{"id":"https://openalex.org/W4317935365","doi":"https://doi.org/10.1145/3582077","title":"Implementing Data Exfiltration Defense in Situ: A Survey of Countermeasures and Human Involvement","display_name":"Implementing Data Exfiltration Defense in Situ: A Survey of Countermeasures and Human Involvement","publication_year":2023,"publication_date":"2023-01-25","ids":{"openalex":"https://openalex.org/W4317935365","doi":"https://doi.org/10.1145/3582077"},"language":"en","primary_location":{"id":"doi:10.1145/3582077","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3582077","pdf_url":null,"source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"},"type":"review","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072249188","display_name":"Mu-Huan Chung","orcid":"https://orcid.org/0000-0002-9826-2142"},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Mu-Huan Chung","raw_affiliation_strings":["University of Toronto, Canada"],"affiliations":[{"raw_affiliation_string":"University of Toronto, Canada","institution_ids":["https://openalex.org/I185261750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101902543","display_name":"Yuhong Yang","orcid":"https://orcid.org/0000-0003-3279-4178"},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Yuhong Yang","raw_affiliation_strings":["University of Toronto, Canada"],"affiliations":[{"raw_affiliation_string":"University of Toronto, Canada","institution_ids":["https://openalex.org/I185261750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100364541","display_name":"Lu Wang","orcid":"https://orcid.org/0000-0003-4016-4096"},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Lu Wang","raw_affiliation_strings":["University of Toronto, Canada"],"affiliations":[{"raw_affiliation_string":"University of Toronto, Canada","institution_ids":["https://openalex.org/I185261750"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063961023","display_name":"Greg Cento","orcid":"https://orcid.org/0000-0002-8734-2972"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Greg Cento","raw_affiliation_strings":["Sun Life Financial, Canada"],"affiliations":[{"raw_affiliation_string":"Sun Life Financial, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048261136","display_name":"Khilan Jerath","orcid":"https://orcid.org/0000-0003-0518-4227"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Khilan Jerath","raw_affiliation_strings":["Sun Life Financial, Canada"],"affiliations":[{"raw_affiliation_string":"Sun Life Financial, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077865999","display_name":"Abhay Raman","orcid":"https://orcid.org/0000-0002-4193-1464"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abhay Raman","raw_affiliation_strings":["Sun Life Financial, Canada"],"affiliations":[{"raw_affiliation_string":"Sun Life Financial, Canada","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049933072","display_name":"David Lie","orcid":"https://orcid.org/0000-0002-2000-6827"},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"David Lie","raw_affiliation_strings":["University of Toronto, Canada"],"affiliations":[{"raw_affiliation_string":"University of Toronto, Canada","institution_ids":["https://openalex.org/I185261750"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5039024869","display_name":"Mark Chignell","orcid":"https://orcid.org/0000-0001-8120-6905"},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mark H. Chignell","raw_affiliation_strings":["University of Toronto, Canada"],"affiliations":[{"raw_affiliation_string":"University of Toronto, Canada","institution_ids":["https://openalex.org/I185261750"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":8,"corresponding_author_ids":["https://openalex.org/A5072249188"],"corresponding_institution_ids":["https://openalex.org/I185261750"],"apc_list":null,"apc_paid":null,"fwci":2.8507,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":{"value":0.9220372,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":"55","issue":"14s","first_page":"1","last_page":"37"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8132388591766357},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7141522765159607},{"id":"https://openalex.org/keywords/scope","display_name":"Scope (computer science)","score":0.6796032786369324},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5574830174446106},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.4800632894039154},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.3687821626663208},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.36216604709625244}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8132388591766357},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7141522765159607},{"id":"https://openalex.org/C2778012447","wikidata":"https://www.wikidata.org/wiki/Q1034415","display_name":"Scope (computer science)","level":2,"score":0.6796032786369324},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5574830174446106},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.4800632894039154},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3687821626663208},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.36216604709625244},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3582077","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3582077","pdf_url":null,"source":{"id":"https://openalex.org/S157921468","display_name":"ACM