{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,26]],"date-time":"2025-06-26T04:12:40Z","timestamp":1750911160126,"version":"3.41.0"},"publisher-location":"Cham","reference-count":19,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319687100"},{"type":"electronic","value":"9783319687117"}],"license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017]]},"DOI":"10.1007\/978-3-319-68711-7_10","type":"book-chapter","created":{"date-parts":[[2017,10,4]],"date-time":"2017-10-04T08:23:40Z","timestamp":1507105420000},"page":"171-192","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Optimal Strategies for Detecting Data Exfiltration by Internal and External Attackers"],"prefix":"10.1007","author":[{"given":"Karel","family":"Durkota","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Viliam","family":"Lis\u00fd","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Christopher","family":"Kiekintveld","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Karel","family":"Hor\u00e1k","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Branislav","family":"Bo\u0161ansk\u00fd","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tom\u00e1\u0161","family":"Pevn\u00fd","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2017,10,4]]},"reference":[{"unstructured":"Grand theft data data exfiltration study: Actors, tactics, and detection. Technical report, McAfee, Inc. (2015). https:\/\/www.mcafee.com\/us\/resources\/reports\/rp-data-exfiltration.pdf","key":"10_CR1"},{"key":"10_CR2","series-title":"Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1007\/978-3-642-05284-2_4","volume-title":"Security and Privacy in Communication Networks","author":"BM Bowen","year":"2009","unstructured":"Bowen, B.M., Hershkop, S., Keromytis, A.D., Stolfo, S.J.: Baiting inside attackers using decoy documents. In: Chen, Y., Dimitriou, T.D., Zhou, J. (eds.) SecureComm 2009. LNICST, vol. 19, pp. 51\u201370. Springer, Heidelberg (2009). doi: 10.1007\/978-3-642-05284-2_4"},{"unstructured":"Braziunas, D.: Pomdp solution methods. University of Toronto, Technical Report (2003)","key":"10_CR3"},{"issue":"3","key":"10_CR4","doi-asserted-by":"publisher","first-page":"115","DOI":"10.1049\/ip-ifs:20055151","volume":"153","author":"P Comesana","year":"2006","unstructured":"Comesana, P., P\u00e9rez-Freire, L., P\u00e9rez-Gonz\u00e1lez, F.: Blind newton sensitivity attack. IEE Proc.-Inf. Secur. 153(3), 115\u2013125 (2006)","journal-title":"IEE Proc.-Inf. Secur."},{"doi-asserted-by":"crossref","unstructured":"Fadolalkarim, D., Sallam, A., Bertino, E.: Pandde: provenance-based anomaly detection of data exfiltration. In: Proceedings of the Sixth ACM Conference on Data and Application Security and Privacy, pp. 267\u2013276. ACM (2016)","key":"10_CR5","DOI":"10.1016\/j.cose.2019.03.021"},{"doi-asserted-by":"crossref","unstructured":"Feder, T., Nazerzadeh, H., Saberi, A.: Approximating nash equilibria using small-support strategies. In: Proceedings of the 8th ACM Conference on Electronic Commerce, pp. 352\u2013354. ACM (2007)","key":"10_CR6","DOI":"10.1145\/1250910.1250961"},{"unstructured":"Wikipedia foundation: List of data breaches. https:\/\/en.wikipedia.org\/wiki\/List_of_data_breaches","key":"10_CR7"},{"key":"10_CR8","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"435","DOI":"10.1007\/978-3-319-47413-7_25","volume-title":"Decision and Game Theory for Security","author":"K Hor\u00e1k","year":"2016","unstructured":"Hor\u00e1k, K., Bo\u0161ansk\u00fd, B.: A point-based approximate algorithm for one-sided partially observable pursuit-evasion games. In: Zhu, Q., Alpcan, T., Panaousis, E., Tambe, M., Casey, W. (eds.) GameSec 2016. LNCS, vol. 9996, pp. 435\u2013454. Springer, Cham (2016). doi: 10.1007\/978-3-319-47413-7_25"},{"doi-asserted-by":"crossref","unstructured":"Laszka, A., Abbas, W., Sastry, S.S., Vorobeychik, Y., Koutsoukos, X.: Optimal thresholds for intrusion detection systems. In: Proceedings of the Symposium and Bootcamp on the Science of Security, pp. 72\u201381. ACM (2016)","key":"10_CR9","DOI":"10.1145\/2898375.2898399"},{"key":"10_CR10","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"264","DOI":"10.1007\/3-540-45853-0_16","volume-title":"Computer Security \u2014 ESORICS 2002","author":"SY Lee","year":"2002","unstructured":"Lee, S.Y., Low, W.L., Wong, P.Y.: Learning fingerprints for a database intrusion detection system. In: Gollmann, D., Karjoth, G., Waidner, M. (eds.) ESORICS 2002. LNCS, vol. 2502, pp. 264\u2013279. Springer, Heidelberg (2002). doi: 