US 11,777,989 B1Granted

Automated deployment of decoy production networks

AssigneeRaymond James Financial, Inc.

InventorsAl-Nath Tuting, Anthony Latteri, Benjamin Michael Weber, Michael Dylan McKinley

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, methods, and computer-readable media are disclosed for systems and methods for automated deployment of decoy production networks. Example methods may include detecting, by one or more computer processors coupled to memory, an unauthorized user in a production network environment, determining a computer-executable payload associated with the unauthorized user, and initiating a first virtual decoy production network environment. Methods may include causing the computer-executable payload to be executed in the first virtual decoy production network environment, and recording telemetry data associated with execution of the computer-executable payload in the first virtual decoy production network environment.

Claims20

Dependent claims

A method comprising:

detecting, by one or more computer processors coupled to memory, an unauthorized user in a production network environment;
determining a payload associated with the unauthorized user;
initiating a first virtual decoy production network environment;
causing the payload to be executed in the first virtual decoy production network environment;
recording telemetry data associated with execution of the payload in the first virtual decoy production network environment;
determining a request to access an active user directory in the first virtual decoy production network environment;
determining a set of actual active usernames in the production network environment;
determining a set of decoy active usernames based at least in part on the set of actual active usernames, wherein the set of decoy active usernames is the set of actual active usernames;
and
generating the active user directory for access in the first virtual decoy production network environment, wherein the active user directory comprises the set of decoy active usernames.

7 more elements

A system comprising:

memory that stores computer-executable instructions;
and
at least one processor configured to access the memory and execute the computer-executable instructions to:
detect an attempt by an unauthorized user to access a production network environment;
determine a payload associated with the unauthorized user;
initiate a first virtual decoy production network environment;
cause the payload to be executed in the first virtual decoy production network environment;
record telemetry data associated with execution of the payload in the first virtual decoy production network environment;
determine a device identifier associated with the unauthorized user;
and
simulate a power event for the device identifier, wherein the unauthorized user is disconnected from the first virtual decoy production network environment during the power event.

8 more elements

Dependencies are inferred from the claim text.