System and a Method for Identifying Malware Network Activity Using a Decoy Environment

A system for gathering information about malware, comprising:

• a working environment comprising:
• a plurality of working environment servers;
• a plurality of working environment endpoints;
• a working environment network interconnecting said plurality of working environment servers and said plurality of working environment endpoints;
• at least one working environment switch directing traffic within said working environment network;
• and
• at least one working environment router directing traffic between said working environment network and an external network;
• a decoy environment comprising:
• at least one physical machine;
• at least one decoy environment server;
• at least one decoy environment endpoint;
• a decoy environment network interconnecting said at least one physical machine, said at least one decoy environment server and said at least one decoy environment endpoint;
• and
• at least one decoy environment router directing traffic between said decoy environment network and an external network;
• a file directing mechanism, functionally associated with said working environment and with said decoy environment, directing at least some files intended for said working environment to said at least one physical machine of said decoy environment;
• and
• a threat tracking mechanism, functionally associated with said decoy environment, tracking and observing actions triggered by said at least some files in said decoy environment.