Fortinet, Inc.
Detecting data exfiltration using machine learning on personal e-mail account display names

Abstract:

An e-mail application is identified by parsing a network packet from the network packets. Responsive to the e-mail application identification, a display name associated with the user is extracted and the display name is stored among a plurality of display names in association with the company e-mail address of the user. Responsive to one of the plurality of display names matching a display name of a private e-mail address of the user as a destination of e-mail along with surpassing a threshold amount of data transfer, the user is flagged for possible data exfiltration.