# US 9,882,929 B1 · Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,929 B1 - Document ID: US9882929B1 - Status: Granted - Kind: B1 - Application number: 14/503,129 - Filed: 2014-09-30 - Granted: 2018-01-30 - Earliest claimed: 2014-09-30 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Taylor Ettema; Huagang Xie - Web page: https://patentgrep.com/patent/US9882929B1 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 21/552: {involving long-term monitoring or reporting} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for dynamic selection and generation of detonation location of suspicious content with a honey network are disclosed. In some embodiments, a system for dynamic selection and generation of detonation location of suspicious content with a honey network includes a virtual machine (VM) instance manager that manages a plurality of virtual clones executed in an instrumented VM environment, in which the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network that emulates a plurality of devices in an enterprise network; and an intelligent malware detonator that detonates a malware sample in at least one of the plurality of virtual clones executed in the instrumented VM environment. ## Claims ### Claim 1 A system for dynamic selection and generation of detonation location of suspicious content with a honey network, comprising: a computer comprising a processor and further comprising: a VM instance launcher executed on the processor that launches a first virtual clone in the honey network of a target device of a plurality of devices in an enterprise network, wherein a malware sample received from the enterprise network was destined for the target device, and wherein the first virtual clone has one or more attributes that are synchronized with one or more attributes of the target device in the enterprise network so that the malware sample would detect that the virtual clone has previously observed and/or expected attributes associated with the target device, and wherein the VM instance launcher executed on the processor dynamically launches a second virtual clone in the honey network of a second device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the second device in the enterprise network that were logged using an agent executed on the target device wherein the second virtual clone in the honey network is instantiated to emulate the second device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the second virtual clone that corresponds to the second device; a virtual machine (VM) instance manager executed on the processor that manages a plurality of virtual clones including the first virtual clone and the second virtual clone executed in an instrumented VM environment, wherein the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network that emulates the plurality of devices including the target device in the enterprise network, and wherein each of the plurality of virtual clones in the honey network have one or more attributes that are synchronized with one or more attributes of a corresponding device of the plurality of devices in the enterprise network; and an intelligent malware detonator executed on the processor that receives at the honey network the malware sample from the enterprise network, wherein the malware sample includes suspicious content, and wherein the malware sample was destined for the targeted device of the plurality of devices in the enterprise network, and the intelligent malware detonator detonates the malware sample in the first virtual clone of the plurality of virtual clones executed in the instrumented VM environment, and wherein one or more activities of the detonated malware sample are monitored in the instrumented VM environment and logged in a honey network log. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the plurality of virtual clones are executed in the instrumented VM environment on a VM server. ### Claim 3 (depends on 1) The system recited in claim 1, wherein in at least one of the plurality of virtual clones is a customized VM image that is executed in the instrumented VM environment. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the suspicious content is downloaded from a web site. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the suspicious content is a malware email. ### Claim 6 (depends on 1) The system recited in claim 1, further comprising: receive an email and determine that the email is a malware email, wherein the suspicious content is the malware email. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the suspicious content is a malware email, further comprising: an email header extractor that extracts a destination email address from the malware email. ### Claim 8 (depends on 1) The system recited in claim 1, wherein the suspicious content is a malware email, and wherein the malware email is associated with a destination email address, further comprising: a user identifier (ID) lookup requester that performs a lookup operation to determine a user ID associated with the destination email address. ### Claim 9 (depends on 1) The system recited in claim 1, wherein the suspicious content is a malware email, wherein the malware email is associated with a destination email address, and wherein the destination email address is associated with a user identifier (ID), further comprising: an IP address lookup requester that determines an IP address associated with the user ID. ### Claim 10 (depends on 1) The system recited in claim 1, wherein the suspicious content is a malware email, wherein the malware email is associated with a destination email address, wherein the destination email address is associated with a user identifier (ID), and wherein the user ID is associated with an IP address, further comprising: a target device identifier that identifies the target device in the enterprise network to clone using the first virtual clone in the honey network based on the IP address. ### Claim 11 A method of dynamic selection and generation of detonation location of suspicious content with a honey network, comprising: launching a first virtual clone in the honey network of a target device of a plurality of devices in an enterprise network, wherein a malware sample received from the enterprise network was destined for the target device, and wherein the first virtual clone has one or more attributes that are synchronized with one or more attributes of the target device in the enterprise network so that the malware sample would detect that the virtual clone has previously observed and/or expected attributes associated with the target device; dynamically