Methods, systems, and media for baiting inside attackers

A method for providing trap-based defenses, the method comprising:

• generating, using a hardware processor, decoy information based at least in part on actual information in a computing environment, wherein the decoy information is generated to comply with one or more document properties;
• embedding, using the hardware processor, a beacon into the decoy information;
• inserting, using the hardware processor, the decoy information with the embedded beacon into the computing environment, wherein the embedded beacon provides a first indication that the decoy information has been accessed by an attacker and wherein the embedded beacon provides a second indication that differentiates between the decoy information and the actual information, wherein the decoy information is contained in a decoy document, wherein the actual information is contained in an actual document, and wherein the embedded beacon differentiates between the decoy document and the actual document;
• and
• using, using the hardware processor, at least a portion of the embedded beacon and other document data to generate a pattern that is displayed to a user in response to the user accessing the decoy document;
• and
• presenting, using the hardware processor, at an index in response to placing a physical mask over the generated pattern, wherein the physical mask decodes the generated pattern into the index and wherein the index provides an indication as to whether at least a portion of the decoy document contains the decoy information.

A system for providing trap-based defenses, the system comprising:

• a processor that:
• generates decoy information based at least in part on actual information in a computing environment, wherein the decoy information is generated to comply with one or more document properties and wherein the decoy information is contained in a decoy document;
• embeds a beacon that includes code into the decoy document;
• and
• inserts the decoy document with the embedded beacon into the computing environment;
• causes the code embedded within the beacon to be executed;
• and
• causes the executed code to transmit a signal to a remote server in response to detecting that an attacker has accessed the decoy information, wherein the signal provides a first indication that the decoy information has been accessed by the attacker, and wherein the embedded beacon provides a second indication that differentiates between the decoy information and the actual information.

A system for providing trap-based defenses, the system comprising:

• a processor that:
• generates decoy information based at least in part on actual information in a computing environment, wherein the decoy information is generated to comply with one or more document properties;
• embeds a beacon into the decoy information;
• and
• inserts the decoy information with the embedded beacon into the computing environment, wherein the embedded beacon provides a first indication that the decoy information has been accessed by an attacker and wherein the embedded beacon provides a second indication that differentiates between the decoy information and the actual information, wherein the decoy information is contained in a decoy document, wherein the actual information is contained in an actual document, and wherein the embedded beacon differentiates between the decoy document and the actual document;
• uses at least a portion of the embedded beacon and other document data to generate a pattern that is displayed to a user in response to the user accessing the decoy document;
• and
• presents an index in response to placing a physical mask over the generated pattern, wherein the physical mask decodes the generated pattern into the index and wherein the index provides an indication as to whether at least a portion of the decoy document contains the decoy information.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for providing trap-based defenses, the method comprising:

• generating decoy information based at least in part on actual information in a computing environment, wherein the decoy information is generated to comply with one or more document properties and wherein the decoy information is contained in a decoy document;
• embedding a beacon that includes code into the decoy document;
• inserting the decoy document with the embedded beacon into the computing environment;
• causing the code embedded within the beacon to be executed;
• and
• causing the executed code to transmit a signal to a remote server in response to detecting that an attacker has accessed the decoy information, wherein the signal provides a first indication that the decoy information has been accessed by the attacker, and wherein the embedded beacon provides a second indication that differentiates between the decoy information and the actual information.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for providing trap-based defenses, the method comprising:

• generating decoy information based at least in part on actual information in a computing environment, wherein the decoy information is generated to comply with one or more document properties;
• embedding a beacon into the decoy information;
• and
• inserting the decoy information with the embedded beacon into the computing environment, wherein the embedded beacon provides a first indication that the decoy information has been accessed by an attacker and wherein the embedded beacon provides a second indication that differentiates between the decoy information and the actual information, wherein the decoy information is contained in a decoy document, wherein the actual information is contained in an actual document, and wherein the embedded beacon differentiates between the decoy document and the actual document;
• using at least a portion of the embedded beacon and other document data to generate a pattern that is displayed to a user in response to the user accessing the decoy document;
• and
• presenting an index in response to placing a physical mask over the generated pattern, wherein the physical mask decodes the generated pattern into the index and wherein the index provides an indication as to whether at least a portion of the decoy document contains the decoy information.