Computer-implemented system and method for creating an environment for detecting malicious content

A system comprising:

• a first sensor implemented by a first one or more electronic devices coupled to a host computer network including a plurality of target nodes, the first sensor comprising instructions that, when executed by the first one or more electronic devices, cause the first sensor to:
• generate first network flow records based on first network traffic involving one or more of the plurality of target nodes of the host computer network;
• and
• send the first network flow records to a detection processing pipeline;
• a second sensor implemented by a second one or more electronic devices coupled to a test computer network including a plurality of cloned nodes, wherein the plurality of cloned nodes correspond to at least some of the plurality of target nodes of the host computer network, wherein the test computer network has no network connectivity to the host computer network, and wherein the second sensor comprises instructions that, when executed by the second one or more electronic devices, cause the second sensor to:
• generate second network flow records based on second network traffic involving one or more of the plurality of cloned nodes, the second network traffic including at least one first instance of malicious network traffic;
• and
• send the second network flow records to the detection processing pipeline;
• a detection processing pipeline implemented by a third one or more electronic devices, the detection processing pipeline comprising instructions that, when executed by the third one or more electronic devices, cause the detection processing pipeline to:
• receive the first network flow records from the first sensor and the second network flow records from the second sensor;
• merge the first network flow records and the second network flow records to obtain merged network flow records;
• and
• use the merged network flow records to train at least one model used to identify at least one second instance of malicious network traffic involving one or more of the plurality of target nodes of the host computer network.

A computer-implemented method comprising:

• receiving, from at least one first sensor coupled to a host computer network, first network flow records based on first network traffic involving one or more of a plurality of target nodes of the host computer network;
• receiving, from at least one second sensor coupled to a test computer network, second network flow records based on second network traffic involving one or more of a plurality of cloned nodes of the test computer network, wherein the plurality of cloned nodes correspond to at least some of the plurality of target nodes of the host computer network, wherein the test computer network has no network connectivity to the host computer network, and wherein the second network traffic includes at least one first instance of malicious network traffic;
• merging the first network flow records and the second network flow records to obtain merged network flow records;
• and
• using the merged network flow records to train at least one model used to identify at least one second instance of malicious network traffic involving one or more of the plurality of target nodes of the host computer network.