MANAGING DYNAMIC DECEPTIVE ENVIRONMENTS

• US 20180027016A1
• Filed: 08/17/2017
• Published: 01/25/2018
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: illusive networks LTD.
• Original Assignee: illusive networks LTD.
• Inventors: Touboul, Shlomo, Levin, Hanan, Roubach, Stephane, Mischari, Assaf, Ben David, Itai, Avraham, Itay, Ozer, Adi, Kazaz, Chen, Israeli, Ofer, Vingurt, Olga, Gareh, Liad, Grimberg, Israel, Cohen, Cobby, Sultan, Sharon, Kubovsky, Matan
• Granted Patent: US 9,985,989 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A deception management system to detect attackers within a dynamically changing network of computer resources, including a deployment governor dynamically designating deception policies, each deception policy including names of non-existing web servers, and levels of diversity for planting the names of non-existing web servers in browser histories of web browsers within resources of the network, the levels of diversity specifying how densely the name of each non-existing web server is planted within resources of the network, a deception deployer dynamically planting the names of non-existing web servers in the browser histories of the web browsers in resources in the network, in accordance with the levels of diversity of the current deception policy, and a notification processor transmitting an alert to an administrator of the network in response to an attempt to access one of the non-existing web servers.

Claims

1-20. -20. (canceled)

21. A deception management system (DMS) to detect attackers within a dynamically changing network of computer resources, comprising:

a deployment governor dynamically designating deception policies, each deception policy comprising (i) names of non-existing web servers, and (ii) levels of diversity for planting the names of non-existing web servers in browser histories of web browsers within resources of the network, the levels of diversity specifying how densely the name of each non-existing web server is planted within resources of the network;

a deception deployer dynamically planting the names of non-existing web servers in the browser histories of the web browsers in resources in the network, in accordance with the levels of diversity of the current deception policy; and

a notification processor transmitting an alert to an administrator of the network in response to an attempt to access one of the non-existing web servers.

22. The DMS of claim 21 further comprising a deployment monitor collecting information about the current deployment of names of non-existing web servers in browser histories of web browsers within resources in the network, and presenting this information to an administrator of the network in an interactive way whereby the administrator is able to interactively change the deception policy via said deployment governor.

23. The DMS of claim 21 wherein the network comprises one or more decoy servers accessible from resources in the network via the one or more names of non-existing web servers.

24. The DMS of claim 21, further comprising an attack risk inspector inspecting the network to find names of existing web servers in browser histories of web browsers within resources of the network, and wherein said deployment governor designates deception policies using names of non-existing web servers that resemble the names of existing web servers found by said attack risk inspector.

25. A deception management system (DMS) to detect attackers within a dynamically changing network of computer resources, comprising:

a deployment governor dynamically designating deception policies, each deception policy comprising (i) files containing non-existing usernames and passwords, and (ii) levels of diversity for planting the files containing the non-existing usernames and passwords within resources of the network, the levels of diversity specifying how densely each file containing non-existing usernames and passwords is planted within resources of the network;

a deception deployer dynamically planting the files containing non-existing usernames and passwords in resources in the network, in accordance with the levels of diversity of the current deception policy; and

a notification processor transmitting an alert to an administrator of the network in response to an attempt to user one of the non-existing usernames and passwords.

26. The DMS of claim 25 further comprising a deployment monitor collecting information about the current deployment of files containing non-existing usernames and passwords within resources in the network, and presenting this information to an administrator of the network in an interactive way whereby the administrator is able to interactively change the deception policy via said deployment governor.

27. The DMS of claim 25 wherein the network comprises one or more decoy resources accessible via non-existing usernames and passwords.

28. The DMS of claim 25, further comprising an attack risk inspector inspecting the network to find files containing existing usernames and passwords within resources of the network, and wherein said deployment governor designates deception policies using files containing non-existing usernames and passwords that resemble the files found by said attack risk inspector.