Alternate files returned for suspicious processes in a compromised computer network
Methods and systems are presented of presenting false and/or decoy content to an intruder operating on a computer system by obfuscating critical files on a computer storage device with data that directs subsequent infiltration and propagation to designated decoy hosts and decoy applications. Method and systems are provided for selectively presenting different contents to different viewers/users of application resource files for the purpose of preventing the valuable content from being read, tampered with, exfiltrated, or used as a means to perform subsequent attacks on network resources.
1. A computer-implemented method comprising:
monitoring, by a computing device, read requests for data, wherein the read requests are sent from legitimate and illegitimate applications, wherein an application is associated with a security rating related to an attribute of the application, and wherein an illegitimate application has a security rating above a threshold;
detecting a read request for particular data;
determining whether the particular data is important;
intercepting the read request for the particular data when the particular data is determined to be important, wherein the read request for the particular data is intercepted before the particular data is retrieved;
identifying an application that sent the read request for the particular data;
determining the application that sent the read request is illegitimate when a security rating associated with the application is above a threshold;
revising the read request for the particular data into a read request for alternative data when the application is determined to be illegitimate, wherein revising the read request for the particular data causes the alternative data to be retrieved rather than the particular data; and
sending the read request for the alternative data, wherein when the read request for the alternative data is received, the alternative data is retrieved.
2. The method of claim 1 , wherein revising the read request includes:
modifying an identification of the particular data to an identification of the alternative data.
3. The method of claim 1 , wherein revising the read request is based on an attribute of the particular data.
4. The method of claim 1 , wherein the alternative data is generated when the application is determined to be illegitimate.
5. The method of claim 1 , wherein the read requests are monitored by a process installed in a kernel space of the computing device.
6. The method of claim 1 , wherein the alternative data includes identification data to cause an attacker to be identified.
7. A system comprising:
one or more processors; and
a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
monitor read requests for data, wherein the read requests are sent from legitimate and illegitimate applications, wherein an application is associated with a security rating related to an attribute of the application, and wherein an illegitimate application has a security rating above a threshold;
detect a read request for particular data;
determine whether the particular data is important;
intercept the read request for the particular data when the particular data is determined to be important, wherein the read request for the particular data is intercepted before the particular data is retrieved;
identify an application that sent the read request for the particular data;
determine the application that sent the read request is illegitimate when a security rating associated with the application is above a threshold;
revise the read request for the particular data into a read request for alternative data when the application is determined to be illegitimate, wherein revising the read request for the particular data causes the alternative data to be retrieved rather than the particular data; and
send the read request for the alternative data, wherein when the read request for the alternative data is received, the alternative data is retrieved.
8. The system of claim 7 , wherein revising the read request includes:
modifying an identification of the particular data to an identification of the alternative data.
9. The system of claim 7 , wherein revising the read request is based on an attribute of the particular data.
10. The system of claim 7 , wherein the alternative data is generated when the application is determined to be illegitimate.
11. The system of claim 7 , wherein the read requests are monitored by a process installed in a kernel space of the system.
12. The system of claim 7 , wherein the alternative data includes identification data to cause an attacker to be identified.
13. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by the one or more processors, cause the one or more processors to:
monitor, by a computing device, read requests for data, wherein the read requests are sent from legitimate and illegitimate applications, wherein an application is associated with a security rating related to an attribute of the application, and wherein an illegitimate application has a security rating above a threshold;
detect a read request for particular data;
determine whether the particular data is important;
intercept the read request for the particular data when the particular data is determined to be important, wherein the read request for the particular data is intercepted before the particular data is retrieved;
identify an application that sent the read request for the particular data;
determine the application that sent the read request is illegitimate when a security rating associated with the application is above a threshold;
revise the read request for the particular data into a read request for alternative data when the application is determined to be illegitimate, wherein revising the read request for the particular data causes the alternative data to be retrieved rather than the particular data; and
send the read request for the alternative data, wherein when the read request for the alternative data is received, the alternative data is retrieved.
14. The computer-program product of claim 7 , wherein revising the read request includes:
modifying an identification of the particular data to an identification of the alternative data.
15. The computer-program product of claim 7 , wherein revising the read request is based on an attribute of the particular data.
16. The computer-program product of claim 7 , wherein the alternative data is generated when the application is determined to be illegitimate.
17. The computer-program product of claim 7 , wherein the read requests are monitored by a process installed in a kernel space of the computing device.