Back to results
US 12,418,565 B2Granted
Deceiving attackers accessing network data
AssigneeSentinelOne, Inc.
InventorsVenu Vissamsetty, Anil Gupta, Harinath Vishwanath Ramchetty
Life of this patent
Estimating the term…
Abstract
Endpoints in a network execute a sensor module that intercepts responses from a directory service to a source on the endpoint. The sensor module determines if the source is sanctioned, such as by referencing a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server.
Claims20
A method performed by a computer system, the method comprising:
- configuring, by a computer system, a system call to refer to a function;
- intercepting a first response from a directory service to a source on the computer system before the first response is returned to the source, wherein the first response is a response to a request for network data received by the directory service, wherein the request for network data originates from the source on the computer system, wherein the request includes the system call;
- determining, by the computer system via the function, that the source on the computer system is not sanctioned by comparing the source to a list of sanctioned applications;
- in response to determining that the source is not sanctioned, generating, via the function, a simulated response comprising deception data and information regarding a decoy server;
- and
- returning the simulated response to the source on the computer system.
3 more elements
A computer system comprising:
- one or more processing devices;
- and
- one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code that, when executed by the one or more processing devices, causes the one or more processing devices to:
- configure, by a computer system, a system call to refer to a function;
- intercept a first response from a directory service to a source on the computer system before the first response is returned to the source, wherein the first response is a response to a request for network data received by the directory service, wherein the request for network data originates from the source on the computer system, wherein the request includes the system call;
- determine, by the computer system via the function, that the source on the computer system is not sanctioned by comparing the source to a list of sanctioned applications;
- in response to determining that the source is not sanctioned, generate, via the function, a simulated response comprising deception data and information regarding a decoy server;
- and
- return the simulated response to the source on the computer system.
6 more elements
A non-transient computer readable medium containing program instructions for causing a computer system to perform the steps of:
- configuring, by a computer system, a system call to refer to a function;
- intercepting a first response from a directory service to a source on the computer system before the first response is returned to the source, wherein the first response is a response to a request for network data received by the directory service, wherein the request for network data originates from the source on the computer system, wherein the request includes the system call;
- determining, by the computer system via the function, that the source on the computer system is not sanctioned by comparing the source to a list of sanctioned applications;
- in response to determining that the source is not sanctioned, generating, via the function, a simulated response comprising deception data and information regarding a decoy server;
- and
- returning the simulated response to the source on the computer system.
3 more elements
Dependencies are inferred from the claim text.