Deception system
AssigneeAcalvio Technologies, Inc.
InventorRajendra A. Gopalakrishna
Life of this patent
Estimating the term…
Abstract
Provided are systems, methods, and computer program products for a cyber-vaccination technique. In various implementations, the technique includes determine characteristics of a testing environment. A testing environment can be used to analyze malware programs. The technique can further include configuring a production network device with the characteristics, so that the production network device resembles the testing environment. The production network device is used for network operations, which excludes analyzing malware programs.
Claims20
A method, comprising:
- launching, in a testing environment, a plurality of malware programs, wherein the testing environment is a closed and monitored computing environment in which malware programs can be run and analyzed, wherein the testing environment prevents the malware programs from infecting other network devices, and wherein a malware program from the plurality of malware programs is launched in the testing environment after having infected a first network device;
- identifying a particular malware program from the plurality of malware programs that did not execute when launched in the testing environment;
- determining one or more characteristics of the testing environment that the particular malware program used to determine that the particular malware program was launched in the testing environment;
- and
- configuring a network device on a network with the one or more characteristics, wherein the network device is connected to and communicates with other network devices, and wherein configuring the network device with the one or more characteristics causes the network device to resemble the testing environment.
A network security device, comprising:
- one or more processors;
- and
- a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
- launching, in a testing environment, a plurality of malware programs, wherein the testing environment is a closed and monitored computing environment in which malware programs can be run and analyzed, wherein the testing environment prevents the malware programs from infecting other network devices, and wherein a malware program from the plurality of malware programs is launched in the testing environment after having infected a first network device;
- identifying a particular malware program from the plurality of malware programs that did not execute when launched in the testing environment;
- determining one or more characteristics of the testing environment that the particular malware program used to determine that the particular malware program was launched in the testing environment;
- and
- configuring a network device on a network with the one or more characteristics, wherein the network device is connected to and communicates with other network devices, and wherein configuring the network device with the one or more characteristics causes the network device to resemble the testing environment.
A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:
- launch, in a testing environment, a plurality of malware programs, wherein the testing environment is a closed and monitored computing environment in which malware programs can be run and analyzed, wherein the testing environment prevents the malware programs from infecting other network devices, and wherein a malware program from the plurality of malware programs is launched in the testing environment after having infected a first network device;
- identify a particular malware program from the plurality of malware programs that did not execute when launched in the testing environment;
- determine one or more characteristics of the testing environment that the particular malware program used to determine that the particular malware program was launched in the testing environment;
- and
- configure a network device on a network with the one or more characteristics, wherein the network device is connected to and communicates with other network devices, and wherein configuring the network device with the one or more characteristics causes the network device to resemble the testing environment.
Dependencies are inferred from the claim text.