Potential attack detection based on dummy network traffic

A computerized apparatus having a processor, wherein the computerized apparatus is a server different than a computing device, the processor being adapted to perform the steps of:

• analyzing an activity, wherein the activity is performed in response to a message, wherein the message is transmitted by a first application that is executed by the computing device, wherein the computing device is connected to a computerized network, wherein the first application is configured to transmit the message in order to induce a potential attacker to perform a malicious activity, wherein said analyzing comprises comparing the activity to a predetermined expected activity in response to the message, wherein the message comprises a trackable content, wherein the activity comprises an exploitation of the trackable content, wherein the trackable content comprises identifying information which identify the computing device, wherein the exploitation of the trackable content is indicative of the potential attacker exploiting the content of the message;
• and
• determining, based on the analysis of the activity, that a second application is under a potential attack, wherein said determining comprises retrieving the identifying information and identifying based on the identifying information the computerized device that is under the potential attack;
• whereby an operation of the first application is capable of exposing potential attacks on the second application without monitoring network traffic of the second application.

A computerized apparatus having a processor, the processor being adapted to perform the steps of:

• analyzing an activity, wherein the activity is performed in response to a message, wherein the message is transmitted by a first application that is executed by a computing device, wherein the computing device is connected to a computerized network, wherein the first application is configured to transmit the message in order to induce a potential attacker to perform a malicious activity, wherein said analyzing comprises comparing the activity to a predetermined expected activity in response to the message;
• determining, based on the analysis of the activity, that a second application is under a potential attack;
• whereby an operation of the first application is capable of exposing potential attacks on the second application without monitoring network traffic of the second application;
• and
• updating an unsafe network database based on said determining to indicate that the computerized network is unsafe, wherein the unsafe network database is utilized by one or more computing devices to determine whether the one or more computing devices are connected to a potentially unsafe network.

A method comprising:

• executing, by a computing device, a first application, wherein the computing device is capable of executing one or more additional applications, wherein said executing comprises:
• transmitting, by the first application, a dummy message via a computerized network, wherein the dummy message simulates network traffic of the one or more additional applications;
• receiving, by the first application, a reply message to the dummy message, wherein the reply message is received from the computerized network;
• and
• comparing the reply message with an expected reply message to the dummy message in order to identify a potential attack on the one or more additional applications.

A computerized apparatus having a processor, the processor being adapted to perform the steps of:

• detecting an exploitation of a trackable content, wherein the trackable content is comprised in a dummy message that is transmitted by an application, wherein the application is being executed by a computing device, wherein the dummy message is transmitted via a communication channel, wherein the application is configured to transmit dummy messages in order to induce a potential attacker to exploit trackable content in the dummy messages;
• retrieving identifying information associated with the trackable content, wherein the identifying information comprises identification of the computing device and identification of the communication channel;
• and
• determining that messages transmitted by the computing device via the communication channel are exposed to a potential attacker.

A server having a processor, the server being connected to a network, the processor being adapted to perform the steps of:

• receiving a message, wherein a computing device is connected to the network, wherein the computing device is executing a first application and is capable of executing one or more additional applications, wherein the first application is configured to transmit dummy messages to the server via the network, wherein the dummy messages simulate network traffic of the one or more additional applications, wherein the dummy messages comprise identifying information that identify the computing device;
• determining that the message is an alteration of a dummy message;
• extracting from the message the identifying information;
• and
• outputting a notification of a potential attack to the computing device, wherein the computing device is configured to perform a responsive action in response to the notification.