Back to results
US 2024/0267409 A1Published application
Cyber clone of a computing entity
AssigneeAdvanced Security Technologies Asia Pte. Ltd.
InventorsVladan TODOROVIC, Danijel SOKOLOVIC
Life of this patent
Estimating the term…
Abstract
A cyber clone of a computing entity stores a request received at the computing entity and a response sent from the computing entity. An external request from an attacker is compared with the recorded request. In response to a match the associated recorded response is sent to the attacker. In response to the external request not matching the recorded request, a false, deceiving response is provided. Alternatively the external request is forwarded to the computing entity, and a live response is forwarded to the attacker. The external request and live response for the current state are optionally stored.
Claims20
A cyber clone of a computing entity comprising:
- a processor;
- and
- a memory storing instructions that when executed by the processor cause the cyber clone to:
- store a plurality of states, each state corresponding to a distinct operating state of the computing entity;
- store for each state in the plurality of states:
- a recorded request received at the computing entity in a corresponding operating state, and
- a recorded response sent from the computing entity and associated with the recorded request,
- receive an external request from an attacker;
- determine an indicator of attack from the external request;
- compare the external request with the recorded request for a current state of the plurality of states;
- in response to the external request matching the recorded request, send the associated recorded response to the attacker;
- in response to the external request not matching the recorded request:
- provide a false, deceiving response, or
- forward the external request to the computing entity,
- receive a live response from the computing entity,
- forward the live response to the attacker, and
- update the current state to a state of the plurality of states based on the external request and the current state.
14 more elements
A computer-implemented method of deceiving an attacker using a cyber clone of a computing entity, the method comprising:
- storing a plurality of states, each state corresponding to a distinct operating state of the computing entity;
- storing for each state:
- a recorded request and its variations received at the computing entity in a corresponding operating state, and
- a recorded response sent from the computing entity associated with the recorded request, receiving an external request from an attacker;
- determining an indicator of attack from the external request;
- comparing the external request with the recorded request for a current state of the plurality of states;
- in response to the external request matching the recorded request, sending the associated recorded response to the attacker;
- in response to the external request not matching the recorded request:
- providing a false, deceiving response, or
- forwarding the external request to the computing entity,
- receiving a live response from the computing entity,
- forwarding the live response to the attacker, and
- updating the current state to a state of the plurality of states based on the external request and the current state.
10 more elements
A system comprising:
- a plurality of computing entities;
- a cyber clone for each computing entity comprising:
- a processor;
- and
- a memory storing instructions that when executed by the processor cause the cyber clone to:
- store a plurality of states, each state corresponding to a distinct operating state of the computing entity;
- store for each state:
- a recorded request received at the computing entity in a corresponding operating state, and
- a recorded response sent from the computing entity and associated with the recorded request,
- receive an external request from an attacker;
- determine an indicator of attack from the external request;
- compare the external request with the recorded request for a current state of the plurality of states;
- in response to the external request matching the recorded request, send the associated recorded response to the attacker;
- in response to the external request not matching the recorded request:
- providing a false, deceiving response, or
- forward the external request to the computing entity,
- receive a live response from the computing entity,
- forward the live response to the attacker
- ;
- and
- update the current state to a state of the plurality of states based on the external request and the current state;
- and
- a server comprising:
- a server processor, and
- a memory storing instructions that when executed by the server processor cause the server to:
- receive the indicators of attack from two or more of the cyber clones;
- determine whether there has been a zero-day attack by correlating the received indicators of attack with historic indicators of attack.
24 more elements
Dependencies are inferred from the claim text.