Secure USB Monitoring and Data Exfiltration Detection System

In the context of the Indian enterprise and institutional environment, this paper has introduced SUMDES, a modular open-source Data Loss Prevention system to overcome the particularity of exfiltrating data via the USB port. Through lightweight formulation of an all-in-one system logic in Python, the product supports all the above functionality without any commercial licensing fees, kernel-mode devices, administrative domain enrollment, or structured audit-logging policies. The theoretic contribution of this work involves a formal mathematical model for a weighted additive risk score that uses Indian regulatory information level classifications (DPDPA 2023, Income Tax Act, UIDAI Regulations, PCI DSS), a binary policy threshold function derived after empirically analyzing the co-occurrence pattern of the sensitive identifiers present in combinations, and a linear scan latency model that facilitates planning the capacity to be deployed on endpoint machines of varying specifications. The five-pattern Sensitive Data Detection Engine achieves 100% recall on all patterns on a synthetic validation set of 100 files; the only pattern with less than perfect precision is that of Credit Card — due to the fact that this pattern's performance is structural, thus colliding with the number field for invoice reference numbers — and there is a definite pathway forward for improvement on this performance in the form of NLP based contextual disambiguation that will be part of Phase 2. Apart from being the first open source system to support native PAN detection and Aadhaar detection, SUMDES is the first published system that delivers real time alert streaming capabilities, is deployed in a manner that can open the database concurrently in WAL mode, and provides an integrated multi-page Streamlit analytics dashboard. It has a layered, modular structure, enabling future extensions for a planned roadmap of three phases: Phase 2 will feature Isolation Forest behavioural anomaly detection, false positive reduction with NLP functionality and binary document inspection; Phase 3 will add OS-level write-blocking via minifilter and LSM drivers, mobile device monitoring using the MTP protocol, and SIEM integration for centralized multi-endpoint deployment. For organisations wishing to enforce USB data-transfer policies in line with the ongoing development of personal data protection regulations and frameworks in India, SUMDES offers a practically ready, instantly auditable base.

[1]     Honeywell, “2023 Honeywell USB Threat Report: Industrial Cybersecurity,” Honeywell Process Solutions, Charlotte, NC, USA, Tech. Rep. HPS-2023-USB, 2023. [2]     IBM Security, “Cost of a Data Breach Report 2023,” IBM Corporation, Armonk, NY, USA, Tech. Rep., 2023. [3]     Ministry of Electronics and Information Technology, Government of India, “Digital Personal Data Protection Act, 2023 (DPDPA),” Gazette of India, New Delhi, India, 2023. [4]     A. Gavin, “OpenDLP: A Free and Open-Source, Agent- and Agentless-based, Centrally Managed, Massively Distributable Data Loss Prevention Tool,” SANS Institute Reading Room, White Paper, 2010. [5]     M. Simsek and B. B. Guvenc, “MyDLP: An Open-Source Data Leakage Prevention System,” in Proc. IEEE Int. Symp. Innovations in Intelligent Systems and Applications (INISTA), 2012, pp. 1–5. [6]     A. Shabtai, Y. Elovici, and L. Rokach, “A Survey of Data Leakage Detection and Prevention Solutions,” in SpringerBriefs in Computer Science, New York, NY: Springer, 2012. [7]     M. Hart, P. Manadhata, and R. Johnson, “Text Classification for Data Loss Prevention,” in Proc. 11th Int. Symp. Privacy Enhancing Technologies (PETS), LNCS vol. 6794, Springer, 2011, pp. 18–37. [8]     K. Borders and A. Chen, “Light Shadow: Operating System Enforced Privacy for Mobile Web Browsers,” in Proc. IEEE Symp. Security and Privacy, 2010, pp. 290–304. [9]     Y. Liu, Y. Zhang, and W. Shi, “A Cloud-Based DLP Framework for Enterprise Data Protection,” IEEE Transactions on Services Computing, vol. 11, no. 4, pp. 634–646, Jul. 2018. [10]   A. Maiti and S. Schuckers, “USB-Based Attacks and Their Defences: A Comprehensive Survey,” IEEE Access, vol. 9, pp. 34170–34193, 2021.