Counter intelligence bot

Patent metadata

Field	Value
Publication number	US-2020028874-A1
Application number	US-201715828643-A
Country	US
Kind code	A1
Filing date	Dec 1, 2017
Priority date	Dec 1, 2017
Publication date	Jan 23, 2020
Grant date	—

Abstract

Techniques are provided that facilitate responding to cyberattacks using counter intelligence (CI) bot technology. In one embodiment, a first system is disclosed that comprises a processor and a memory. The memory can store executable instructions that, when executed by the processor, facilitate performance of operations including receiving a request from a second system requesting assistance in association with a cyberattack on the second system, wherein the request comprises information indicating a type of the cyberattack. The operations further comprise selecting a counter intelligence bot configured to respond to the type of cyberattack, and directing the counter intelligence bot to respond to the cyberattack, wherein the directing comprises enabling the counter intelligence bot to respond to the cyberattack by establishing a gateway with the second system and employing the gateway to intercept and respond to traffic associated with the cyberattack on behalf of the second system.

First claim

What is claimed is:

1 . A first system, comprising:
a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
receiving a request from a second system requesting assistance in association with a cyberattack on the second system, wherein the request comprises information indicating a type of the cyberattack;
selecting a counter intelligence bot configured to respond to the type of cyberattack; and
directing the counter intelligence bot to respond to the cyberattack, wherein the directing comprises enabling the counter intelligence bot to respond to the cyberattack by establishing a gateway with the second system and employing the gateway to intercept and respond to traffic associated with the cyberattack on behalf of the second system.

2 . The first system of claim 1 , wherein the directing comprises enabling the counter intelligence bot to respond to the cyberattack by obtaining intelligence information regarding the cyberattack in association with the employing the gateway to intercept and respond to the traffic.

3 . The first system of claim 2 , wherein the directing comprises enabling the counter intelligence bot to respond to the cyberattack by executing a response that facilitates stopping the cyberattack on the second system.

4 . The first system of claim 3 , wherein, as a result of the executing of the response, the counter intelligence bot is enabled to disable the gateway with the second system and provide the intelligence information to the first system.

5 . The first system of claim 4 , wherein the operations further comprise:
receiving the intelligence information from the counter intelligence bot; and employing the intelligence information to train the counter intelligence bot using a machine learning model.

6 . The first system of claim 3 , wherein the executing of the response is performed after the obtaining the intelligence information.

7 . The first system of claim 3 , wherein the executing of the response is performed in response to detection of a trigger event in association with the obtaining the intelligence information.

8 . The first system of claim 3 , wherein the response comprises powering down the second system.

9 . The first system of claim 3 , wherein the response is selectable based on a type of the second system.

10 . The first system of claim 3 , wherein the response is selectable based on a risk level associated with the second system.

11 . A system, comprising:
a processor; and a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
detecting a cyberattack on the system;
based on the detecting, sending a request to a cyberattack response system requesting assistance in association with responding to the cyberattack, wherein the request comprises information indicating a type of the cyberattack; and
based on receiving the information indicating the type of cyberattack, establishing a gateway using a counter intelligence bot selected by, configured by, and received from the cyberattack response system, wherein the counter intelligence bot has been configured to respond to the cyberattack on behalf of the system.

12 . The system of claim 11 , wherein the counter intelligence bot has been configured to respond to the cyberattack by employing the gateway to intercept and respond to traffic associated with the cyberattack.

13 . The system of claim 12 , wherein the counter intelligence bot has been further configured to respond to the cyberattack by gathering intelligence information regarding the cyberattack in association with the employing the gateway to intercept and respond to the traffic.

14 . The system of claim 13 , wherein the counter intelligence bot has been further configured to respond to the cyberattack by executing a response that facilitates stopping the cyberattack on the system.

15 . The system of claim 14 , wherein the counter intelligence bot has been further configured to disable the gateway with the system and provide the intelligence information to the cyberattack response system.

16 . The system of claim 14 , wherein the counter intelligence bot has been further configured to execute the response after the gathering of the intelligence information.

17 . The system of claim 14 , wherein the counter intelligence bot has been further configured to execute the response based on detection of a trigger event in association with the gathering of the intelligence information.

18 . The system of claim 14 , wherein the response varies based on a type of the system.

19 . A machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
receiving a request from a system requesting assistance in association with a cyberattack on the system, wherein the request comprises information indicating a type of the cyberattack; selecting a counter intelligence bot configured to respond to the type of cyberattack comprising configuring the counter intelligence bot to respond to the cyberattack by establishing a gateway with the system and employing the gateway to intercept and respond to traffic associated with the cyberattack on behalf of the system; and directing the counter intelligence bot to respond to the cyberattack on behalf of the system comprising sending the counter intelligence bot to the system.

20 . The machine-readable storage medium of claim 19 , wherein the configuring the counter intelligence bot further comprises configuring the counter intelligence bot to respond to the cyberattack by obtaining intelligence information regarding the cyberattack in association with the employing the gateway to intercept and respond to the traffic.

Assignees

• At & T Ip I Lp

Inventors

• Lam Yeeling

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title