Detecting Low-and-Slow Data Exfiltration: A Behavioural and Cumulative-Signal Approach to Identifying Slow-Moving Data Extraction

DOI

https://www.doi.org/10.59256/indjcst.20260502114

Published In

Volume 5, Issue 2 (2026)

Published Online

May-August 2026

Pages

1039-1042

Article Type

Original Article

Check for updates

Most exfiltration controls are built to catch a single large transfer: a threshold on session size, a daily-volume cap, a DLP rule tuned to a file-size or record-count trigger. An adversary who instead moves data out in small increments over an extended period – kilobytes at a time, spread across days or weeks, often through channels that are individually unremarkable – can stay under every one of those thresholds indefinitely. This paper sets out a detection approach for that low-and-slow pattern. It argues that no single log source or single-session threshold is sufficient, and that reliable detection instead requires stitching together weak, individually-tolerable signals across along observation window, using periodicity, cumulative volume against an adaptive baseline, and entity-relative behavioural scoring. A practical detection architecture is proposed, built primarily on SIEM correlation logic over proxy, DNS, endpoint and database logs, with worked detection logic, tuning guidance to control false positives, and a discussion of the specific evasion techniques – protocol choice, timing jitter, channel rotation – that a slow exfiltration campaign is likely to use against exactly this kind of detection.