System and a method for identifying the presence of malware using mini-traps set at network endpoints

1. A system for identifying the presence of advanced persistent threats on a network, comprising:

a plurality of resources, interconnected to form a network;

at least one decoy resource forming part of said network, at least one of said at least one decoy resource comprising a virtual decoy resource;

at least one mini-trap installed on at least one of said plurality of resources and functionally associated with at least one of said at least one decoy resource, said at least one mini-trap comprising deceptive information directing malware accessing said at least one mini-trap to said decoy resource associated therewith, such that said malware proceeds from said at least one mini-trap to said decoy resource associated therewith; and

a manager node forming part of said network and configured to manage placement of said at least one mini-trap on said at least one of said plurality of resources and association between said at least one mini-trap and said decoy resource associated therewith

wherein each of said at least one mini-trap is associated with a unique value, such that when infecting malware accesses one of said at least one mini-trap located on a specific one of said plurality of resources, the mini-trap being accessed is uniquely identified, thereby uniquely identifying the specific resource as being infected.

2. The system of claim 1 , wherein said deceptive information comprises faked credentials.

3. The system of claim 1 , wherein said at least one mini-trap comprises a plurality of mini traps, said at least one decoy resource comprises a plurality of decoy resources, and wherein at least two of said plurality of mini-traps are associated with different ones of said plurality of decoy resources.

4. The system of claim 1 , wherein said at least one mini-trap comprises a plurality of mini traps, and wherein at least two of said plurality of mini-traps are associated with the same one of said at least one decoy resource.

5. The system of claim 1 , wherein said manager node comprises a user interface, allowing a user to configure said network, set up one or more of said at least one mini-trap and of said at least one decoy resource, and gather information from said at least one decoy resource.

6. The system of claim 1 , wherein said network comprises at least two Local Area Networks (LANs), said at least one mini-trap is installed on a resource in a first of said at least two LANs, and said at least one decoy resource associated with said at least one mini-trap is on a second of said at least two LANs.

7. The system of claim 6 , wherein said at least two LANs are geographically distributed.

8. The system of claim 1 , further comprising at least one traffic sniffer functionally associated with said at least one mini-trap, configured to sniff use of said at least one mini-trap and thereby to indicate the presence of infecting malware.

9. A method for identifying the presence of advanced persistent threats on a network including a plurality of resources, the method comprising:

providing at least one decoy resource forming part of the network, at least one of said at least one decoy resource comprising a virtual decoy resource;

installing at least one mini-trap on at least one of said plurality of resources, said at least one mini-trap being functionally associated with at least one of said at least one decoy resource, said at least one mini-trap comprising deceptive information directing malware accessing said at least one mini-trap to said at least one decoy resource associated therewith, such that said malware proceeds from said at least one mini-trap to said decoy resource associated therewith;

associating each of said at least one mini-trap with a unique value, such that when infecting malware accesses one of said at least one mini-trap located on a specific one of said plurality of resources, the mini-trap being accessed is uniquely identified, thereby uniquely identifying the specific resource as being infected;

detecting use of said at least one mini-trap by infecting malware by detecting said unique value associated with said at least one mini-trap, thereby to identify the presence of malware on said at least one of said plurality of resources where said at least one mini-trap is installed; and

managing placement of said at least one mini-trap on said at least one of said plurality of resources and association between said at least one mini-trap and said decoy resources associated therewith.

10. The method of claim 9 , wherein said detecting comprises sniffing use of said at least one mini-trap in traffic in said network.

11. The method of claim 9 , wherein said installing comprises at least one of the following:

planting said at least one mini-trap on said one of said plurality of resources using Active Directory GPO tools;

planting said at least one mini-trap on said one of said plurality of resources using administrator credentials and authorizations;

directly accessing said one of said plurality of resources to plant said at least one mini-trap thereon; and

running agents on said plurality of resources for planting said at least one mini-trap thereon.

12. The method of claim 9 , further comprising periodically updating said functional association between said at least one mini-trap and said at least one decoy resource.