Extrusion detection

Extrusion Detection is a branch of Intrusion Detection aimed at developing mechanisms to identify successful or unsuccessful attempts to use the resources of a computer system to compromise other systems. Extrusion Detection techniques focus primarily on the analysis of internal system activity as well as outbound traffic in order to identify malicious users, malware or network packets that may pose a threat to the security of a computing environment.

While Intrusion Detection is mostly concerned about the identification of incoming attacks (intrusion attempts), Extrusion Detection systems try to prevent attacks from being launched in the first place by implementing monitoring controls at leaf nodes of a network -- rather than concentrating them at choke points, e.g., routers -- in order to distribute the inspection workload among multiple systems. Extrusion Detection tries to identify attack attempts launched locally in order to prevent them from reaching their target.

Extrusion Detection is also known as Outbound Intrusion Detection.

Related documents

1. "Extrusion Detection: Security Monitoring for Internal Intrusions"
2. "Stopping Spam by Extrusion Detection"
3. "Outbound Intrusion Detection"