detecting-insider-data-exfiltration-via-dlp

Load file activity logs into a pandas DataFrame, compute each user's average daily upload volume as a baseline, then flag users whose current-day transfers exceed three times that baseline. Combine this with off-hours filtering on timestamp hours for stronger signals.

You need a CSV with at least timestamp, user, and bytes_transferred columns, typically exported from endpoint agents, cloud storage access logs, or email DLP events. Timestamps must be parseable dates with correct timezones for off-hours analysis.

A fixed 3x daily threshold only catches same-day spikes, so an insider drip-feeding a few MB per day stays invisible. Add cumulative 30-day rolling sums compared against peer-group baselines and rare-destination detection to catch low-and-slow exfiltration.

Volume baselines over endpoint, cloud, and email logs miss DNS tunneling, DoH/DoT, personal webmail or cloud accounts, Slack/Discord uploads, and pastebin or git pushes. Any channel without a DLP sensor is a blind spot that must be enumerated explicitly.

Allowlist known roles and destinations such as backup jobs, developers pushing build artifacts, and shift workers who legitimately operate at night. Verify timestamps are timezone-correct so the off-hours window is not shifted, and validate the rule in a lab with a known test transfer.