System and a method for identifying malware network activity using a decoy environment

1. A method for identifying malware and for gathering information about identified malware in a decoy environment associated with a working environment, the method comprising:

providing a decoy environment including:

at least one physical machine;

at least one decoy environment server;

at least one decoy environment endpoint;

a decoy environment network interconnecting said at least one physical machine, said at least one decoy environment server and said at least one decoy environment endpoint; and

at least one traffic directing mechanism for directing traffic from an external network to said decoy environment network;

directing at least some files intended for the working environment to said at least one physical machine of said decoy environment;

executing said at least some files directed to said decoy environment on said at least one physical machine of said decoy environment; and

tracking and observing actions triggered by said at least some files in said decoy environment, and

upon receipt of a network request in said decoy environment network, said network request originating from attacking malware running in said decoy environment, generating in said decoy environment network a network response to said network request, the network response mimicking a response that would be made by a network of said working environment, said generating including:

collecting requests made to nodes in said network of said working environment and responses associated therewith in a database, said decoy environment network having access to said database, including collecting at least one of single request-response pairs and sessions of requests and responses;

upon receipt of said network request by said decoy environment network, finding in said database a past request, similar to said received network request; and

from said decoy environment network, providing a response to said received request, said response based on a past response associated with said past request in said database.

2. The method of claim 1 , wherein said collecting comprises maintaining, in said collected requests and responses, a structure of traffic within said network of said organization.

3. The method of claim 1 , wherein said database is dedicated to a specific type of communication or server, and wherein said collected requests and responses relate to said specific type of communication or server.

4. The method of claim 1 , further comprising identifying suspicious files intended for said working environment, and transferring said suspicious files to said traffic directing mechanism for directing to said decoy environment.

5. The method of claim 1 , wherein said directing at least some files comprises directing all files intended for said working environment to said decoy environment.

6. The method of claim 1 , at least one of said at least one decoy environment server and said at least one decoy environment endpoint comprises said at least one physical machine.

7. The method of claim 1 , at least one of said at least one decoy environment server and said at least one decoy environment endpoint comprises a virtual machine.

8. The method of claim 1 , said tracking and observing further comprising providing information about tracked and observed actions triggered by one or more of said at least some files to said working environment.

9. The method of claim 1 , wherein said working environment includes network traffic, and said providing said decoy environment includes providing in said decoy environment network, network traffic mimicking said network traffic in said working environment.

10. The method of claim 1 , wherein said at traffic directing mechanism comprises at least one router.