Adding supplemental data to a security-related query
OwnerAlmog Ohayon, Guy Franco +1inventors
InventorsAlmog Ohayon, Guy Franco, Roi Abutbul
Life of this patent
Estimating the term…
Abstract
Various embodiments are described herein that add supplemental data into security-related query results delivered to an operating system. More specifically, an operating system can submit a security-related query to a directory server (or some other network-accessible database), and then pass results of the security-related query to a local proxy. The local proxy can add supplemental data into the results. For example, the local proxy could add bogus directory information in an effort to obfuscate an attempt to gain access to network data by an unauthorized entity who attempts to penetrate the network by parsing the results of the security-related query.
Claims21
A method for detecting unauthorized access to a computer network, the method comprising:
- installing, by a computer system at a network, a security application;
- executing, by the computer system, the security application, wherein the execution of the security application causes a security-related virtual machine to be initiated at the computer system;
- triggering, by the security-related virtual machine, installation of a local proxy file at the computer system, wherein the local proxy file causes security-related data of a bogus directory to be added to data of a response to a directory enumeration query;
- sending, by the computer system, the directory enumeration query to a directory server;
- receiving, by the computer system and from the directory server, a query-result message that was sent in response to the directory enumeration query;
- adding, by the computer system, the security-related data of the bogus directory to data of the query-result message;
- sending, by the computer system, the security-related data of the bogus directory to another computer;
- and
- executing, by the computer system, a command as part of a security-related response triggered by a message from the directory server that indicates that the directory server received a security-related query that includes a portion of the security-related data of the bogus directory, and that indicates that the security-related query is part of an attempted breach of security of the network.
A method comprising:
- executing, by a computer system, a security-related application, wherein the execution of the security-related application causes a security-related virtual machine to be initiated at the computer system;
- triggering, by the security-related virtual machine, generation of a local control file at the computer system, wherein the local control file causes supplemental data to be added to data of a response to a security-related query;
- sending, by the computer system, the security-related query to a security-related computer system;
- receiving, by the computer system and from the security-related computer system, a query-result message that was sent in response to the security-related query;
- adding, by the computer system, the supplemental data to data of the query-result message;
- sending, by the computer system, the supplemental data to another computer;
- and
- executing, by the computer system, a command as part of a security-related response triggered by a message from the security-related computer system that indicates that the security-related computer system received the security-related query that included a portion of the supplemental data.
A method comprising:
- generating, by a computer system at a network, security-related data at the computer system, wherein the security-related data causes supplemental data to be added to data of a response to a security-related query;
- sending, by the computer system, the security-related query to a security-related computer system;
- receiving, by the computer system and from the security-related computer system, a query-result message that was sent in response to the security-related query;
- and
- adding, by the computer system, the supplemental data to data of the query-result message.
A computer-implemented method, the method comprising:
- causing a deception module to be installed on a computing device within a network;
- receiving, by the computing device, a security-related query;
- sending, by the computing device, the security-related query to a directory server that includes network elements;
- receiving, by the computing device, a response to the security-related query from the directory server;
- adding, by the deception module, supplemental information to the response from the directory server to arrive at a modified query response;
- and
- further processing, by the computing device, the modified query response.
Dependencies are inferred from the claim text.