Automatically generating network resource groups and assigning customized decoy policies thereto

• US 9,712,547 B2
• Filed: 06/07/2016
• Issued: 07/18/2017
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: illusive networks LTD.
• Original Assignee: illusive networks LTD.
• Inventors: Touboul, Shlomo, Levin, Hanan, Roubach, Stephane, Mischari, Assaf, Ben David, Itai, Avraham, Itay, Ozer, Adi, Kazaz, Chen, Israeli, Ofer, Vingurt, Olga, Gareh, Liad, Grimberg, Israel, Cohen, Cobby, Sultan, Sharon, Kubovsky, Matan
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US15/175,050
• Publication Number:
  US 20160359905A1
• Time in Patent Office: 406 Days
• Field of Search: 726 1, 726 23, 726 25
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A cyber security system to detect attackers, including a data collector collecting data regarding a network, the data including network resources and users, a learning module analyzing data collected by the network data collector, determining therefrom groupings of the network resources into at least two groups, and assigning a customized decoy policy to each group of resources, wherein a decoy policy for a group of resources includes one or more decoy attack vectors, and one or more resources in the group in which the one or more decoy attack vectors are to be planted, and wherein an attack vector is an object of a first resource that may be used to access or discover a second resource, and a decoy deployer planting, for each group of resources, one or more decoy attack vectors in one or more resources in that group, in accordance with the decoy policy for that group.

Claims

1. A cyber security system to detect attackers within a network of resources, comprising:

circuitry of a network data collector collecting data regarding an enterprise network, the data comprising network computing resources and operating systems of the network computing resources, users and user privileges, installed applications, open ports, previous logged on users, browser histories, vault content and shares, from data sources comprising a directory service, the network resources, knowledge bases comprising firewall logs, and in/out ports of machines;

circuitry of a learning module analyzing the data collected by said network data collector, determining therefrom groupings of the network resources into at least two groups, and assigning a customized decoy policy to each group of resources, wherein a decoy policy for a group of resources comprises one or more decoy lateral attack vectors, and one or more resources in the group in which the one or more decoy lateral attack vectors are to be planted, and wherein each of the one or more decoy lateral attack vectors is an object of a first resource within the network that has a potential to be used by an attacker who discovered the first resource to further discover information regarding a second resource within the network, the second resource being previously undiscovered by the attacker; and

circuitry of a decoy deployer planting, for each group of resources, one or more decoy lateral attack vectors in memory or storage of one or more resources in the group, to implement the decoy policy for the group.

2. The cyber security system of claim 1 wherein the customized decoy policy for a group comprises customized usernames, DNS aliases, and browser histories for that group.

3. The cyber security system of claim 1 wherein none of the at least two groups of resources overlap.

4. The cyber security system of claim 1 wherein some of the at least two groups of resources overlap.

5. A cyber security method for detecting attackers within a network of resources, comprising:

collecting data regarding an enterprise network, the data comprising network computing resources and operating systems of the network computing resources, users and user privileges, installed applications, open ports, previous logged on users, browser histories, vault content and shares, from data sources comprising a directory service, the network resources, knowledge bases comprising firewall logs, and in/out ports of machines;

analyzing the data collected by said collecting data;

determining groupings of the network resources into at least two groups;

assigning a customized decoy policy to each group of resources, wherein a decoy policy for a group of resources comprises one or more decoy lateral attack vectors, and one or more resources in the group in which the one or more decoy lateral attack vectors are to be planted, and wherein each of the one or more decoy lateral attack vectors is an object of a first resource within the network that has a potential to be used by an attacker who discovered the first resource to further discover information regarding a second resource within the network, the second resource being a resource previously undiscovered by the attacker; and

planting, for each group of resources, one or more decoy lateral attack vectors in memory or storage of one or more resources in the group, to implement the decoy policy for the group.

6. The cyber security method of claim 5 wherein said assigning comprises assigning customized usernames, DNS aliases, and browser histories for each group.

7. The cyber security method of claim 5 wherein none of the at least two groups of resources overlap.

8. The cyber security method of claim 5 wherein some of the at least two groups of resources overlap.