Counter intelligence bot

Patent metadata

Field	Value
Publication number	US-10785258-B2
Application number	US-201715828643-A
Country	US
Kind code	B2
Filing date	Dec 1, 2017
Priority date	Dec 1, 2017
Publication date	Sep 22, 2020
Grant date	Sep 22, 2020

Abstract

Techniques are provided that facilitate responding to cyberattacks using counter intelligence (CI) bot technology. In one embodiment, a first system is disclosed that comprises a processor and a memory. The memory can store executable instructions that, when executed by the processor, facilitate performance of operations including receiving a request from a second system requesting assistance in association with a cyberattack on the second system, wherein the request comprises information indicating a type of the cyberattack. The operations further comprise selecting a counter intelligence bot configured to respond to the type of cyberattack, and directing the counter intelligence bot to respond to the cyberattack, wherein the directing comprises enabling the counter intelligence bot to respond to the cyberattack by establishing a gateway with the second system and employing the gateway to intercept and respond to traffic associated with the cyberattack on behalf of the second system.

First claim

What is claimed is:

1. A first system, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
receiving a request from a second system requesting assistance in association with a cyberattack on the second system, wherein the request comprises information indicating a type of the cyberattack;
selecting a counter intelligence bot configured to respond to the type of cyberattack using tactics that are tailored to the type of cyberattack, wherein the tactics comprise providing pseudo responses to traffic requests received in association with the cyberattack; and
directing the counter intelligence bot to establish a gateway with the second system and employ the gateway to intercept cyberattack traffic, comprising the traffic requests, and respond to the type of cyberattack as configured.

2. The first system of claim 1 , wherein the counter intelligence bot is further configured to respond to the cyberattack by obtaining intelligence information regarding operations of the cyberattack.

3. The first system of claim 2 , wherein the counter intelligence bot is further configured to respond to the cyberattack by executing a response that facilitates stopping the cyberattack on the second system.

4. The first system of claim 3 , wherein the counter intelligence bot is further configured to disable the gateway with the second system and provide the intelligence information to the first system in response to the executing.

5. The first system of claim 4 , wherein the operations further comprise:
receiving the intelligence information from the counter intelligence bot; and
employing the intelligence information to update the tactics of the counter intelligence bot using machine learning.

6. The first system of claim 3 , wherein the counter intelligence bot is further configured to execute the response after the intelligence information is obtained.

7. The first system of claim 3 , wherein the executing of the response is performed in response to detection of a trigger event in association with the obtaining the intelligence information.

8. The first system of claim 3 , wherein the response comprises powering down the second system.

9. The first system of claim 3 , wherein the response varies based on a type of the second system.

10. The first system of claim 3 , wherein the response is selectable based on a risk level associated with the second system.

11. A system, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
sending a request to a cyberattack response system requesting assistance in association with responding to a cyberattack, wherein the request comprises information indicating a type of the cyberattack; and
establishing a gateway with a counter intelligence bot selected based on the counter intelligence bot being configured to respond to the type of cyberattack using tactics that are tailored to the type of cyberattack, wherein the tactics comprise providing pseudo responses to traffic requests received in association with the cyberattack; and
directing the counter intelligence bot to employ the gateway to intercept cyberattack traffic, comprising the traffic requests, and to respond to the cyberattack as configured.

12. The system of claim 11 , wherein the counter intelligence bot was selected from amongst different counter intelligence bots respectively configured to respond to different types of cyberattacks.

13. The system of claim 12 , wherein the counter intelligence bot is further configured to respond to the cyberattack by gathering intelligence information regarding operations of the cyberattack in association with the employing the gateway to intercept and respond to the traffic.

14. The system of claim 13 , wherein the counter intelligence bot is further configured to respond to the cyberattack by executing a response that facilitates stopping the cyberattack on the system.

15. The system of claim 14 , wherein the counter intelligence bot is further configured to disable the gateway with the system and provide the intelligence information to the cyberattack response system.

16. The system of claim 14 , wherein the counter intelligence bot is further configured to execute the response after the gathering of the intelligence information.

17. The system of claim 14 , wherein the counter intelligence bot is further configured to execute the response based on detection of a trigger event in association with the gathering of the intelligence information.

18. The system of claim 14 , wherein the response varies based on a type of the system.

19. A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
receiving a request from a system requesting assistance in association with a cyberattack on the system, wherein the request comprises information indicating a type of the cyberattack;
configuring a counter intelligence bot to respond to the type of cyberattack by establishing a gateway with the system and employing the gateway to intercept and respond to traffic associated with the cyberattack using responses tailored to the type of cyberattack, wherein the responses comprise providing pseudo responses to traffic requests received in association with the cyberattack; and
directing the counter intelligence bot to establish the gateway and respond to the cyberattack as configured.

20. The non-transitory machine-readable medium of claim 19 , wherein the configuring the counter intelligence bot further comprises configuring the counter intelligence bot to respond to the cyberattack by obtaining intelligence information regarding operations of the cyberattack;
configuring the counter intelligence bot to disable the gateway the gateway after the obtaining the intelligence information; and
configuring the counter intelligence bot to provide the intelligence information to the system.

Assignees

• At & T Ip I Lp

Inventors

• Lam Yeeling

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title