Method and apparatus for preventing and analyzing network intrusion

A network device for preventing network intrusion to a network, the network device comprising:

• a network interface module configured to receive signals from entities and transmit signals to the entities;
• a plurality of net liar modules, each net liar module operating independently in a sub-network of the network, each net liar module that comprises:
• a trust determination module configured to determine that an entity is not trusted based on an initial communication from the entity, wherein said determination can be based on (i) the entity missing from a trust list or (ii) discovering a flag of a packet turned on which is normally turned off, the packet being included in the initial communication;
• and
• a disinformation controller module configured to control the network interface module to transmit a first disinformation in place of a real information of the network device to misguide the entity and control the network interface module to transmit signals that are indicative of the first disinformation in a consistent manner within a first time window;
• and
• a net liar management module configured to manage the plurality of net liar modules and made the first disinformation congruent over the sub-network such that the first disinformation and any other disinformation transmitted by another of the net liar modules do not contradict each other.

A non-transitory computer readable medium storing program instructions for causing a processor to execute operations for preventing network intrusion to a network, the operations comprising:

• receiving by a network device an initial communication from an entity;
• determining the entity is not trusted based on the initial communication, wherein said determining can be based on (i) the entity missing from a trust list or (ii) discovering a flag of a packet turned on which is normally turned off, the packet being included in the initial communication;
• transmitting a first disinformation in place of a real information of the network device to misguide the entity by one of a plurality of net liar modules, each net liar module operating independently in a sub-network of the network, wherein the first disinformation is made congruent over the sub-network by a net liar management module configured to manage the plurality of net liar modules such that the first disinformation and any other disinformation transmitted by another of the net liar modules do not contradict each other;
• and
• transmitting signals that are indicative of the first disinformation to hide the real information of the network device in a consistent manner within a first time window.