Systems and methods for detecting and tracking adversary trajectory

A network apparatus, comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to:
• deploy a deception mechanism in a network;
• receive a message from the deception mechanism, wherein the message indicates a communication between a device and the deception mechanism;
• identify attack information associated with the device, wherein the attack information includes device information and interaction information corresponding to the device, and wherein the interaction information is related to the communication between the device and the deception mechanism;
• identify the device in an adjacency data structure based on the device information, wherein the adjacency data structure indicates communications between devices in the network;
• generate an attack trajectory data structure from the adjacency data structure, wherein the attack trajectory data structure includes one or more suspect devices that are connected, either directly or indirectly, with the device in the adjacency data structure;
• determine an attack trajectory path in the attack trajectory data structure based on the attack information, wherein the attack trajectory path indicates another device in the network that is included in an attack;
• and
• remove, from the attack trajectory path, an at least partially separate attack trajectory path that has a probability below a threshold.

A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:

• deploy a deception mechanism in a network;
• receive a message from the deception mechanism, wherein the message indicates a communication between a device and the deception mechanism;
• identify attack information associated with the device, wherein the attack information includes device information and interaction information corresponding to the device, and wherein the interaction information is related to the communication between the device and the deception mechanism;
• identify the device in an adjacency data structure based on the device information, wherein the adjacency data structure indicates communications between devices in the network;
• generate an attack trajectory data structure from the adjacency data structure, wherein the attack trajectory data structure includes one or more suspect devices that are connected, either directly or indirectly, with the device in the adjacency data structure;
• determine an attack trajectory path in the attack trajectory data structure based on the attack information, wherein the attack trajectory path indicates another device in the network that is included in an attack;
• and
• remove, from the attack trajectory path, an at least partially separate attack trajectory path that has a probability below a threshold.