Detecting data exfiltration as the data exfiltration occurs or after the data exfiltration occurs

Abstract

A device may identify exfiltration information to be used to detect data exfiltration. The exfiltration information may be associated with a file being tested to determine whether the file exfiltrates data. The exfiltration information may include a resource identifier that identifies a resource to be used to detect the data exfiltration. The device may determine that the resource, to be used to detect the data exfiltration, has been accessed. The device may identify, based on determining that the resource has been accessed, the file associated with the exfiltration information. The device may perform an action, associated with the file, to counteract the data exfiltration based on determining that the resource has been accessed and based on identifying the file.

1 - 20 . (canceled) 
     
     
         21 . A method comprising:
 identifying, by a device, a policy;   implementing, by the device, the policy based on identifying the policy;   determining, by the device and based on implementing the policy, a quantity of premature expirations of an adjustment interval,
 a bandwidth reservation of a label-switched path being adjusted at an expiration of the adjustment interval; and 
   determining, by the device and based on determining the quantity of premature expirations of the adjustment interval, an updated policy that reduces the quantity of premature expirations of the adjustment interval.   
     
     
         22 . The method of  claim 21 , further comprising:
 receiving information that identifies network traffic behavior associated with the label-switched path,
 where identifying the policy comprises:
 determining the policy based on the information that identifies the network traffic behavior associated with the label-switched path. 
 
   
     
     
         23 . The method of  claim 21 , further comprising:
 determining a sample interval value and an adjustment interval value,
 where identifying the policy comprises:
 determining the policy based on the sample interval value and the adjustment interval value. 
 
   
     
     
         24 . The method of  claim 21 , further comprising:
 analyzing network traffic behavior associated with the label-switched path,
 where identifying the policy comprises:
 determining the policy based on analyzing the network traffic behavior associated with the label-switched path and a model associated with the label-switched path. 
 
   
     
     
         25 . The method of  claim 21 ,
 where the policy is a first policy,   where the label-switched path is a first label-switched path,   where the method further comprises:
 identifying a second policy for a second label-switched path, and 
   where the second policy is different from the first policy.   
     
     
         26 . The method of  claim 21 , further comprising:
 determining multiple policies for the label-switched path,
 where identifying the policy comprises:
 identifying the policy as a particular policy, of the multiple policies, to be implemented based on a time of day. 
 
   
     
     
         27 . The method of  claim 21 , further comprising:
 providing, to an ingress routing device, one or more instructions that cause the ingress routing device to implement the updated policy.   
     
     
         28 . A system comprising:
 a memory; and   one or more processors to:
 identify a policy; 
 determine, based on the policy, a quantity of premature expirations of an adjustment interval,
 a bandwidth reservation of a label-switched path being adjusted at an expiration of the adjustment interval; and 
 
 determine, based on determining the quantity of premature expirations of the adjustment interval, an updated policy that reduces the quantity of premature expirations of the adjustment interval. 
   
     
     
         29 . The system of  claim 28 ,
 where the one or more processors are further to:
 receive information that identifies network traffic behavior associated with the label-switched path, and 
   where, when identifying the policy, the one or more processors are to:
 determine the policy based on the information that identifies the network traffic behavior associated with the label-switched path. 
   
     
     
         30 . The system of  claim 28 ,
 where the one or more processors are further to:
 determine a sample interval value and an adjustment interval value, and 
   where, when identifying the policy, the one or more processors are to:
 determine the policy based on the sample interval value and the adjustment interval value. 
   
     
     
         31 . The system of  claim 28 ,
 where the one or more processors are further to:
 analyze network traffic behavior associated with the label-switched path, and 
   where, when identifying the policy, the one or more processors are to:
 determine the policy based on analyzing the network traffic behavior associated with the label-switched path and a model associated with the label-switched path. 
   
     
     
         32 . The system of  claim 28 ,
 where the policy is a first policy,   where the label-switched path is a first label-switched path,   where the one or more processors are further to:
 identify a second policy for a second label-switched path, and 
   where the second policy is different from the first policy.   
     
     
         33 . The system of  claim 28 ,
 where the one or more processors are further to:
 determine multiple policies for the label-switched path, and 
   where, when identifying the policy, the one or more processors are to:
 identify the policy as a particular policy, of the multiple policies, to be implemented based on a time of day. 
   
     
     
         34 . The system of  claim 28 , where the one or more processors are further to:
 provide, to an ingress routing device, one or more instructions that cause the ingress routing device to implement the updated policy.   
     
     
         35 . A non-transitory computer-readable medium storing instructions, the instructions comprising:
 one or more instructions that, when executed by at least one processor, cause the at least one processor to:
 identify a policy; 
 determine, based on the policy, a quantity of premature expirations of an adjustment interval,
 a bandwidth reservation of a label-switched path being adjusted at an expiration of the adjustment interval; and 
 
 determine, based on determining the quantity of premature expirations of the adjustment interval, an updated policy that reduces the quantity of premature expirations of the adjustment interval. 
   
     
     
         36 . The non-transitory computer-readable medium of  claim 35 ,
 where the one or more instructions further cause the at least one processor to:
 receive information that identifies network traffic behavior associated with the label-switched path, and 
   where the one or more instructions to identify the policy cause the at least one processor to:
 determine the policy based on the information that identifies the network traffic behavior associated with the label-switched path. 
   
     
     
         37 . The non-transitory computer-readable medium of  claim 35 ,
 where the one or more instructions further cause the at least one processor to:
 determine a sample interval value and an adjustment interval value, and 
   where the one or more instructions to identify the policy cause the at least one processor to:
 determine the policy based on the sample interval value and the adjustment interval value. 
   
     
     
         38 . The non-transitory computer-readable medium of  claim 35 ,
 where the one or more instructions further cause the at least one processor to:
 analyze network traffic behavior associated with the label-switched path, and 
   where the one or more instructions to identify the policy cause the at least one processor to:
 determine the policy based on analyzing the network traffic behavior associated with the label-switched path and a model associated with the label-switched path. 
   
     
     
         39 . The non-transitory computer-readable medium of  claim 35 ,
 where the policy is a first policy,   where the label-switched path is a first label-switched path,   where the one or more instructions to identify the policy cause the at least one processor to:
 identify a second policy for a second label-switched path, and 
   where the second policy is different from the first policy.   
     
     
         40 . The non-transitory computer-readable medium of  claim 35 ,
 where the one or more instructions further cause the at least one processor to:
 determine multiple policies for the label-switched path, and 
   where the one or more instructions to identify the policy cause the at least one processor to:
 identify the policy as a particular policy, of the multiple policies, to be implemented based on a time of day.