Cyber security deception system

Patent metadata

Field	Value
Publication number	US-12526314-B2
Application number	US-202218558858-A
Country	US
Kind code	B2
Filing date	May 4, 2022
Priority date	May 5, 2021
Publication date	Jan 13, 2026
Grant date	Jan 13, 2026

Abstract

A cyber security system for protecting a networked system, the cyber security system being implemented on a computer service comprised in or provided in communication with the networked system, the cyber security system being configured to deploy an interactive deception framework configured to interact with an unauthorized entity that has accessed the networked system; the interactive deception being configured to interact with the unauthorized entity by providing artificial components of the networked system; and wherein the security component is configured to dynamically adapt or select the artificial components based on the interaction with the unauthorized entity and/or a characterization of the unauthorized entity.

First claim

The invention claimed is:

1 . A cyber security system comprising a hardware processor and a memory for protecting a networked system, the networked system comprising infrastructure components for operating the networked system, the cyber security system being implemented on a computer service comprising a deception host server, the computer service being configured for in communication with the networked system over a network, the cyber security system being configured to:
deploy an interactive deception framework configured to interact with an unauthorized entity; successively deploy a plurality of real and/or artificial components having increasing or differing difficulty or complexity dependent on a previous artificial component being overcome; provide a narrative to the unauthorized entity, the narrative comprising feedback that guides the unauthorized entity along a pathway through the deception framework, wherein a control system is configured to dynamically adjust the narrative based on at least one or each of: the interaction with the unauthorized entity, characterization of the unauthorized entity and/or one or more properties of the unauthorized entity; the interactive deception framework being configured to interact with the unauthorized entity by providing artificial components in an environment hosted by the deception host server, wherein the artificial components are faux components of the networked system that can be interacted with by unauthorized entities, and configured to report interactions between the artificial components and the unauthorized entity to the control system of the cyber security system implemented on the computer service; and wherein the control system of the cyber security system implemented on the computer service is configured to at least one of: dynamically adapt the real artificial components wherein the dynamic adaption or selection of the real and/or artificial components is dependent on a rate of progress or skill of the unauthorized entity at overcoming previous real and/or artificial components; or to select and deploy further artificial components; based on the interaction with the unauthorized entity and/or a characterization of the unauthorized entity.

2 . The cyber security system of claim 1 , wherein one or more of the artificial components comprise a decoy, the decoy comprising a decoy machine, or virtual machine, a decoy device or virtual device, a decoy webpage, a decoy document, a decoy file, decoy information, a real device operating or configured as a decoy, a real service, computer system or network operating or configured as a decoy, a real operating system operating or configured as a decoy or a real networked node operating or configured as a decoy.

3 . The cyber security system of claim 1 , wherein the narrative comprises providing one or more different artificial components that are provided to the unauthorized entity upon the unauthorized entity completing one or more actions from the pathway involving the artificial component.

4 . The cyber-security system of claim 1 , configured to determine an engagement score based on a number of interactions of the unauthorized entity with the an artificial feature over a period of time; and wherein the cyber-security cyber security system is configured to dynamically adapt or select the artificial components to deploy based at least in part on the determined engagement score.

5 . The cyber security system of claim 1 , configured to characterize the location within the networked system and/or characterize the level of skill or abilities of the unauthorized entity based on the interaction with the unauthorized entity.

6 . The cyber security system of claim 5 , configured to determine an unauthorized attack timeline comprising at least one or more or each of: where and when the unauthorized entity has accessed the networked system and the paths through the networked system taken by the unauthorized entity.

7 . The cyber security system of claim 1 , configured to provide a mirror network as part of the interactive deception work, mirror network being a real or virtual network that mirrors or represents at least part of the networked system.

8 . The cyber security system of claim 7 , wherein the mirror network is configured to monitor activities and operations performed in the mirror network by the unauthorized entity and to determine or characterize the interaction with the unauthorized entity and/or information on skills, abilities and/or strategies of the unauthorized entity.

9 . The cyber security system of claim 1 , comprising a control system that implements a machine learning system that is provided with at least the interactions with the unauthorized entity and/or the characterization of the unauthorized entity as inputs and is configured to provide instructions to dynamically adapt or select the real and/or artificial components and/or dynamically adjust the narrative or pathway based on the interactions with the unauthorized entity and/or the characterization of the unauthorized user entity.

10 . The cyber security system of claim 9 , wherein the artificial intelligence system is configured to identify new attack classes based at least the interactions with the unauthorized entity and/or the characterization of the unauthorized entity.

11 . A cyber security method for protecting a networked system, that comprises network infrastructure components for operating the networked system, the cyber security method comprising:
deploying, at least partly in an environment hosted by a deception host server of a computer service that is configured for communication with the networked system over a network, an interactive deception framework configured to interact with an unauthorized entity accessing or attempting to access the networked system, wherein the interactive deception framework comprises real artificial components in the environment hosted by the deception host server, wherein the artificial components are faux components of the networked system that can be interacted with by the unauthorized entity; successively deploying, at least partly in an environment hosted by a deception host server of the computer service that is configured for communication with the networked system over a network, a plurality of real and/or artificial components having increasing or differing difficulty or complexity dependent on a previous artificial component being overcome; providing, using the computer service that is configured for communication with the networked system over a network, a narrative to the unauthorized entity, the narrative comprising feedback that guides the unauthorized entity along a pathway through the deception framework, wherein a control system of a cyber security system implemented on the computer service and from the artificial components is configured to dynamically adjust the narrative based on at least one or each of: the interaction with the unauthorized entity, characterization of the unauthorized entity and/or one or more properties of the unauthorized entity; receiving, at the control system of the cyber security system implemented on the computer service and from the artificial components, reports of interactions between the artificial components and the unauthorized entity; and dynamically adapting or selecting and deploying, by the control system, the artificial components based at least in part on the interaction with the unauthorized entity and/or a characterization of the unauthorized entity, wherein the dynamic adaption or selection of the real and/or artificial components is dependent on a rate of progress or skill of the unauthorized entity at overcomin

Assignees

• Univ Strathclyde

Inventors

• Bellekens Xavier
• Tachtatzis Christos
• Atkinson Robert
• Andonovic Ivan

Classifications

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title