Processing Critical Information in Corporate Networks Based on a Combined Approach of a DLP System with a Botnet Detection System

This paper aims to develop a multi-layered cyber defense concept that combines content-aware data loss prevention and botnet detection. The goal is to provide full visibility into critical data flows in corporate networks, block leakage channels in real time, and maintain an acceptably low false positive rate. To achieve this goal, we synthesize a hybrid monitoring-detection-response-protection architecture and verify its performance in a controlled laboratory environment. As a result of the study, an architecture of six logical nodes was formed. The end station became both a source and a consumer of data; users generated files and network sessions on it. The installed DLP agent successfully classified documents by confidentiality level, recorded actions, and generated events about a possible leak. The deployed botnet sensor timely detected characteristic anomalies in the traffic. Both event streams were consolidated into a single incident console, where they were supplemented with user, device, and data class context. The policy engine then correctly assessed the risk based on adaptive thresholds and made decisions on blocking, encrypting, or logging. The response engine implemented this decision, sent an order to the agent to block or encrypt files, and synchronously set network rules that interrupted the botnet channel. After performing the actions, the system returned confirmation to the console, ensuring a complete audit cycle. The integrated solution correctly processed 97.8% of malicious events, while keeping false positives at 2.2%. The median detection time remained below 0.8 seconds, and full containment of critical data occurred within 1.3 seconds of the attack. The results confirm that correlating botnet behavior with data classification context dramatically reduces noise and speeds up response. By integrating up-to-date DLP platforms with other cybersecurity tools, an organization significantly reduces the likelihood of leakage and maintains the resilience of its information resources in an environment of growing digital threats.