Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network

A system, comprising:

• a processor configured to:
• launch a first virtual clone in a honey network of a target device of a plurality of devices in an enterprise network, wherein a malware sample received from the enterprise network was destined for the target device, and wherein the first virtual clone has one or more attributes that are synchronized with one or more attributes of the target device in the enterprise network so that the malware sample would detect that the first virtual clone has previously observed and/or expected attributes associated with the target device;
• launch a second virtual clone in the honey network of a second device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the second device in the enterprise network that were logged using an agent executed on the target device, wherein the second virtual clone in the honey network is instantiated to emulate the second device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the second virtual clone that corresponds to the second device;
• receive at the honey network the malware sample from the enterprise network, wherein the malware sample includes suspicious content;
• and
• detonate the malware sample in the first virtual clone of a plurality of virtual clones executed in an instrumented VM environment, and wherein one or more activities of the detonated malware sample are monitored in the instrumented VM environment and logged in a honey network log;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.

A method, comprising:

• launching a first virtual clone in a honey network of a target device of a plurality of devices in an enterprise network, wherein a malware sample received from the enterprise network was destined for the target device, and wherein the first virtual clone has one or more attributes that are synchronized with one or more attributes of the target device in the enterprise network so that the malware sample would detect that the first virtual clone has previously observed and/or expected attributes associated with the target device;
• launching a second virtual clone in the honey network of a second device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the second device in the enterprise network that were logged using an agent executed on the target device, wherein the second virtual clone in the honey network is instantiated to emulate the second device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the second virtual clone that corresponds to the second device;
• receiving at the honey network the malware sample from the enterprise network, wherein the malware sample includes suspicious content;
• and
• detonating the malware sample in the first virtual clone of a plurality of virtual clones executed in an instrumented VM environment, and wherein one or more activities of the detonated malware sample are monitored in the instrumented VM environment and logged in a honey network log.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• launching a first virtual clone in a honey network of a target device of a plurality of devices in an enterprise network, wherein a malware sample received from the enterprise network was destined for the target device, and wherein the first virtual clone has one or more attributes that are synchronized with one or more attributes of the target device in the enterprise network so that the malware sample would detect that the first virtual clone has previously observed and/or expected attributes associated with the target device;
• launching a second virtual clone in the honey network of a second device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the second device in the enterprise network that were logged using an agent executed on the target device, wherein the second virtual clone in the honey network is instantiated to emulate the second device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the second virtual clone that corresponds to the second device;
• receiving at the honey network the malware sample from the enterprise network, wherein the malware sample includes suspicious content;
• and
• detonating the malware sample in the first virtual clone of a plurality of virtual clones executed in an instrumented VM environment, and wherein one or more activities of the detonated malware sample are monitored in the instrumented VM environment and logged in a honey network log.