SYSTEMS, METHODS, AND MEDIA FOR GENERATING BAIT INFORMATION FOR TRAP-BASED DEFENSES

• US 20090241191A1
• Filed: 05/31/2007
• Published: 09/24/2009
• Est. Priority Date: 05/31/2006
• Status: Active Grant

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Keromytis, Angelos D., Stolfo, Salvatore J.
• Granted Patent: US 8,819,825 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems, methods, and media for generating bait information for trap-based defenses are provided. In some embodiments, methods for generating bait information for trap-based defenses include: recording historical information of a network; translating the historical information; and generating bait information by tailoring the translated historical information.

Claims

1. A method for generating bait information for trap-based defenses, comprising:

recording historical information of a network automatically;

translating the historical information automatically; and

generating bait information by tailoring the translated historical information automatically.

2. The method of claim 1, further comprising:

replaying the translated historical information; and

evaluating the translated historical information.

3. The method of claim 1, wherein the historical information of the network comprises a set of in-host behaviors of at least one system in the network.

4. The method of claim 1, wherein the historical information of the network comprises at least one keystroke event.

5. The method of claim 1, further comprising one of:

injecting the bait information into the network;

monitoring the bait information in the network; and

the combination thereof.

6. The method of claim 5, wherein injecting the bait information into the network comprises using a surrogate user bot (SUB).

7. The method of claim 1, wherein the bait information comprises a bait email message having at least one document attached thereto.

8. Computer-readable media containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for generating bait information for trap-based defenses, the method comprising:

recording historical information of a network automatically;

translating the historical information automatically; and

generating bait information by tailoring the translated historical information automatically.

9. The computer-readable media of claim 8, wherein the method further comprises:

replaying the translated historical information; and

evaluating the translated historical information.

10. The computer-readable media of claim 8, wherein the historical information of the network comprises a set of in-host behaviors of at least one system in the network.

11. The computer-readable media of claim 8, wherein the historical information of the network comprises at least one keystroke event.

12. The computer-readable media of claim 8, wherein the method further comprises one of:

injecting the bait information into the network;

monitoring the bait information in the network; and

the combination thereof.

13. The computer-readable media of claim 12, wherein injecting the bait information into the network comprises using a surrogate user bot (SUB).

14. The computer-readable media of claim 8, wherein the bait information comprises a bait email message having at least one document attached thereto.

15. A system for generating bait information for trap-based defenses, the system comprising:

a recording module capable of recording historical information of a network;

a translator capable of translating the historical information; and

a tailoring module capable of generating bait information by tailoring the translated historical information.

16. The system of claim 15, further comprising:

a replay module capable of replaying the translated historical information; and

an evaluation module capable of evaluating the translated historical information.

17. The system of claim 15, wherein the historical information of the network comprises a set of in-host behaviors of at least one system in the network.

18. The system of claim 15, wherein the historical information of the network comprises at least one keystroke event.

19. The system of claim 15, wherein tailoring the translated historical information comprises altering the content of data in the translated historical information.

20. The system of claim 15, further comprising one of:

an injection module capable of injecting the bait information into the network;

a monitoring module capable of monitoring the bait information in the network; and

the combination thereof

21. The system of claim 20, wherein the injection module comprises a surrogate user bot (SUB).

22. The system of claim 15, wherein the bait information comprises a bait email message having at least one document attached thereto.

23. A system for generating bait information for trap-based defenses, the system comprising:

a recording means for recording historical information of a network;

a translator means for translating the historical information; and

a tailor means for generating bait information by tailoring the translated historical information to fit the needs for the network.

24. The system of claim 23, further comprising:

a replaying means for replaying the translated historical information; and

an evaluation means for evaluating the translated historical information.

25. The system of claim 23, wherein the historical information of the network comprises a set of in-host behaviors of at least one system in the network.

26. The system of claim 23, wherein the historical information of the network comprises at least one keystroke event.

27. The system of claim 23, further comprising an injection means for injecting the bait information into the network.

28. The system of claim 23, further comprising a monitoring means for monitoring the bait information in the network.

29. The system of claim 23, wherein the bait information comprises a bait email message having at least one document attached thereto.