Granted Patent B2

US 7,854,005 · App. 11/506,758 · Granted Dec 14, 2010

Abstract

Claims (45)

1. A method for generating fictitious computer file system content for a computer system configured to provide a deception environment in which an intruder is allowed to access at least part of the generated fictitious computer file system content, comprising:

creating a plurality of templates;

providing a collection of data items available to be inserted into the templates, the data items including one or more fictitious user names;

selecting one or more of the templates; and

for each template selected:

automatically, using a computer processor, selecting at least one data item from the collection; and

populating the template with the at least one data item from the collection so as to generate fictitious computer file system content.

2. The method of claim 1 wherein the collection of data items comprises one or more dates.

3. The method of claim 1 wherein at least one template is an e-mail message requiring at least one item of data to be complete.

4. The method of claim 1 wherein at least one template is a word processing document requiring at least one item of data to be complete.

5. The method of claim 1 wherein at least one template is a spreadsheet requiring at least one item of data to be complete.

6. The method of claim 1 wherein for at least one selected template the step of populating comprises receiving a number from a random number generator.

7. The method of claim 6 wherein the random number generator is a pseudo random number generator.

8. The method of claim 7 wherein the pseudo random number generator employs a unique key to generate numbers.

9. The method of claim 1 wherein for at least one selected template the step of populating comprises correlating a random number to an item of data in the collection.

10. The method of claim 1 wherein for at least one selected template the step of populating comprises inserting an item of data into the template.

11. The method of claim 1 further comprising intentionally including at least one spelling error in at least one template.

12. The method of claim 11 wherein a random number is used to determine what the at least spelling error will be.

13. The method of claim 1 further comprising intentionally introducing at least one grammatical error into at least one populated template.

14. The method of claim 1 wherein for at least one selected template, selecting the at least one data item is based at least in part on the relative probability of occurrence of the at least one data item.

15. The method of claim 1 wherein for at least one selected template, selecting the at least one data item is a function of (1) a random number and (2) the relative probability of occurrence of the at least one data item.

16. The method of claim 15 wherein a pseudo random number generator provides the random number.

17. The method of claim 1 , further comprising associating a probability of occurrence with each template and wherein selecting one or more of the templates is based at least in part on the associated probability of occurrence.

18. The method of claim 1 wherein at least one template requires that at least two items of data be compatible with one another.

19. The method of claim 1 , wherein the collection includes at least one data item that is not fictitious.

20. The method of claim 1 , wherein the fictitious computer file system content comprises fictitious computer file system content of a deception environment on a server.

21. The method of claim 1 , wherein the fictitious computer file system content comprises fictitious computer file system content of a deception environment on a PC.

22. The method of claim 1 , wherein the fictitious computer file system content comprises fictitious computer file system content of a deception environment as part of a trap system.

23. A system for generating fictitious computer file system content for a computer system configured to provide a deception environment in which an intruder is allowed to access at least part of the generated fictitious computer file system content, comprising:

a processor configured to:

create a plurality of templates;

provide a collection of data items available to be inserted into the templates, the data items including one or more fictitious user names;

select one or more of the templates; and

for each template selected:

automatically select at least one data item from the collection; and

populate the template with the at least one data item from the collection so as to generate fictitious computer file system content; and

a memory coupled with the processor, wherein the memory provides the processor with instructions.

24. A computer program product for generating fictitious file system content for a computer configured to provide a deception environment in which an intruder is allowed to access at least part of the generated fictitious computer file system content, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

creating a plurality of templates;

providing a collection of data items available to be inserted into the templates, the data items including one or more fictitious user names;

selecting one or more of the templates; and

for each template selected:

automatically selecting at least one data item from the collection; and

populating the template with the at least one data item from the collection so as to generate fictitious computer file system content.

25. The method of claim 1 , wherein the fictitious computer file system content is generated periodically over time in order to provide a more realistic deception environment.

Assignments (8)