Systems and methods for generating tripwire files
View Patent ↗A computer-implemented method for generating tripwire files may include (1) generating an initial tripwire file according to an initial tripwire generation calculation, the initial tripwire file configured such that modification of the initial tripwire file triggers investigation of a security breach, (2) generating a subsequent tripwire file according to a subsequent tripwire generation calculation, the subsequent tripwire generation calculation differing from the initial tripwire generation calculation along at least one dimension, (3) receiving automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of a security threat, and (4) adjusting automatic generation of a third tripwire file based on the automated feedback indicating whether at least one of the initial tripwire file and the subsequent tripwire file failed to detect the security threat. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for generating tripwire files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
generating an initial tripwire file according to an initial variant of a tripwire generation algorithm, the initial tripwire file configured such that modification of the initial tripwire file triggers investigation of a security breach;
generating a subsequent tripwire file according to a subsequent variant of the tripwire generation algorithm, the subsequent variant of the tripwire generation algorithm randomly differing from the initial variant of the tripwire generation algorithm along at least one dimension;
receiving automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of a security threat at least in part by:
a backup client receiving an indication from a user to perform a restoration operation; and
the backup client asking the user, in response to receiving the indication from the user to perform the restoration operation, whether the restoration operation is a result of a recent crypto-lock attack; and
adjusting automatic generation of a third tripwire file based on the automated feedback indicating whether at least one of the initial tripwire file and the subsequent tripwire file failed to detect the security threat at least in part by selecting which variant of the tripwire generation algorithm was more effective in protecting against known ransomware exploits.
2. The computer-implemented method of claim 1 , wherein the initial variant of the tripwire generation algorithm and the subsequent variant of the tripwire generation algorithm are polymorphic.
3. The computer-implemented method of claim 1 , wherein the dimension along which the subsequent variant of the tripwire generation algorithm differs from the initial variant of the tripwire generation algorithm comprises at least one of:
a naming convention for naming a corresponding tripwire file;
a size of the corresponding tripwire file; and
a file format for the corresponding tripwire file.
4. The computer-implemented method of claim 1 , wherein receiving automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of the security threat comprises checking, during a backup operation, whether a fingerprint of a corresponding tripwire file on a client device differs from a previously calculated fingerprint of the same tripwire file stored on a backup server.
5. The computer-implemented method of claim 4 , wherein checking whether the fingerprint of the corresponding tripwire file on the client device differs from the previously calculated fingerprint of the same tripwire file stored on the backup server comprises determining that the fingerprint of the corresponding tripwire file on the client device does not differ from the previously calculated fingerprint of the same tripwire file stored on the backup server.
6. The computer-implemented method of claim 5 , further comprising:
detecting the security threat at the client device; and
determining that the corresponding tripwire file failed to enable detection of the security threat.
7. The computer-implemented method of claim 4 , wherein checking whether the fingerprint of the corresponding tripwire file on the client device differs from the previously calculated fingerprint of the same tripwire file stored on the backup server comprises determining that the fingerprint of the corresponding tripwire file on the client device does differ from the previously calculated fingerprint of the same tripwire file stored on the backup server.
8. The computer-implemented method of claim 7 , further comprising:
checking, in response to determining that the fingerprint of the corresponding tripwire file on the client device does differ from the previously calculated fingerprint of the same tripwire file stored on the backup server, for the presence of the security threat at the client device;
detecting the security threat at the client device; and
determining that the corresponding tripwire file enabled detection of the security threat.
9. The computer-implemented method of claim 8 , wherein detecting the security threat at the client device comprises prompting the user at the client device to confirm the presence of the security threat at the client device.
10. The computer-implemented method of claim 1 , wherein generating the initial tripwire file and the subsequent tripwire file comprises performing a nested loop that loops between different values for each variable while looping between different variables used in the tripwire generation algorithm.
