Granted Patent B2

US 12,432,253 · App. 18/637,358 · Granted Sep 30, 2025

Inventors: Venu Vissamsetty (San Jose, CA); Anil Gupta (Bangalore, IN); Harinath Vishwanath Ramchetty (Bangalore, IN)

Assignee: SentinelOne, Inc.

H04L63/1491G06F21/554G06F21/566H04L41/12H04L61/4505H04L61/5007H04L63/1416G06F2221/2123H04L61/4523

Abstract

Claims (31)

1. A computer-implemented method for deceiving a source attempting to access target data, the method comprising:

configuring, by a computer system, a system call to refer to a detour function;

receiving, by the computer system from a source, a request to access target data via the system call;

determining, by the computer system via the detour function, whether the source is sanctioned; and

returning, by the computer system in response to determining that the source is not sanctioned, decoy data to the source, wherein the decoy data is different from the target data, the decoy data configured to mimic the target data,

wherein the computer system comprises a computer processor and an electronic storage medium.

2. The computer-implemented method of claim 1 , wherein the decoy data is configured to mimic a format of the target data.

3. The computer-implemented method of claim 2 , wherein the format comprises one or more of a word processor document, spreadsheet, database, credential, configuration file, browser history, or a listing of recently accessed files.

4. The computer-implemented method of claim 1 , wherein the source comprises an attacker system.

5. The computer-implemented method of claim 1 , wherein the target data comprises production data.

6. The computer-implemented method of claim 1 , wherein the computer system comprises an endpoint.

7. The computer-implemented method of claim 6 , wherein the endpoint comprises a production device.

8. The computer-implemented method of claim 1 , wherein the decoy data does not comprise production data.

9. The computer-implemented method of claim 1 , wherein the request to access target data comprises a read command or information request.

10. The computer-implemented method of claim 1 , wherein whether the source is sanctioned is determined by determining whether the source comprises a sanctioned application.

11. The computer-implemented method of claim 1 , wherein the decoy data is stored locally on the computer system.

12. The computer-implemented method of claim 1 , wherein the decoy data is stored on another location and is accessed by the computer system.

13. A system for deceiving a source attempting to access target data, the system comprising:

one or more computer readable storage devices configured to store a plurality of computer executable instructions; and

one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the system to:

configure a system call to refer to a detour function;

receive a request to access target data via the system call;

determine, via the detour function, whether the source is sanctioned; and

return, in response to determining that the source is not sanctioned, decoy data to the source, wherein the decoy data is different from the target data, the decoy data configured to mimic the target data.

14. The system of claim 13 , wherein the decoy data is configured to mimic a format of the target data.

15. The system of claim 14 , wherein the format comprises one or more of a word processor document, spreadsheet, database, credential, configuration file, browser history, or a listing of recently accessed files.

16. The system of claim 13 , wherein the target data comprises production data.

17. The system of claim 13 , wherein the decoy data does not comprise production data.

18. The system of claim 13 , wherein whether the source is sanctioned is determined by determining whether the source comprises a sanctioned application.

19. The system of Claim 13 , wherein the decoy data is stored locally.

20. The system of Claim 13 , wherein the decoy data is stored on another location and is accessed by the system.

Assignments (2)

Continuity (5)

References Cited (400)