Detecting anomalous communications

The computer-implemented method, wherein detecting the of the intrusion event includes:

• monitoring at least one attribute of the first decoy instance during runtime;
• comparing the at least one attribute to a register of attributes;
• and
• when the at least one attribute is determined to be indicative of an intrusion event based on the comparison of the at least one attribute to the register of attributes, asserting that an intrusion event has been detected.

A device, comprising:

• a communications interface;
• a processor;
• and
• a memory;
• wherein the processor is configured to detect, at a first decoy instance hosted by the device, an intrusion event generated by an intruding instance that is not hosted by the device, to generate an intrusion event trace based on the detected intrusion event, and to transmit the intrusion event trace from the first decoy instance to a first intrusion detection instance that is communicably coupled to the device.

A system, comprising:

• a device, including:
• a communications interface,
• a processor, and
• a memory,
• wherein the processor is configured to detect, at a first decoy instance hosted by the device, an intrusion event generated by an intruding instance that is not hosted by the device, to generate an intrusion event trace based on the detected intrusion event, and to transmit the intrusion event trace from the first decoy instance to an intrusion detection instance that is communicably coupled to the device;
• the intrusion detection system;
• and
• a communications network;
• wherein the device is configured to communicate the intrusion event trace to the intrusion detection system via the communications network.

A non-transitory computer readable medium on which is stored a computer program including machine readable instructions for intrusion detection, the machine readable instructions, when executed by a processor, causing the processor to perform the following steps:

• detecting, at a first decoy instance hosted by an embedded device connected to a communications network, an intrusion event generated by an intruding instance that is not hosted by the embedded device;
• generating an intrusion event trace based on the detected intrusion event;
• and
• transmitting the intrusion event trace from the first decoy instance to a first intrusion detection instance that is communicably coupled to the embedded device.