Testing environment cyber vaccine
Provided are systems, methods, and computer program products for a cyber-vaccination technique. In various implementations, the technique includes determine characteristics of a testing environment. A testing environment can be used to analyze malware programs. The technique can further include configuring a production network device with the characteristics, so that the production network device resembles the testing environment. The production network device is used for network operations, which excludes analyzing malware programs.
1. A method, comprising:
launching, in a testing environment, a plurality of malware programs, wherein the testing environment is a closed and monitored computing environment in which malware programs can be run and analyzed, wherein the testing environment prevents the malware programs from infecting other network devices, and wherein a malware program from the plurality of malware programs is launched in the testing environment after having infected a first network device;
identifying a particular malware program from the plurality of malware programs that did not execute when launched in the testing environment;
determining one or more characteristics of the testing environment that the particular malware program used to determine that the particular malware program was launched in the testing environment; and
configuring a network device on a network with the one or more characteristics, wherein the network device is connected to and communicates with other network devices, and wherein configuring the network device with the one or more characteristics causes the network device to resemble the testing environment.
2. The method of claim 1 , wherein the testing environment includes a virtual machine.
3. The method of claim 1 , wherein the one or more characteristics include a process associated with a virtual machine.
4. The method of claim 1 , wherein the one or more characteristics include a particular Media Access Control (MAC) address.
5. The method of claim 1 , wherein the one or more characteristics include an entry in a system registry.
6. The method of claim 1 , wherein the one or more characteristics include one or more of a structure or content of a file system.
7. The method of claim 1 , wherein the one or more characteristics include an execution path of a process associated with the testing environment.
8. The method of claim 1 , further comprising:
automatically distributing the one or more characteristics to one or more other network devices.
9. The method of claim 1 , wherein the one or more characteristics include hardware identifiers, software programs, or data.
10. The method of claim 1 , wherein configuring the network device includes modifying an operation of a program running on the network device.
11. The method of claim 1 , wherein configuring the network device includes starting a virtual device on the network device.
12. A network security device, comprising:
one or more processors; and
a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
launching, in a testing environment, a plurality of malware programs wherein the testing environment is a closed and monitored computing environment in which malware programs can be run and analyzed, wherein the testing environment prevents the malware programs from infecting other network devices, and wherein a malware program from the plurality of malware programs is launched in the testing environment after having infected a first network device;
identifying a particular malware program from the plurality of malware programs that did not execute when launched in the testing environment;
determining one or more characteristics of the testing environment that the particular malware program used to determine that the particular malware program was launched in the testing environment; and
configuring a network device on a network with the one or more characteristics, wherein the network device is connected to and communicates with other network devices, and wherein configuring the network device with the one or more characteristics causes the network device to resemble the testing environment.
13. The network device of claim 12 , wherein the testing environment includes a virtual machine.
14. The network device of claim 12 , wherein the non-transitory computer-readable medium further comprises instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
automatically distributing the one or more characteristics to one or more other network devices.
15. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors, cause the one or more processors to:
launch, in a testing environment, a plurality of malware programs, wherein the testing environment is a closed and monitored computing environment in which malware programs can be run and analyzed, wherein the testing environment prevents the malware programs from infecting other network devices, and wherein a malware program from the plurality of malware programs is launched in the testing environment after having infected a first network device;
identify a particular malware program from the plurality of malware programs that did not execute when launched in the testing environment;
determine one or more characteristics of the testing environment that the particular malware program used to determine that the particular malware program was launched in the testing environment; and
configure a network device on a network with the one or more characteristics, wherein the network device is connected to and communicates with other network devices, and wherein configuring the network device with the one or more characteristics causes the network device to resemble the testing environment.
16. The computer-program product of claim 15 , wherein the testing environment includes a virtual machine.
17. The computer-program product of claim 15 , further comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
automatically distribute the one or more characteristics to one or more other network devices.
18. The computer-program product of claim 15 , wherein the one or more characteristics include hardware identifiers, software programs, or data.
19. The computer-program product of claim 15 , wherein configuring the network device includes modifying an operation of a program running on the network device.
20. The computer-program product of claim 15 , wherein configuring the network device includes starting a virtual device on the network device.