System and method for detecting computer network intrusions

A method for managing computer network intrusions, the method comprising:

• configuring, by a host system including at least one processor and a memory, a security device in a network by transmitting configuration parameters to the security device, the security device configured on the network in a distributed manner precluding a direct path from the security device to backend resources, wherein the security device is configured to lay dormant on the private network, detect intrusion events caused by access of the security device, and capture details associated with the intrusion events, and wherein the configuration parameters including instructions for the security device to operate as a given type of network asset;
• monitoring, by the host system, the security device by retrieving and analyzing a heartbeat pulse of the security device, the heartbeat pulse comprising an operational snapshot of the security device including the captured details;
• determining, by the host system, a change in integrity in the security device based on the monitoring;
• sending, by the host system, one or more notification messages to a network administrator based on the determination.

A method for responding to computer network intrusions, the method comprising:

• receiving, by a data processing device including a processor and memory, configuration parameters from a host system, the configuration parameters including instructions for the data processing device to operate as a given type of network asset emulating certain device characteristics and services, the data processing device laying dormant on a network and configured in a distributed manner on the network precluding a direct path from the data processing device to backend resources;
• detecting, by the data processing device, intrusion events caused by access of the data processing device;
• capturing, by the data processing device, details associated with the intrusion events;
• generating, by the data processing device, a heartbeat pulse by creating an operational snapshot of the data processing device including the captured details and transmitting the operational snapshot to the host system;
• detecting, by the data processing device, intrusion events based on the configuration parameters;
• transmitting, by the data processing device, a notification of the intrusion events to the host system;
• determining, by the data processing device, an occurrence of attack associated with the intrusion events;
• and
• initiating, by the data processing device, one or more protective measures.