System and method for generating fictitious content for a computer

• US 20070061883A1
• Filed: 08/18/2006
• Published: 03/15/2007
• Est. Priority Date: 07/14/1999
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Lyle, Michael, Ross, Robert, Maricondo, James
• Granted Patent: US 7,854,005 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A system and method are disclosed for generating fictitious computer file system content. A template is created. A collection of data items available to be inserted into the template is provided. The template is populated with at least one data item from the collection.

Claims

1-24. -24. (canceled)

25. A method for generating fictitious computer file system content, comprising:

creating a plurality of templates;

providing a collection of data items available to be inserted into the templates;

selecting one or more of the templates; and

for each template selected;

automatically selecting at least one data item from the collection; and

populating the template with the at least one data item from the collection.

26. The method of claim 25 wherein the collection of data items comprises one or more names.

27. The method of claim 25 wherein the collection of data items comprises one or more dates.

28. The method of claim 25 wherein at least one template is an e-mail message requiring at least one item of data to be complete.

29. The method of claim 25 wherein at least one template is a word processing document requiring at least one item of data to be complete.

30. The method of claim 25 wherein at least one template is a spreadsheet requiring at least one item of data to be complete.

31. The method of claim 25 wherein for at least one selected template the step of populating comprises receiving a number from a random number generator.

32. The method of claim 31 wherein the random number generator is a pseudo random number generator.

33. The method of claim 32 wherein the pseudo random number generator employs a unique key to generate numbers.

34. The method of claim 25 wherein for at least one selected template the step of populating comprises correlating a random number to an item of data in the collection.

35. The method of claim 25 wherein for at least one selected template the step of populating comprises inserting an item of data into the template.

36. The method of claim 25 further comprising intentionally including at least one spelling error in at least one template.

37. The method of claim 36 wherein a random number is used to determine what the at least spelling error will be.

38. The method of claim 25 further comprising intentionally introducing at least one grammatical error into at least one populated template.

39. The method of claim 25 wherein for at least one selected template, selecting the at least one data item is based at least in part on the relative probability of occurrence of the at least one data item.

40. The method of claim 25 wherein for at least one selected template, selecting the at least one data item is a function of (1) a random number and (2) the relative probability of occurrence of the at least one data item.

41. The method of claim 40 wherein a pseudo random number generator provides the random number.

42. The method of claim 25, further comprising associating a probability of occurrence with each template and wherein selecting one or more of the templates is based at least in part on the associated probability of occurrence.

43. The method of claim 25 wherein at least one template requires that at least two items of data be compatible with one another.

44. The method of claim 25, wherein the collection includes at least one data item that is not fictitious.

45. The method of claim 25, wherein the deception environment is on a server.

46. The method of claim 25, wherein the deception environment is on a PC.

47. The method of claim 25, wherein the deception environment is part of a trap system.

48. A system for generating fictitious computer file system content, comprising:

a processor configured to;

create a plurality of templates;

provide a collection of data items available to be inserted into the templates;

select one or more of the templates; and

for each template selected;

automatically select at least one data item from the collection; and

populate the template with the at least one data item from the collection; and

a memory coupled with the processor, wherein the memory provides the processor with instructions.

49. A computer program product for generating fictitious file system content for a computer, the computer program product being embodied in a computer readable medium and comprising computer instructions for:

creating a plurality of templates;

providing a collection of data items available to be inserted into the templates;

selecting one or more of the templates; and

for each template selected;

automatically selecting at least one data item from the collection; and

populating the template with the at least one data item from the collection.