Loading patent…
AssigneeIllusive Networks Ltd.
InventorsShlomo Touboul, Hanan Levin, Stephane Roubach, Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, Ofer Israeli, Olga Vingurt, Liad Gareh, Israel Grimberg, Cobby Cohen, Sharon Sultan, Matan Kubovsky
Estimating the term…
A method for cyber security, including detecting, by a management server, a breach by an attacker of a resource within a network of resources, predicting, by the management server, an attacker target subnet, based on connections created during the breach, and isolating, by the management server, the target subnet in response to the predicting a target subnet.
A method for cyber security for a network of resources, wherein access to the resources via network connections that extend outside the network is governed by a firewall, the method comprising:
A method for cyber security for a network of resources, wherein access to the resources via network connections that extend outside the network is governed by a firewall, the method comprising:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
Countermeasures against malicious traffic: using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: detecting local…
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
About 9 years 7 months of term left · ends 7 Jun 2036 (estimated)
This application is a non-provisional of U.S. Provisional Application No. 62/172,251, entitled SYSTEM AND METHOD FOR CREATION, DEPLOYMENT AND MANAGEMENT OF AUGMENTED ATTACKER MAP, and filed on Jun. 8, 2015 by inventors Shlomo Touboul, Hanan Levin, Stephane Roubach, Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, Ofer Israeli, Olga Vingurt, Liad Gareh, Israel Grimberg, Cobby Cohen and Sharon Sultan, the contents of which are hereby incorporated herein in their entirety.
This application is a non-provisional of U.S. Provisional Application No. 62/172,253, entitled SYSTEM AND METHOD FOR MULTI-LEVEL DECEPTION MANAGEMENT AND DECEPTION SYSTEM FOR MALICIOUS ACTIONS IN A COMPUTER NETWORK, and filed on Jun. 8, 2015 by inventors Shlomo Touboul, Hanan Levin, Stephane Roubach, Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, Ofer Israeli, Olga Vingurt, Liad Gareh, Israel Grimberg, Cobby Cohen and Sharon Sultan, the contents of which are hereby incorporated herein in their entirety.
This application is a non-provisional of U.S. Provisional Application No. 62/172,255, entitled METHODS AND SYSTEMS TO DETECT, PREDICT AND/OR PREVENT AN ATTACKER'S NEXT ACTION IN A COMPROMISED NETWORK, and filed on Jun. 8, 2015 by inventors Shlomo Touboul, Hanan Levin, Stephane Roubach, Assaf Mischari, Itai Ben David, Itay Avraham, Adi Ozer, Chen Kazaz, Ofer Israeli, Olga Vingurt, Liad Gareh, Israel Grimberg, Cobby Cohen and Sharon Sultan, the contents of which are hereby incorporated herein in their entirety.
The present invention will be more fully understood and appreciated from the following detailed description, taken in conjunction with the drawings in which:
FIG. 1 is a simplified diagram of a prior art enterprise network connected to an external internet;
FIG. 2 is a simplified diagram of an enterprise network with network surveillance, in accordance with an embodiment of the present invention; and
For reference to the figures, the following index of elements and their numerals is provided. Similarly numbered elements represent elements of the same type, but they need not be identical elements.
Table of elements in the FIGURES Element Description 10 Internet 100 enterprise network 110 network computers 120 network servers 130 network switches and routers 140 mobile devices 150 access governor (optional) 252 forensic alert module 160 SIEM server 170 DNS server 180 firewall 200 enterprise network with network surveillance 210 deception management server 211 policy manager 212 deployment module 213 forensic application 220 database of credential types 230 policy database 240 decoy servers 242 forensic alert module 260 update server Elements numbered in the 1000's are operations of flow charts.
In accordance with embodiments of the present invention, systems and methods are provided for responding to breach by an attacker of a resource within an enterprise network, by predicting and preventing the attacker's next actions.