DT-Leak: Process Mining-Based Behavioral Detection of Data Exfiltration - Cordeiro, Ailton; Silva, Geilson; Aires, Fernando; Santos, Wellison R. M.; Lima, Ricardo; Lima, Milton (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
The increasing sophistication of cyber threats, particularly Advanced Persistent Threats (APTs) focused on data exfiltration, has challenged the effectiveness of traditional perimeter-based and signature-based defenses. Conventional approaches rely heavily on tools such as Security Information and Event Management (SIEM), Intrusion Detection Systems (IDS), and event correlation to identify malicious activities based on isolated Indicators of Compromise (IoCs). However, these methods often fail to detect ’low and slow’ or ’live off the land’ behavioral sequences that mimic legitimate protocols, due to the lack of systematic mechanisms to transform fragmented log telemetry into verifiable behavioral models. To bridge this gap, this research proposes DT-Leak, a process mining-based approach to discover and analyze the behavioral dynamics of data exfiltration in corporate environments. The solution employs semantic abstraction strategies to mitigate the complexity of raw logs. This work offers a new analytical perspective that views cyberattacks as structured, discoverable processes, providing a formal framework to convert security telemetry into actionable behavioral intelligence. Experimental results demonstrate that the Heuristics Miner achieved the best balance between behavioral fidelity and model interpretability.