Systems, methods, and media for generating bait information for trap-based defenses

#The disclosed subject matter relates to systems, methods, and media for generating bait information for trap-based defenses

#The increasing prevalence and sophistication of malicious software, also referred to as malware, such as rootkits and spyware, have become first-order threats to the computer system and network security. For example, spyware having the rootkit's ability to conceal its presence can wreak havoc on the computer system and network security.

#A rootkit refers to a set of software tools that are used to conceal the presence of running processes, files, and/or system data, such as network connections, memory addresses, and registry entries, from programs used by system administrators. Spyware refers to a large class of software capable of covertly monitoring a system or a network, and transmitting data collected therefrom to third parties. Spyware encompasses network sniffers and keystroke and password loggers.

#FIG. 1 is a schematic diagram of a system for generating bait information for trap-based defenses in accordance with some embodiments of the disclosed subject matter.

#FIG. 2 is a simple illustration of a method for generating bait information for trap-based defenses in accordance with some embodiments of the disclosed subject matter.

#FIG. 3 is a simple illustration of a method for transforming original information to bait information in accordance with some embodiments of the disclosed subject matter.

#Systems, methods, and media for generating bait information for trap-based defenses are provided. The trap-based defense refers to a proactive defense mechanism that is based on counter-intelligence principles. Whereas the purely preventive defense mechanisms focus on preventing the malware from infiltrating into a network, the trap-based defense focuses on detecting and deceiving the malware that has already succeeded in infiltrating into the network. Traps are set up to attract the malware's attention in order to detect its presence, identify its hideout, feed it with bogus information, and/or destroy it. For example, a stream of bait information, referred to as bait traffic, can be used to attract the malware, such as network sniffers.

#In some embodiments of the disclosed subject matter, systems, methods, and media are provided for crafting a stream of bait information by injecting bait information generated using real system events and network traffic that have been recorded. Bait information refers to any data that is designed to lure the malware's attention. A user or host behavior at the level of network flows, application use, and keystroke dynamics can be modeled to generate seemingly valid but booby-trapped bait information. The bait information, in turn, can be used to set up trap-based defenses based on proactive deception to complement the filtering-based reactive defense.

#Bait traffic, which can be modeled after legitimate data flows and events, can steer malware that is seeking to make use of bait information towards decoy systems. The decoy systems, in turn, can help discover the identity of compromised systems or internal intruders (e.g., rogue users) in a network. In some embodiments, however, the decoy systems are designed to defer making public the identity of a user suspected of conducting unauthorized activities until sufficient evidence connecting the user with the suspected activities is collected. This additional step, referred to as privacy preservation, is to ensure that no user is falsely accused of conducting unauthorized activities.