Abstract: A method and system for detecting and preventing data exfiltration attacks is disclosed. The system includes a manager device and an endpoint device, and an attack prevention device. The method includes detecting, at plurality of endpoint devices, downloads made at endpoint devices using Simple Network Management Protocol (SNMP) proxy. Next, the method includes mirroring network traffic associated with the downloads. The method further includes providing the mirrored network traffic as an input to a deep learning model, wherein the deep learning model detects presence of malware in the downloads. Finally, the method involves sending, by the manager device, an alert to one or more devices to prevent, recover, or mitigate data exfiltration attacks.

Abstract: A method and system for streaming management information base data using simple network management protocol is disclosed. The system includes a manager device and an endpoint device, which runs a SNMP agent and SNMP proxy. The SNMP proxy retrieves MIB data from the SNMP Agent associated with the endpoint device, wherein the MIB data comprises a full MIB sub-tree and differential MIB sub-trees. MIB views comprising MIB variables of interest associated with a full MIB sub-tree and differential MIB sub-trees are created based on a predetermined configuration. The SNMP proxy stores the MIB views and corresponding MIB data in a data store and compresses the MIB views and MIB data into files. Compressed file of the MIB view with MIB data associated with full MIB sub-tree are sent to the manager device in an initial stream. Further, the endpoint device streams compressed file of the MIB views with MIB data associated with the differential MIB sub-tree to the manager device on receiving a request.

Abstract: A method and system for detecting and preventing data exfiltration attacks is disclosed. The system includes a manager device and an endpoint device, and an attack prevention device. The method includes detecting, at plurality of endpoint devices, downloads made at endpoint devices using Simple Network Management Protocol (SNMP) proxy. Next, the method includes mirroring network traffic associated with the downloads. The method further includes providing the mirrored network traffic as an input to a deep learning model, wherein the deep learning model detects presence of malware in the downloads. Finally, the method involves sending, by the manager device, an alert to one or more devices to prevent, recover, or mitigate data exfiltration attacks.

Abstract: A method and system for streaming management information base data using simple network management protocol is disclosed. The system includes a manager device and an endpoint device, which runs a SNMP agent and SNMP proxy. The SNMP proxy retrieves MIB data from the SNMP Agent associated with the endpoint device, wherein the MIB data comprises a full MIB sub-tree and differential MIB sub-trees. MIB views comprising MIB variables of interest associated with a full MIB sub-tree and differential MIB sub-trees are created based on a predetermined configuration. The SNMP proxy stores the MIB views and corresponding MIB data in a data store and compresses the MIB views and MIB data into files. Compressed file of the MIB view with MIB data associated with full MIB sub-tree are sent to the manager device in an initial stream. Further, the endpoint device streams compressed file of the MIB views with MIB data associated with the differential MIB sub-tree to the manager device on receiving a request.