Systems, methods, and media for generating bait information for trap-based defenses

• US 8,819,825 B2
• Filed: 05/31/2007
• Issued: 08/26/2014
• Est. Priority Date: 05/31/2006
• Status: Expired due to Fees

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Keromytis, Angelos D., Stolfo, Salvatore J.
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US12/302,774
• Publication Number:
  US 20090241191A1
• Time in Patent Office: 2,644 Days
• Field of Search: 726 23- 24
• US Class Current: 726/24
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems, methods, and media for generating bait information for trap-based defenses are provided. In some embodiments, methods for generating bait information for trap-based defenses include: recording historical information of a network; translating the historical information; and generating bait information by tailoring the translated historical information.

Claims

1. A method for generating bait information for trap-based defenses, comprising:

recording, using a hardware processor, data sent over a network;

replacing, using the hardware processor, a portion of the recorded data that includes personal information with altered personal information;

associating, using the hardware processor, the altered personal information with the recorded data as identifying information of the recorded data;

inserting, using the hardware processor, one or more keywords into the recorded data;

generating, using the hardware processor, bait information from the recorded data, wherein the bait information includes both the altered personal information and the one or more keywords inserted into the recorded data; and

causing, using the hardware processor, the bait information, including both the altered personal information and the one or more keywords, to be sent over the network.

2. The method of claim 1, further comprising:

receiving, using the hardware processor, an evaluation of the bait information, wherein the evaluation is based on whether a user correctly identified that at least a portion of the data included in the bait information has the altered personal information or the one or more keywords.

3. The method of claim 1, wherein the data sent over the network comprises a set of in-host behaviors of at least one system in the network.

4. The method of claim 1, wherein the data sent over the network comprises at least one keystroke event.

5. The method of claim 1, further comprising:

monitoring, using the hardware processor, the bait information sent over the network using the associated altered personal information.

6. The method of claim 5, wherein causing the bait information to be sent over the network comprises using a surrogate user bot (SUB) using virtualized keyboard and mouse drivers to cause the bait information to be sent from a particular user account.

7. The method of claim 1, wherein the bait information comprises a bait email message having at least one document attached thereto.

22. The method of claim 1, wherein the personal information comprises authentication credentials.

8. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, causes the processor to perform a method for generating bait information for trap-based defenses, the method comprising:

recording data sent over a network;

replacing a portion of the recorded data that includes personal information with altered personal information;

associating the altered personal information with the recorded data as identifying information of the recorded data;

inserting one or more keywords into the recorded data;

generating bait information from the recorded data, wherein the bait information includes both the altered personal information and the one or more keywords inserted into the recorded data; and

causing, using the hardware processor, the bait information, including both the altered personal information and the one or more keywords, to be sent over the network.

9. The non-transitory computer-readable medium of claim 8, wherein the method further comprises:

receiving an evaluation of the bait information, wherein the evaluation is based on whether a user correctly identified that at least a portion of the data included in the bait information has the altered personal information or the one or more keywords.

10. The non-transitory computer-readable medium of claim 8, wherein the data sent over the network comprises a set of in-host behaviors of at least one system in the network.

11. The non-transitory computer-readable medium of claim 8, wherein the data sent over the network comprises at least one keystroke event.

12. The non-transitory computer-readable medium of claim 8, wherein the method further comprises

monitoring the bait information sent over the network using the associated altered personal information.

13. The non-transitory computer-readable medium of claim 12, wherein causing the bait information to be sent over the network comprises using a surrogate user bot (SUB) using virtualized keyboard and mouse drivers to cause the bait information to be sent from a particular user account.

14. The non-transitory computer-readable medium of claim 8, wherein the bait information comprises a bait email message having at least one document attached thereto.

23. The non-transitory computer-readable medium of claim 8, wherein the personal information comprises authentication credentials.

15. A system for generating bait information for trap-based defenses, the system comprising:

a hardware processor that is programmed to;

record data sent over a network;

replace a portion of the recorded data that includes personal information with altered personal information;

associate the altered personal information with the recorded data as identifying information of the recorded data;

insert one or more keywords into the recorded data;

generate bait information from the recorded data, wherein the bait information includes both the altered personal information and the one or more keywords inserted into the recorded data; and

causing, using the hardware processor, the bait information, including both the altered personal information and the one or more keywords, to be sent over the network.

16. The system of claim 15, wherein the hardware processor is further programmed to:

receive an evaluation of the bait information, wherein the evaluation is based on whether a user correctly identified that at least a portion of the data included in the bait information has the altered personal information or the one or more keywords.

17. The system of claim 15, wherein the data sent over the network comprises a set of in-host behaviors of at least one system in the network.

18. The system of claim 15, wherein the data sent over the network comprises at least one keystroke event.

19. The system of claim 15, wherein the hardware processor is further programmed to:

monitor the bait information sent over the network using the associated altered personal information.

20. The system of claim 19, wherein the hardware processor is further programmed to cause the bait information to be sent over the network using a surrogate user bot (SUB) using virtualized keyboard and mouse drivers to cause the bait information to be sent from a particular user account.

21. The system of claim 15, wherein the bait information comprises a bait email message having at least one document attached thereto.

24. The system of claim 15, wherein the personal information comprises authentication credentials.