Using decoys by a data loss prevention system to protect against unscripted activity
AssigneeSymantec Corporation
InventorDarren Shou
Life of this patent
Estimating the term…
Abstract
A computing device executing a data loss prevention (DLP) system tracks bait data on at least one of the computing device or a network. The DLP system identifies a potential security threat in response to detecting unscripted activity associated with the bait data. The DLP system performs an action in response to identifying the potential security threat.
Claims19
A computer-implemented method comprising:
- tracking, by a hardware processing device executing a data loss prevention (DLP) system, initial bait data on at least one of a host computing device or a network to which the host computing device is connected, wherein the initial bait data is generated from training data, and wherein the initial bait data comprises at least a modified portion of the training data that is related to the initial bait data;
- identifying one or more properties of the initial bait data within one or more incident reports for a potential security threat;
- generating, from the training data, additional bait data that has the one or more properties of the initial bait data in response to detecting unscripted activity associated with the initial bait data committed by the potential security threat, wherein the additional bait data comprises at least a modified portion of the training data that is related to the additional bait data, and wherein the initial bait data and the additional bait data comprise at least one of decoy stored data or decoy input data;
- and
- making the additional bait data available to the potential security threat.
A non-transitory computer readable storage medium including instructions that, when executed by a hardware processing device, cause the processing device to perform operations comprising:
- tracking, by the hardware processing device executing a data loss prevention (DLP) system, initial bait data on at least one of a host computing device or a network to which the host computing device is connected, wherein the initial bait data is generated from training data, and wherein the initial bait data comprises at least a modified portion of the training data that is related to the initial bait data;
- identifying one or more properties of the initial bait data within one or more incident reports for a potential security threat;
- generating, from the training data, additional bait data that has the one or more properties of the initial bait data in response to detecting unscripted activity associated with the initial bait data committed by the potential security threat, wherein the additional bait data comprises at least a modified portion of the training data that is related to the additional bait data, and wherein the initial bait data and the additional bait data comprise at least one of decoy stored data or decoy input data;
- and
- making the additional bait data available to the potential security threat.
The non-transitory computer readable storage medium 9, wherein the network traffic includes decoy network traffic that is generated by a plurality of endpoints on the network in accordance with one or more deception scripts, and wherein detecting the unscripted activity comprises detecting the unscripted activity in at least one of the decoy network traffic or the initial bait data to or from at least one of the endpoints.
A computing device comprising:
- a memory to store instructions for a data loss prevention (DLP) system;
- and
- a hardware processing device, connected to the memory, to execute the instructions to:
- track initial bait data on at least one of a host computing device or a network to which the host computing device is connected, wherein the initial bait data is generated from training data, and wherein the initial bait data comprises at least a modified portion of the training data that is related to the initial bait data;
- identify one or more properties of the initial bait data within one or more incident reports for a potential security threat;
- generate, from the training data, additional bait data that has the one or more properties of the initial bait data in response to detecting unscripted activity associated with the initial bait data committed by the potential security threat, wherein the additional bait data comprises at least a modified portion of the training data that is related to the additional bait data, and wherein the initial bait data and the additional bait data comprise at least one of decoy stored data or decoy input data;
- and
- make the additional bait data available to the potential security threat.
Dependencies are inferred from the claim text.