Cognitive Honeypot

Patent metadata

Field	Value
Publication number	US-2016119377-A1
Application number	US-201414521095-A
Country	US
Kind code	A1
Filing date	Oct 22, 2014
Priority date	Oct 22, 2014
Publication date	Apr 28, 2016
Grant date	—

Abstract

An electronic communication evaluating device determines a suspicion level for an initial electronic communication. The initial electronic communication is addressed to an addressed entity that is associated with an electronic communication receiver. In response to the suspicion level exceeding a predetermined level, a communication switching device reroutes the initial electronic communication from the addressed entity to a cognitive honeypot. The cognitive honeypot transmits, to the electronic communication transmitting system, emulation electronic communications that emulate the addressed entity until a predefined state of the communication session occurs.

First claim

What is claimed is:

1 . A method for managing electronic communications, the method comprising:
determining, by an electronic communication evaluating device, a suspicion level for an initial electronic communication, wherein the initial electronic communication is addressed to an addressed entity that is associated with an electronic communication receiver; in response to the suspicion level exceeding a predetermined level, rerouting, by a communication switching device, the initial electronic communication from the addressed entity to a cognitive honeypot; and transmitting, from the cognitive honeypot to an electronic communication transmitting system, emulation electronic communications that emulate the addressed entity until a predefined state of a communication session occurs.

2 . The method of claim 1 , wherein the cognitive honeypot is a natural language question and answer honeypot communication device that determines a legitimacy of the initial electronic communication.

3 . The method of claim 1 , wherein the predefined state is a reduction of the suspicion level to a level that is at or below a predetermined level of untrustworthiness.

4 . The method of claim 1 , wherein the predefined state is a termination of the communication session.

5 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; and in response to receiving no additional responsive electronic communications after a predetermined amount of time, terminating the communication session between the electronic communication transmitting system and the electronic communication receiver.

6 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; determining, by the electronic communication evaluation device, that the suspicion level for the initial electronic communication has dropped below the predetermined level; utilizing, by one or more processors, the responsive electronic communications from the electronic communication transmitting system to identify a new entity that is better suited to handle the initial electronic communication than the addressed entity; and rerouting, by the communication switching device, subsequent electronic communications from the electronic communication transmitting system to the new entity.

7 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; determining, by the electronic communication evaluation device, that the suspicion level for the initial electronic communication has dropped below the predetermined level; and in response to determining that the suspicion level for the initial electronic communication has dropped below the predetermined level, routing subsequent electronic communications from the electronic communication transmitting system to the addressed entity.

8 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; and utilizing, by one or more processors, the responsive electronic communications from the electronic communication transmitting system to modify the cognitive honeypot from emulating a first type of resource to emulating a second type of resource.

9 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; and utilizing, by one or more processors, the responsive electronic communications from the electronic communication transmitting system to modify a communication style of the cognitive honeypot, wherein a modified communication style emulates a communication style of the responsive electronic communications.

10 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; and determining, by one or more processors, traits of the electronic communication transmitting system based on the responsive electronic communications from the electronic communication transmitting system.

11 . The method of claim 1 , further comprising:
receiving, by the electronic communication receiver, responsive electronic communications from the electronic communication transmitting system, wherein the responsive electronic communications are in response to the emulation electronic communications; and determining, by one or more processors, traits of an author of the responsive electronic communications from the electronic communication transmitting system.

12 . The method of claim 1 , further comprising:
examining, by one or more processors, the initial electronic communication for a predetermined phrase; and determining, by one or more processors, the suspicion level based on identifying the predetermined phrase in the initial electronic communication.

13 . The method of claim 1 , wherein the initial electronic communication is a telephone call to a first person, wherein the electronic communication receiver comprises a speech interpreting device and a human voice emulating device, and wherein the method further comprises:
determining, by the speech interpreting device, a subject of the telephone call; determining, by the electronic communication evaluation device, that the subject of the telephone call raises the suspicion level over the predetermined level; and rerouting, by the communication switching device, the telephone call to the human voice emulating device that utilizes the content derived by the cognitive honeypot to mimic a voice of a second person for future voice exchanges with the electronic communication transmitting system.

14 . The method of claim 1 , wherein the initial electronic communication is a telephone call to a person, wherein the electronic communication receiver comprises a speech interpreting device and a human voice emulating device, and wherein the method further comprises:
determining, by the speech interpreting device, a subject of the telephone call; determining, by the electronic communication evaluation device, that the subject of the telephone call raises the suspicion level over the predetermined level; and rerouting, by the communication switching device, the telephone call to the human voice emulating device that mimics a voice of the person using content derived from the cognitive honeypot.

15 . The method of claim 1 , further comprising:
determining, by one or more processors, a level of data storage device usage by the electronic communication transmitting system duri

Assignees

• IBM

Inventors

• Goldberg Itzhack
• Kozloski James R
• Pickover Clifford A
• Sondhi Neil
• Vukovic Maja

Classifications

• H04L67/143

  Termination or inactivation of sessions, e.g. event-controlled end of session · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F40/40

  Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30) · CPC title

• G06F40/20

  Natural language analysis (semantic analysis of natural language G06F40/30) · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title