Computing Surveys","issn_l":"0360-0300","issn":["0360-0300","1557-7341"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Computing Surveys","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.800000011920929}],"awards":[{"id":"https://openalex.org/G2323260579","display_name":null,"funder_award_id":"IT30559","funder_id":"https://openalex.org/F4320322675","funder_display_name":"Mitacs"}],"funders":[{"id":"https://openalex.org/F4320322675","display_name":"Mitacs","ror":"https://ror.org/00cjrc276"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":205,"referenced_works":["https://openalex.org/W31046632","https://openalex.org/W33933511","https://openalex.org/W42722137","https://openalex.org/W44775132","https://openalex.org/W77083600","https://openalex.org/W129133996","https://openalex.org/W132347231","https://openalex.org/W572872720","https://openalex.org/W1109422923","https://openalex.org/W1514368868","https://openalex.org/W1569442657","https://openalex.org/W1570321471","https://openalex.org/W1577337656","https://openalex.org/W1588953585","https://openalex.org/W1594706025","https://openalex.org/W1627074804","https://openalex.org/W1648834017","https://openalex.org/W1654306951","https://openalex.org/W1678518841","https://openalex.org/W1682759715","https://openalex.org/W1800216166","https://openalex.org/W1873122431","https://openalex.org/W1909163279","https://openalex.org/W1962083226","https://openalex.org/W1965654413","https://openalex.org/W1969795119","https://openalex.org/W1977306523","https://openalex.org/W1978271112","https://openalex.org/W1984946784","https://openalex.org/W1994326726","https://openalex.org/W1994805988","https://openalex.org/W1996360405","https://openalex.org/W1996575854","https://openalex.org/W1996655273","https://openalex.org/W1997199359","https://openalex.org/W2007999111","https://openalex.org/W2009668520","https://openalex.org/W2013745554","https://openalex.org/W2023017076","https://openalex.org/W2025519999","https://openalex.org/W2032437438","https://openalex.org/W2033397154","https://openalex.org/W2039237691","https://openalex.org/W2041700825","https://openalex.org/W2041858766","https://openalex.org/W2042448840","https://openalex.org/W2045999085","https://openalex.org/W2050082837","https://openalex.org/W2050131929","https://openalex.org/W2052131022","https://openalex.org/W2059348446","https://openalex.org/W2068189899","https://openalex.org/W2070191343","https://openalex.org/W2071642882","https://openalex.org/W2077121139","https://openalex.org/W2081418638","https://openalex.org/W2082348123","https://openalex.org/W2089216878","https://openalex.org/W2091788338","https://openalex.org/W2097171586","https://openalex.org/W2099964107","https://openalex.org/W2101173463","https://openalex.org/W2104468266","https://openalex.org/W2108073531","https://openalex.org/W2111465715","https://openalex.org/W2114073616","https://openalex.org/W2116065364","https://openalex.org/W2126348339","https://openalex.org/W2137749308","https://openalex.org/W2141420453","https://openalex.org/W2142889610","https://openalex.org/W2147767253","https://openalex.org/W2151584216","https://openalex.org/W2154486111","https://openalex.org/W2154765153","https://openalex.org/W2160319865","https://openalex.org/W2161125296","https://openalex.org/W2165313690","https://openalex.org/W2165766811","https://openalex.org/W2166602595","https://openalex.org/W2166975838","https://openalex.org/W2184786010","https://openalex.org/W2185323257","https://openalex.org/W2188114092","https://openalex.org/W2194024026","https://openalex.org/W2213345052","https://openalex.org/W2271567685","https://openalex.org/W2282821441","https://openalex.org/W2298172707","https://openalex.org/W2305105243","https://openalex.org/W2312250904","https://openalex.org/W2404532944","https://openalex.org/W2483945477","https://openalex.org/W2507724564","https://openalex.org/W2512189246","https://openalex.org/W2522094345","https://openalex.org/W2541427793","https://openalex.org/W2545430315","https://openalex.org/W2566006170","https://openalex.org/W2597756285","https://openalex.org/W2615133144","https://openalex.org/W2617906815","https://openalex.org/W2691976780","https://openalex.org/W2694044524","https://openalex.org/W2701195988","https://openalex.org/W2730380569","https://openalex.org/W2754972313","https://openalex.org/W2765732179","https://openalex.org/W2766428736","https://openalex.org/W2773825811","https://openalex.org/W2790515622","https://openalex.org/W2790583291","https://openalex.org/W2790664081","https://openalex.org/W2801609661","https://openalex.org/W2809183419","https://openalex.org/W2843669218","https://openalex.org/W2858044321","https://openalex.org/W2892020218","https://openalex.org/W2895144199","https://openalex.org/W2901285969","https://openalex.org/W2903158431","https://openalex.org/W2904105652","https://openalex.org/W2919933