data Exfiltration Detection 179 6.1 Motivation .

180 6.2 Existing Methods . 183 vi 6.3 Sub-Curve HMM Method . 190 6.4 Evaluation . 206 6.5 Experimental Results .

214 6.6 Discussion . 223 6.7 Summary . 227 7 Memory-based Data Exfiltration Detection 229 7.1 Motivation . 230 7.2 Existing Methods .

233 7.3 Concepts . 237 7.4 Fast lookup Bag-of-Words (FBoW) . 244 7.5 Evaluation . 256 7.6 Summary .

278 8 Temporal-based Data Exfiltration Detection 281 8.1 Motivation . 281 8.2 Existing Methods . 285 8.3 Definitions . 287 8.4 Temporary Memory Bag-of-Words (TMBoW) .

293 8.5 Experimental Results . 301 8.6 Summary . 314 9 Conclusion 317.