Systems, methods, and media for generating bait information for trap-based defenses

• US 9,356,957 B2
• Filed: 07/23/2014
• Issued: 05/31/2016
• Est. Priority Date: 05/31/2006
• Status: Active Grant

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Keromytis, Angelos D., Stolfo, Salvatore J.
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US14/339,245
• Publication Number:
  US 20140337978A1
• Time in Patent Office: 678 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems, methods, and media for generating bait information for trap-based defenses are provided. In some embodiments, methods for generating bait information for trap-based defenses include: recording historical information of a network; translating the historical information; and generating bait information by tailoring the translated historical information.

Claims

1. A method for generating bait information for trap-based defenses, comprising:

recording, using a hardware processor, data sent over a network;

generating, using the hardware processor, bait information by replacing a portion of the recorded data with altered data such that the bait information is identifiable based on the presence of the altered data;

associating, using the hardware processor, the bait information with the altered data as identifying information of the bait information;

causing, using the hardware processor, the bait information to be sent over the network;

receiving at least a portion of the altered data over the network;

identifying the bait information based on the received altered data; and

identifying a sender of the altered data as a potential attacker.

2. The method of claim 1, further comprising:

causing at least a portion of the bait information to be presented to one or more users;

receiving an evaluation of the bait information from at least a subset of the one or more users; and

scoring the bait information based on the number of users of the subset that correctly identified the bate information as including altered data.

3. The method of claim 1, wherein the data sent over the network comprises a set of in-host behaviors of at least one system in the network.

4. The method of claim 1, wherein the data sent over the network comprises at least one keystroke event.

5. The method of claim 1, wherein causing the bait information to be sent over the network comprises using a surrogate user bot (SUB) using virtualized keyboard and mouse drivers to cause the bait information to be sent from a particular user account.

6. The method of claim 1, wherein the bait information comprises a bait email message having at least one document attached thereto.

7. The method of claim 1, wherein the altered data includes at least one of:

a date;

a username;

a password;

a keyword;

a geographical location; and

a name.

8. The method of claim 1, wherein altering a portion of the recorded data comprises replacing a portion of the recorded data with the altered data.

9. The method of claim 1, wherein altering a portion of the recorded data comprises inserting the altered data into the recorded data.

10. The method of claim 9, wherein inserting the altered data into the recorded data comprises stegenorgraphically inserting the altered data.

11. A system for generating bait information for trap-based defenses, comprising:

a hardware processor that is programmed to;

record data sent over a network;

generate bait information by replacing a portion of the recorded data with altered data such that the bait information is identifiable based on the presence of the altered data;

associate the bait information with the altered data as identifying information of the bait information;

cause the bait information to be sent over the network;

receive at least a portion of the altered data over the network;

identify the bait information based on the received altered data; and

identify a sender of the altered data as a potential attacker.

12. The system of claim 11, wherein the hardware processor is further programmed to:

cause at least a portion of the bait information to be presented to one or more users;

receive an evaluation of the bait information from at least a subset of the one or more users; and

score the bait information based on the number of users of the subset that correctly identified the bate information as including altered data.

13. The system of claim 11, wherein the data sent over the network comprises a set of in-host behaviors of at least one system in the network.

14. The system of claim 11, wherein the data sent over the network comprises at least one keystroke event.

15. The system of claim 11, wherein the hardware processor is further programmed to use a surrogate user bot (SUB) using virtualized keyboard and mouse drivers to cause the bait information to be sent from a particular user account.

16. The system of claim 11, wherein the bait information comprises a bait email message having at least one document attached thereto.

17. The system of claim 11, wherein the altered data includes at least one of:

a date;

a username;

a password;

a keyword;

a geographical location; and

a name.

18. The system of claim 11, wherein altering a portion of the recorded data comprises replacing a portion of the recorded data with the altered data.

19. The system of claim 11, wherein altering a portion of the recorded data comprises inserting the altered data into the recorded data.

20. The system of claim 19, wherein inserting the altered data into the recorded data comprises stegenorgraphically inserting the altered data.

21. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, causes the processor to perform a method for generating bait information for trap-based defenses, the method comprising:

recording data sent over a network;

generating bait information by replacing a portion of the recorded data with altered data such that the bait information is identifiable based on the presence of the altered data;

associating the bait information with the altered data as identifying information of the bait information;

causing the bait information to be sent over the network;

receiving at least a portion of the altered data over the network;

identifying the bait information based on the received altered data; and

identifying a sender of the altered data as a potential attacker.