10.1007\/3-540-45853-0_16"},{"key":"10_CR11","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"240","DOI":"10.1007\/978-3-662-44851-9_16","volume-title":"Machine Learning and Knowledge Discovery in Databases","author":"V Lis\u00fd","year":"2014","unstructured":"Lis\u00fd, V., Kessl, R., Pevn\u00fd, T.: Randomized operating point selection in adversarial classification. In: Calders, T., Esposito, F., H\u00fcllermeier, E., Meo, R. (eds.) ECML PKDD 2014. LNCS, vol. 8725, pp. 240\u2013255. Springer, Heidelberg (2014). doi: 10.1007\/978-3-662-44851-9_16"},{"key":"10_CR12","doi-asserted-by":"publisher","first-page":"75","DOI":"10.1016\/j.ijcip.2008.08.001","volume":"1","author":"D Liu","year":"2008","unstructured":"Liu, D., Wang, X., Camp, J.: Game-theoretic modeling and analysis of insider threats. Int. J. Crit. Infrastruct. Prot. 1, 75\u201380 (2008)","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"issue":"2","key":"10_CR13","doi-asserted-by":"publisher","first-page":"10","DOI":"10.1109\/MITP.2010.52","volume":"12","author":"S Liu","year":"2010","unstructured":"Liu, S., Kuhn, R.: Data loss prevention. IT Prof. 12(2), 10\u201313 (2010)","journal-title":"IT Prof."},{"doi-asserted-by":"crossref","unstructured":"Liu, Y., Corbett, C., Chiang, K., Archibald, R., Mukherjee, B., Ghosal, D.: Sidd: a framework for detecting sensitive data exfiltration by an insider attack. In: 42nd Hawaii International Conference on System Sciences, HICSS 2009, pp. 1\u201310. IEEE (2009)","key":"10_CR14","DOI":"10.1109\/HICSS.2009.390"},{"key":"10_CR15","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1007\/978-3-319-47413-7_3","volume-title":"Decision and Game Theory for Security","author":"SM Mc Carthy","year":"2016","unstructured":"Mc Carthy, S.M., Sinha, A., Tambe, M., Manadhata, P.: Data exfiltration detection and prevention: virtually distributed POMDPs for practically safer networks. In: Zhu, Q., Alpcan, T., Panaousis, E., Tambe, M., Casey, W. (eds.) GameSec 2016. LNCS, vol. 9996, pp. 39\u201361. Springer, Cham (2016). doi: 10.1007\/978-3-319-47413-7_3"},{"issue":"2","key":"10_CR16","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1023\/A:1026543900054","volume":"40","author":"Y Rubner","year":"2000","unstructured":"Rubner, Y., Tomasi, C., Guibas, L.J.: The earth mover\u2019s distance as a metric for image retrieval. Int. J. Comput. Vis. 40(2), 99\u2013121 (2000)","journal-title":"Int. J. Comput. Vis."},{"doi-asserted-by":"crossref","unstructured":"Shoham, Y., Leyton-Brown, K.: Multiagent Systems: Algorithmic, Game-theoretic, and Logical Foundations. Cambridge University Press (2008)","key":"10_CR17","DOI":"10.1017\/CBO9780511811654"},{"unstructured":"Smith, T., Simmons, R.: Heuristic search value iteration for pomdps. In: Proceedings of the 20th Conference on Uncertainty in Artificial Intelligence, pp. 520\u2013527. AUAI Press (2004)","key":"10_CR18"},{"issue":"3","key":"10_CR19","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1109\/COMST.2007.4317620","volume":"9","author":"S Zander","year":"2007","unstructured":"Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermeasures in computer network protocols. IEEE Commun. Surv. Tutorials 9(3), 44\u201357 (2007)","journal-title":"IEEE Commun. Surv. Tutorials"}],"container-title":["Lecture Notes in Computer Science","Decision and Game Theory for Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-68711-7_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,26]],"date-time":"2025-06-26T00:15:52Z","timestamp":1750896952000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-68711-7_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"ISBN":["9783319687100","9783319687117"],"references-count":19,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-68711-7_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2017]]},"assertion":[{"value":"4 October 2017","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"GameSec","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Decision and Game Theory for Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Vienna","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Austria","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2017","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 October 2017","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"25 October 2017","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"gamesec2017","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/www.gamesec-conf.org\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}