11. A system for generating tripwire files, the system comprising:
a generation module, stored in memory, that:
generates an initial tripwire file according to an initial variant of a tripwire generation algorithm, the initial tripwire file configured such that modification of the initial tripwire file triggers investigation of a security breach; and
generates a subsequent tripwire file according to a subsequent variant of the tripwire generation algorithm, the subsequent variant of the tripwire generation algorithm randomly differing from the initial variant of the tripwire generation algorithm along at least one dimension;
a reception module, stored in memory, that receives automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of a security threat at least in part by:
a backup client receiving an indication from a user to perform a restoration operation; and
the backup client asking the user, in response to receiving the indication from the user to perform the restoration operation, whether the restoration operation is a result of a recent crypto-lock attack; and
an adjustment module, stored in memory, that adjusts automatic generation of a third tripwire file based on the automated feedback indicating whether at least one of the initial tripwire file and the subsequent tripwire file failed to detect the security threat at least in part by selecting which variant of the tripwire generation algorithm was more effective in protecting against known ransomware exploits; and
at least one physical processor configured to execute the generation module, the reception module, and the adjustment module.
12. The system of claim 11 , wherein the initial variant of the tripwire generation algorithm and the subsequent variant of the tripwire generation algorithm are polymorphic.
13. The system of claim 11 , wherein the dimension along which the subsequent variant of the tripwire generation algorithm differs from the initial variant of the tripwire generation algorithm comprises at least one of:
a naming convention for naming a corresponding tripwire file;
a size of the corresponding tripwire file; and
a file format for the corresponding tripwire file.
14. The system of claim 11 , wherein the reception module receives automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of the security threat by checking, during a backup operation, whether a fingerprint of a corresponding tripwire file on a client device differs from a previously calculated fingerprint of the same tripwire file stored on a backup server.
15. The system of claim 14 , wherein the reception module checks whether the fingerprint of the corresponding tripwire file on the client device differs from the previously calculated fingerprint of the same tripwire file stored on the backup server by determining that the fingerprint of the corresponding tripwire file on the client device does not differ from the previously calculated fingerprint of the same tripwire file stored on the backup server.
16. The system of claim 15 , wherein the reception module further:
detects the security threat at the client device; and
determines that the corresponding tripwire file failed to enable detection of the security threat.
17. The system of claim 14 , wherein the reception module checks whether the fingerprint of the corresponding tripwire file on the client device differs from the previously calculated fingerprint of the same tripwire file stored on the backup server by determining that the fingerprint of the corresponding tripwire file on the client device does differ from the previously calculated fingerprint of the same tripwire file stored on the backup server.
18. The system of claim 17 , wherein the reception module:
checks, in response to determining that the fingerprint of the corresponding tripwire file on the client device does differ from the previously calculated fingerprint of the same tripwire file stored on the backup server, for the presence of the security threat at the client device;
detects the security threat at the client device; and
determines that the corresponding tripwire file enabled detection of the security threat.
19. The system of claim 18 , wherein the reception module detects the security threat at the client device by prompting the user at the client device to confirm the presence of the security threat at the client device.
20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
generate an initial tripwire file according to an initial variant of a tripwire generation algorithm, the initial tripwire file configured such that modification of the initial tripwire file triggers investigation of a security breach;
generate a subsequent tripwire file according to a subsequent variant of the tripwire generation algorithm, the subsequent variant of the tripwire generation algorithm randomly differing from the initial variant of the tripwire generation algorithm along at least one dimension;
receive automated feedback that indicates whether at least one of the initial tripwire file and the subsequent tripwire file failed to enable detection of a security threat at least in part by:
a backup client receiving an indication from a user to perform a restoration operation; and
the backup client asking the user, in response to receiving the indication from the user to perform the restoration operation, whether the restoration operation is a result of a recent crypto-lock attack; and
adjust automatic generation of a third tripwire file based on the automated feedback indicating whether at least one of the initial tripwire file and the subsequent tripwire file failed to detect the security threat at least in part by selecting which variant of the tripwire generation algorithm was more effective in protecting against known ransomware exploits.