Deceiving attackers accessing network data

    公开(公告)号:US11695800B2

    公开(公告)日:2023-07-04

    申请号:US16849813

    申请日:2020-04-15

    CPC classification number: H04L63/1491 H04L41/12 H04L61/4505 H04L61/5007

    Abstract: Endpoints in a network execute a sensor module that intercepts commands. The sensor module compares a source of commands to a sanctioned list of applications received from a management server. If the source does not match a sanctioned application the command is ignored and a simulated acknowledgment is sent or, deception data is returned instead. In some embodiments, certain data is protected such that commands will be ignored or modified to refer to deception data where the source is not a sanctioned application. The source may be verified to be a sanctioned application by evaluating a certificate, hash, or path of the source. Responses from an active directory server may be intercepted and modified to reference a decoy server when not addressed to a sanctioned application. Requests to view network resources may be responded to with references to a decoy server.

Patent Agency Ranking