2020/12/17 by Bushra Sabir, Sabir, Bushra, Faheem Ullah +6 · 13 citations
Computer Science · Engineering · #Advanced Malware Detection Techniques #Artificial intelligence #Categorization #Computer science #Context (archaeology) #Cryptography and Security (cs.CR) #Data mining #Data science #Deep learning #Digital and Cyber Forensics #Engineering #FOS: Computer and information sciences #Feature (linguistics) #Feature engineering #Intersection (aeronautics) #Machine Learning (cs.LG) #Machine learning #Network Security and Intrusion Detection #cs.CR #cs.LG
paper · pdf · doi:10.48550/arxiv.2012.09344
published in arXiv (Cornell University) (Cornell University)
openalex publication_date 2020/12/17 · arxiv created 2021/03/21 · arxiv updated 2021/03/23 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Context: Research at the intersection of cybersecurity, Machine Learning (ML), and Software Engineering (SE) has recently taken significant steps in proposing countermeasures for detecting sophisticated data exfiltration attacks. It is important to systematically review and synthesize the ML-based data exfiltration countermeasures for building a body of knowledge on this important topic. Objective: This paper aims at systematically reviewing ML-based data exfiltration countermeasures to identify and classify ML approaches, feature engineering techniques, evaluation datasets, and performance metrics used for these countermeasures. This review also aims at identifying gaps in research on ML-based data exfiltration countermeasures. Method: We used a Systematic Literature Review (SLR) method to select and review 92 papers. Results: The review has enabled us to (a) classify the ML approaches used in the countermeasures into data-driven, and behaviour-driven approaches, (b) categorize features into six types: behavioural, content-based, statistical, syntactical, spatial and temporal, (c) classify the evaluation datasets into simulated, synthesized, and real datasets and (d) identify 11 performance measures used by these studies. Conclusion: We conclude that: (i) the integration of data-driven and behaviour-driven approaches should be explored; (ii) There is a need of developing high quality and large size evaluation datasets; (iii) Incremental ML model training should be incorporated in countermeasures; (iv) resilience to adversarial learning should be considered and explored during the development of countermeasures to avoid poisoning attacks; and (v) the use of automated feature engineering should be encouraged for efficiently detecting data exfiltration attacks.