The approach is based on the hypothesis that the network behavior of a data exfiltration differs significantly from normal connections. A data exfiltration is performed in an outgoing network ...