Back to results
US 12,432,253 B2Granted
Deceiving attackers accessing network data
AssigneeSentinelOne, Inc.
InventorsVenu Vissamsetty, Anil Gupta, Harinath Vishwanath Ramchetty
Life of this patent
Estimating the term…
Abstract
Endpoints in a network execute a sensor module that intercepts commands to obtain information regarding a remote network resource. The sensor module compares a source of commands to a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server.
Claims20
A computer-implemented method for deceiving a source attempting to access target data, the method comprising:
- configuring, by a computer system, a system call to refer to a detour function;
- receiving, by the computer system from a source, a request to access target data via the system call;
- determining, by the computer system via the detour function, whether the source is sanctioned;
- and
- returning, by the computer system in response to determining that the source is not sanctioned, decoy data to the source, wherein the decoy data is different from the target data, the decoy data configured to mimic the target data,
- wherein the computer system comprises a computer processor and an electronic storage medium.
3 more elements
A system for deceiving a source attempting to access target data, the system comprising:
- one or more computer readable storage devices configured to store a plurality of computer executable instructions;
- and
- one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the system to:
- configure a system call to refer to a detour function;
- receive a request to access target data via the system call;
- determine, via the detour function, whether the source is sanctioned;
- and
- return, in response to determining that the source is not sanctioned, decoy data to the source, wherein the decoy data is different from the target data, the decoy data configured to mimic the target data.
5 more elements
Dependencies are inferred from the claim text.