Flexible Deception Architecture

1 . A computer-implemented method for imitating an application in a deception point comprising:

getting an image for the application;

creating an instance of the application in a container using the image;

receiving a network communication, the network communication including an instruction for the application;

processing the instruction using the instance;

responding to the network communication using the processing; and

monitoring behavior from the processing, the monitoring including intercepting library calls, function calls, messages, and events from the container.

2 . The method of claim 1 , wherein the creating the instance includes:

producing the container using the image;

allocating a filesystem of a host operating system to the container;

adding a read-write layer to the image; and

launching a process specified by the image.

3 . The method of claim 2 , wherein the creating the instance is performed using Docker.

4 . The method of claim 1 further comprising:

when a predetermined amount of time associated with the image has elapsed:

clearing file storage used by the instance; and

resetting the instance.

5 . The method of claim 1 further comprising:

receiving a whitelist of benign behaviors, the benign behaviors including at least one of a Domain Name System (DNS) query, file type, Uniform Resource Locator (URL), and hash of an executable file;

checking the whitelist for the monitored behavior; and

issuing an alert when the monitored behavior is not on the whitelist.

6 . The method of claim 1 , wherein the monitored behavior includes uploading an executable file and the method further comprises:

hashing the uploaded executable file to produce a hash;

retrieving a malware analysis of the uploaded executable file using the hash; and

issuing an alert when the malware analysis indicates the presence of malware.

7 . The method of claim 1 , further comprising:

logging the monitored behavior; and

providing the log to a manager.

8 . The method of claim 1 , wherein the monitored behavior includes at least one of inbound and outbound network connections.

9 . The method of claim 1 , wherein the monitored behavior includes at least one of changing, creating, and removing one or more of a process, file, and directory; memory usage change; and disk usage change.

10 . The method of claim 1 , wherein the monitored behavior includes network bonding of processes.

11 . A system for imitating an application in a deception point comprising:

a hardware processor; and

a memory coupled to the hardware processor, the memory storing instructions executable by the hardware processor to perform a method comprising:

getting an image for the application;

creating an instance of the application in a container using the image;

receiving a network communication, the network communication including an instruction for the application;

processing the instruction using the instance;

responding to the network communication using the processing; and

monitoring behavior from the processing, the monitoring including intercepting library calls, function calls, messages, and events from the container.

12 . The system of claim 11 , wherein the creating the instance includes:

producing the container using the image;

allocating a filesystem of a host operating system to the container;

adding a read-write layer to the image; and

launching a process specified by the image.

13 . The system of claim 12 , wherein the creating the instance is performed using Docker.

14 . The system of claim 1 , wherein the method further comprises:

when a predetermined amount of time associated with the image has elapsed:

clearing file storage used by the instance; and

resetting the instance.

15 . The system of claim 11 , wherein the method further comprises:

receiving a whitelist of benign behaviors, the benign behaviors including at least one of a Domain Name System (DNS) query, file type, Uniform Resource Locator (URL), and hash of an executable file;

checking the whitelist for the monitored behavior; and

issuing an alert when the monitored behavior is not on the whitelist.

16 . The system of claim 11 , wherein the monitored behavior includes uploading an executable file and the method further comprises:

hashing the uploaded executable file to produce a hash;

retrieving a malware analysis of the uploaded executable file using the hash; and

issuing an alert when the malware analysis indicates the presence of malware.

17 . The system of claim 11 , wherein the method further comprises:

logging the monitored behavior; and

providing the log to a manager.

18 . The system of claim 11 , wherein the monitored behavior includes at least one of inbound and outbound network connections.

19 . The system of claim 11 , wherein the monitored behavior includes at least one of changing, creating, and removing one or more of a process, file, and directory; memory usage change; and disk usage change.

20 . A system for imitating an application in a deception point comprising:

a processor;

a memory coupled to the processor, the memory storing instructions executable by the processor to perform a method comprising:

getting an image for the application;

receiving a network communication, the network communication including an instruction for the application; and

responding to the network communication using processing;

means for creating an instance of the application in a container using the image;

means for the processing the instruction using the instance; and

means for monitoring behavior from the processing, the monitoring including intercepting library calls, function calls, messages, and events from the container.