System and method for analyzing unauthorized intrusion into a computer network

A computer system, comprising:

• one or more processors, and
• memory storing one or more programs for execution by the one or more processors, the one or more programs including:
• a first fully-functional operating system configured to provide real information of the fully-functional operating system in response to an external scan;
• and
• a monitoring module that (A) is coupled with the first operating system and hidden from an attacker attacking the first operating system, (B) monitors activities in the first operating system, (C) captures data including attack-identifying information based on the activities in the first operating system, and (D) provides captured data including the attack-identifying information to an information processing system that includes an operating system that is separate and distinct from the one or more operating systems of the computer system, wherein the information processing system is configured to generate an attack signature by analyzing the captured data, wherein the monitoring module includes a kernel module that monitors activities in the first operating system, and the kernel module is not included in a kernel module listing of the first operating system and kernel pointers for the kernel module are removed so that the kernel module is hidden from the attacker attacking the first operating system.