Cyber Attack Disruption Through Multiple Detonations of Received Payloads

A method comprising:

• connecting a local computer system to a network;
• coupling a security system to the local computer system, the security system comprising a security controller and a decoy environment operationally isolated from the local computer system;
• receiving a payload from an external source;
• copying the received payload to a first memory in the decoy environment and to a second memory of a user computer of the local computer system;
• repetitively detonating the payload a plurality of times within the decoy environment, wherein the payload includes a malicious component from an attacking party configured to generate a callback communication to the attacking party, and the repetitive detonation of the payload a plurality of times generates multiple decoy callback communications which are transmitted to the attacking party across the network in accordance with a predetermined detonation profile in which different numbers of detonations are carried out over a succession of equal elapsed time periods;
• and
• using the user computer to activate the received payload which generates an authentic callback communication which is also transmitted to the attacking party across the network in conjunction with the decoy callback communications, the authentic callback communication transmitted during an intermediate one of the equal elapsed time periods.

A method comprising:

• using a local network accessible device to receive a payload transmitted across a computer network, the local network accessible device comprising a processor, an associated memory and a decoy environment;
• copying the received payload to the decoy environment and to the associated memory;
• and
• repetitively detonating, within the decoy environment, the copied payload a plurality of times while concurrently activating, within the associated memory, the copied payload at least once,
• wherein the received payload includes a malicious component from an attacking party configured to carry out a malicious action responsive to activation of the payload,
• wherein the malicious action is carried out responsive to both the detonating of the copied payload within the decoy environment and activating of the copied payload within the associated memory,
• wherein the malicious action comprises generating a callback communication to the attacking party,
• wherein the detonation of the copied payload in the decoy environment said plurality of times in succession generates a corresponding plurality of decoy callback communications that are transferred across the network to the attacking party, and
• wherein the activation of the copied payload in the associated memory generates at least one authentic callback communication that is transferred across the network to the attacking party during the continued transfer of said decoy callback communications so that the at least one authentic callback communication is masked within said decoy callback communications.