launching a second virtual clone in the honey network of a second device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the second device in the enterprise network that were logged using an agent executed on the target device wherein the second virtual clone in the honey network is instantiated to emulate the second device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the second virtual clone that corresponds to the second device; managing a plurality of virtual clones including the first virtual clone and the second virtual clone executed in an instrumented VM environment, wherein the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network that emulates the plurality of devices including the target device in the enterprise network, and wherein each of the plurality of virtual clones in the honey network have one or more attributes that are synchronized with one or more attributes of a corresponding device of the plurality of devices in the enterprise network; receiving at the honey network the malware sample from the enterprise network, wherein the malware sample includes suspicious content, and wherein the malware sample was destined for the targeted device of the plurality of devices in the enterprise network; and detonating the malware sample in the first virtual clone of the plurality of virtual clones executed in the instrumented VM environment, and wherein one or more activities of the detonated malware sample are monitored in the instrumented VM environment and logged in a honey network log. ### Claim 12 (depends on 11) The method of claim 11, wherein the plurality of virtual clones are executed in the instrumented VM environment on a VM server. ### Claim 13 (depends on 11) The method of claim 11, wherein in at least one of the plurality of virtual clones is a customized VM image that is executed in the instrumented VM environment. ### Claim 14 (depends on 11) The method of claim 11, wherein the suspicious content is downloaded from a web site. ### Claim 15 (depends on 11) The method of claim 11, wherein the suspicious content is a malware email. ### Claim 16 A computer program product for dynamic selection and generation of detonation location of suspicious content with a honey network, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: launching a first virtual clone in the honey network of a target device of a plurality of devices in an enterprise network, wherein a malware sample received from the enterprise network was destined for the target device, and wherein the first virtual clone has one or more attributes that are synchronized with one or more attributes of the target device in the enterprise network so that the malware sample would detect that the virtual clone has previously observed and/or expected attributes associated with the target device; dynamically launching a second virtual clone in the honey network of a second device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the second device in the enterprise network that were logged using an agent executed on the target device wherein the second virtual clone in the honey network is instantiated to emulate the second device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the second virtual clone that corresponds to the second device; managing a plurality of virtual clones including the first virtual clone and the second virtual clone executed in an instrumented VM environment, wherein the plurality of virtual clones executed in the instrumented VM environment correspond to the honey network that emulates the plurality of devices including the target device in the enterprise network, and wherein each of the plurality of virtual clones in the honey network have one or more attributes that are synchronized with one or more attributes of a corresponding device of the plurality of devices in the enterprise network; receiving at the honey network the malware sample from the enterprise network, wherein the malware sample includes suspicious content, and wherein the malware sample was destined for the targeted device of the plurality of devices in the enterprise network; and detonating the malware sample in the first virtual clone of the plurality of virtual clones executed in the instrumented VM environment, and wherein one or more activities of the detonated malware sample are monitored in the instrumented VM environment and logged in a honey network log. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein the plurality of virtual clones are executed in the instrumented VM environment on a VM server. ### Claim 18 (depends on 16) The computer program product recited in claim 16, wherein in at least one of the plurality of virtual clones is a customized VM image that is executed in the instrumented VM environment. ### Claim 19 (depends on 16) The computer program product recited in claim 16, wherein the suspicious content is downloaded from a web site. ### Claim 20 (depends on 16) The computer program product recited in claim 16, wherein the suspicious content is a malware email. ### Claim 21 (depends on 1) The system recited in claim 1, wherein the VM instance launcher executed on the processor dynamically launches a third virtual clone in the honey network of a third device of the plurality of devices in the enterprise network based on one or more logged interactions between the target device and the third device in the enterprise network that were logged using the agent executed on the target device wherein the third virtual clone in the honey network is instantiated to emulate the third device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the third virtual clone that corresponds to the second device, wherein the third device corresponds to a printer, a router, a directory server, a DNS server, a file share server, an email server, a web server, or a proxy server in the enterprise network. ### Claim 22 (depends on 1) The system recited in claim 1, wherein the VM instance launcher executed on the processor dynamically launches a third virtual clone in the honey network of a third device of the plurality of devices in the enterprise network based on a requested interaction from the first virtual clone in the honey network to the third device in the enterprise network that were logged using the agent executed on the target device wherein the third virtual clone in the honey network is instantiated to emulate the third device in the enterprise network to facilitate interactions in the honey network between the first virtual clone that corresponds to the target device and the third virtual clone that corresponds to the third device.