System and method for creation, deployment and management of augmented attacker map

• US 9,553,885 B2
• Filed: 01/23/2016
• Issued: 01/24/2017
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: illusive networks LTD.
• Original Assignee: illusive networks LTD.
• Inventors: Touboul, Shlomo, Levin, Hanan, Roubach, Stephane, Mischari, Assaf, Ben David, Itai, Avraham, Itay, Ozer, Adi, Kazaz, Chen, Israeli, Ofer, Vingurt, Olga, Gareh, Liad, Grimberg, Israel, Cohen, Cobby, Sultan, Sharon, Kubovsky, Matan
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US15/004,904
• Publication Number:
  US 20160359876A1
• Time in Patent Office: 367 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A network surveillance system including a deception management server within a network, including a deployment module managing and planting decoy attack vectors in network resources, wherein an attack vector is an object in memory or storage of a first resource that may be used to access a second resource, and decoy servers accessible from resources in the network via decoy attack vectors, each decoy server including a forensic alert module causing a real-time forensic application to be transmitted to a destination resource in the network when the decoy server is being accessed by a specific resource in the network via a decoy attack vector, wherein the forensic application, when launched in the destination resource, identifies a process running within the specific resource that is accessing that decoy server, logs the activities performed by the thus-identified process in a forensic report, and transmits the forensic report to the deception management server.

Claims

1. A system for network surveillance to detect attackers, comprising:

a deception management server within a network of resources, comprising;

a deployment processor managing and planting one or more decoy attack vectors in one or more of the resources in the network, wherein an attack vector is an object in memory or storage of a first resource that may be used to access a second resource; and

a notification processor; and

one or more decoy servers accessible from resources in the network, each decoy server comprising a forensic alert processor that issues an alert when a specific resource in the network accesses that decoy server via one or more of the decoy attack vectors planted in that specific resource by said deployment processor, the alert causing said deception management server to transmit a real-time forensic application to the specific resource, wherein the forensic application, when launched in the specific resource, identifies a process running within the specific resource that is accessing that decoy server, logs the activities performed by the thus-identified process in a forensic report, and transmits the forensic report to said deception management server, wherein said notification processor transmits to a notification server a notification that a resource in the network accessed a decoy server, and information in the forensic report provided by the forensic application, in response to said deception management server receiving the forensic report.

2. The system of claim 1, further comprising an event monitor, recognizing an attempt by a first resource in the network to access a second resource in the network via the decoy attack vectors planted by said deployment processor in the first resource, and causing, in response to the recognizing, the real-time forensic application to be transmitted to the first resource.

3. The system of claim 2 wherein said notification processor transmits a notification to the notification server, in response to said deception management server receiving a forensic report from the forensic application running on the first resource.

4. The system of claim 1 wherein said deception management server further comprises a database of attack vectors, and wherein the one or more decoy attack vectors planted by said deployment processor are attack vectors in said database of attack vectors.

5. The system of claim 4, wherein the attack vectors in said database of attack vectors include at least one member of (i) username and password, (ii) username and authentication ticket, (iii) FTP server address, username and password, (iv) database server address, username and password, and (v) SSH server address, username and password.

6. The system of claim 4 further comprising an update server transmitting, from time to time, updated attack vectors to said database of attack vectors.

7. The system of claim 4, wherein the resources in the network are grouped into multiple groups of resources, wherein said deception management server further comprises a database of policies that specify, for each group of resources on the network, one or more decoy attack vectors to plant in that group of resources, from among the attack vectors in said database of attack vectors, and wherein said deployment processor plants the one or more decoy attack vectors in the groups of resources in accordance with the database of policies.

8. The system of claim 1 wherein each decoy server further comprises a tar-pit processor, delaying access to data on the decoy server while a resource accesses that decoy server.

9. A method of network surveillance to detect attackers, comprising:

planting one or more decoy attack vectors in one or more resources in a network of computers, wherein an attack vector is an object in memory or storage of a first resource that may be used to access a second resource;

recognizing that a decoy server in the network is being accessed by a specific resource in the network via one or more of the decoy attack vectors planted in the specific resource by said planting;

causing a real-time forensic application to be transmitted to the specific resource, wherein the forensic application, when launched on the specific resource, is operative to;

identify a process running within the specific resource that is accessing the decoy server;

log the activities performed by the thus-identified process in a forensic report; and

transmit the forensic report to a deception management server; and

transmitting to a notification server a notification that a resource in the network accessed a decoy server, and information in the forensic report provided by the forensic application, in response to the deception management server receiving the forensic report.

10. The method of claim 9 further comprising delaying access to data on the decoy server while the specific resource accesses the decoy server.

11. The method of claim 9 further comprising:

recognizing an attempt by a first resource in the network to access a second resource in the network via one or more of the decoy attack vectors planted in the first resource by said planting; and

causing the real-time forensic application to be transmitted to the first resource, in response to said recognizing.

12. The method of claim 9, wherein the decoy attack vectors include at least one member of (i) username and password, (ii) username and authentication ticket, (iii) FTP server address, username and password, (iv) database server address, username and password, and (v) SSH server address, username and password.

13. A system for network surveillance to detect attackers, the system comprising:

a deception management server within a network of resources that is governed by an access governor that authorizes users to access the resources in the network based on user credentials, the deception management server comprising;

a deployment processor, planting one or more decoy user credentials in one or more of the resources in the network; and

a notification processor; and

a forensic alert processor that issues an alert when said access governor recognizes an attempt by a first resource in the network to access a second resource in the network via one or more of the decoy credentials planted in the first resource by said deployment processor, the alert causing said deception management server to transmit a real-time forensic application to the first resource, wherein the forensic application, when launched in the first resource, identifies a process running within the first resource that is attempting to access the second resource, logs the activities performed by the thus-identified process in a forensic report, and transmits the forensic report to said deception management server,

wherein said notification processor transmits to a notification server a notification that the first resource attempted to access the second resource via decoy credentials, and information in the forensic report provided by the forensic application, in response to said deception management server receiving the forensic report.

14. A method of network surveillance to detect attackers, comprising:

planting one or more decoy user credentials in one or more resources in a network of resources that is governed by an access governor that authorizes users to access the resources in the network based on user credentials;

recognizing an attempt by a first resource in the network to access a second resource in the network via one or more of the decoy user credentials planted in the first resource by said planting;

in response to said recognizing, causing a real-time forensic application to be transmitted to the first resource, wherein the forensic application, when launched, is operative to;

identify a process running within the first resource that is accessing the decoy server;

log the activities performed by the thus-identified process; and

transmit the log to a deception management server; and

transmitting to a notification server a notification that a resource in the network accessed a decoy server, and information in the forensic report provided by the forensic application, in response to the deception management server receiving the forensic report.