843","https://openalex.org/W2921968294","https://openalex.org/W2930423981","https://openalex.org/W2933127114","https://openalex.org/W2941898360","https://openalex.org/W2949647805","https://openalex.org/W2969269317","https://openalex.org/W2984353433","https://openalex.org/W2990135320","https://openalex.org/W2990540619","https://openalex.org/W2990714382","https://openalex.org/W2992161509","https://openalex.org/W2997439297","https://openalex.org/W3000086409","https://openalex.org/W3000429356","https://openalex.org/W3004908285","https://openalex.org/W3005298575","https://openalex.org/W3006711782","https://openalex.org/W3013285202","https://openalex.org/W3014091682","https://openalex.org/W3021130993","https://openalex.org/W3028347386","https://openalex.org/W3037634279","https://openalex.org/W3039513780","https://openalex.org/W3048012689","https://openalex.org/W3084164197","https://openalex.org/W3096281460","https://openalex.org/W3097904228","https://openalex.org/W3098102491","https://openalex.org/W3105682467","https://openalex.org/W3107245277","https://openalex.org/W3109288593","https://openalex.org/W3111596588","https://openalex.org/W3114627546","https://openalex.org/W3116565634","https://openalex.org/W3133555681","https://openalex.org/W3142650863","https://openalex.org/W3143304050","https://openalex.org/W3159654885","https://openalex.org/W3161804663","https://openalex.org/W3165053742","https://openalex.org/W3167011080","https://openalex.org/W3168763570","https://openalex.org/W3170155579","https://openalex.org/W3176289544","https://openalex.org/W3179245071","https://openalex.org/W3198411072","https://openalex.org/W3198775197","https://openalex.org/W3202733154","https://openalex.org/W3207777896","https://openalex.org/W4206422821","https://openalex.org/W4210300416","https://openalex.org/W4211218509","https://openalex.org/W4213012696","https://openalex.org/W4225665922","https://openalex.org/W4232836212","https://openalex.org/W4235933432","https://openalex.org/W4243342770","https://openalex.org/W4250211766","https://openalex.org/W4252307542","https://openalex.org/W4281727634","https://openalex.org/W4287551906","https://openalex.org/W4287752385","https://openalex.org/W4288083473","https://openalex.org/W4293168393","https://openalex.org/W6603173816","https://openalex.org/W6627389111","https://openalex.org/W6630780968","https://openalex.org/W6636576504","https://openalex.org/W6640124270","https://openalex.org/W6674932189","https://openalex.org/W6676258922","https://openalex.org/W6678876396","https://openalex.org/W6683852856","https://openalex.org/W6684381460","https://openalex.org/W6684764998","https://openalex.org/W6686593911","https://openalex.org/W6686604339","https://openalex.org/W6737365491","https://openalex.org/W6756615331","https://openalex.org/W6787742256","https://openalex.org/W6796176818","https://openalex.org/W7005253963"],"related_works":["https://openalex.org/W2055296412","https://openalex.org/W2845979180","https://openalex.org/W2353578929","https://openalex.org/W2358647360","https://openalex.org/W2623347760","https://openalex.org/W2088673791","https://openalex.org/W2434628453","https://openalex.org/W1981278478","https://openalex.org/W3022026389","https://openalex.org/W2348380451"],"abstract_inverted_index":{"In":[0],"this":[1,65],"article":[2,66],"we":[3,60],"consider":[4,30],"the":[5,15,53,56,62,68,71],"problem":[6],"of":[7,17,46,55,64,70,79,82,107],"defending":[8,83,93],"against":[9,48,84,94,159],"increasing":[10],"data":[11,49,57,85,95,160],"exfiltration":[12,24,58,96],"threats":[13,25],"in":[14,112,121],"domain":[16,102],"cybersecurity.":[18,122],"We":[19,29,73,87,143],"review":[20],"existing":[21],"work":[22],"on":[23],"and":[26,33,67,109,134],"corresponding":[27],"countermeasures.":[28],"current":[31,90],"problems":[32],"challenges":[34],"that":[35,89,130,150],"need":[36],"to":[37,40,118],"be":[38,119,132],"addressed":[39],"provide":[41,75],"a":[42,146],"qualitatively":[43],"better":[44],"level":[45],"protection":[47],"exfiltration.":[50,86,161],"After":[51],"considering":[52,138],"magnitude":[54],"threat,":[59],"outline":[61],"objectives":[63],"scope":[69],"review.":[72],"then":[74],"an":[76],"extensive":[77],"discussion":[78],"present":[80],"methods":[81],"note":[88],"methodologies":[91],"for":[92,148],"do":[97],"not":[98],"connect":[99],"well":[100],"with":[101,145],"experts,":[103],"both":[104],"as":[105,110],"sources":[106],"knowledge":[108],"partners":[111],"decision-making.":[113],"However,":[114],"human":[115,140,155],"interventions":[116],"continue":[117],"required":[120],"Thus,":[123],"cybersecurity":[124],"applications":[125],"are":[126],"necessarily":[127],"socio-technical":[128],"systems":[129],"cannot":[131],"safely":[133],"efficiently":[135],"operated":[136],"without":[137],"relevant":[139],"factor":[141],"issues.":[142],"conclude":[144],"call":[147],"approaches":[149],"can":[151],"more":[152],"effectively":[153],"integrate":[154],"expertise":[156],"into":[157],"defense":[158]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":3}],"updated_date":"2026-03-08T08:50:53.379069","created_date":"2025-10-10T00:00:00"}