Methods and systems for honeyfile creation, deployment, and management

A method of automatically manipulating a lifecycle of a honeyfile on a file system, comprising:

• implementing a learning algorithm on a file system;
• identifying a real file;
• training the learning algorithm by observing temporal events involving the real file;
• training a model with the learning algorithm;
• implementing a user agent on the file system;
• creating a honeyfile on the file system;
• deploying the honeyfile on the file system;
• using the trained model to generate user agent actions;
• evaluating the honeyfile;
• and
• either:
• deleting the honeyfile;
• or
• re-using the trained model to generate user agent actions to automatically modify the honeyfile.

A system for automatically modifying honeyfiles for a file system, comprising:

• a server connected via an electronic communications network to a file system of at least one user device, the server:
• comprising:
• a processor/controller;
• a database including a file set;
• and
• an interface;
• and
• configured to execute the steps of:
• implementing a user agent on a system;
• training models of user behavior on the system, wherein:
• interactions with files are temporal events;
• the temporal events are sampled from a list comprising at least:
• create;
• copy;
• add content;
• delete content;
• and add comment;
• and
• a time between the temporal events is sampled;
• providing simple exclusion rules;
• and
• running the user agent on the trained user behavior model to automatically modify honeyfiles for a file system;
• wherein the modifications to the honeyfiles comprise at least one of:
• creating multiple draft versions of honeyfiles;
• copying files;
• deleting files;
• adding content in files;
• deleting content in files;
• replacing content in files;
• and
• adding comments to files.