Host-based deception security technology
Systems and methods for generating and deploying decoy files and decoy applications that appear to be authentic files and applications. The content of the decoy files may be configurable, and the decoy files may be beaconized. The extent to which decoy files are and decoy applications are deployed may depend on the authentication level or change in authentication level of a user.
1. A method of operating a host-based security system comprising:
generating a set of decoy files from a first set of documents by, in each document of the set, replacing a first information with second information;
determining a first authentication level for a user;
displaying a first quantity of decoy files corresponding to the authentication level;
determining a second authentication level for the user; and
upon determining the second authentication level, displaying a second quantity of decoy files.
2. The method of claim 1 , wherein the first quantity of decoy files is zero and the second quantity of decoy files is greater than zero.
3. The method of claim 1 , wherein the first quantity of decoy files is greater than zero.
4. The method of claim 3 , wherein the second quantity of decoy files is greater than the first quantity of decoy files.
5. The method of claim 3 , wherein the second quantity of decoy files is less than the first quantity of decoy files.
6. The method of claim 3 , wherein the set of decoy files includes a decoy file having an embedded beacon.
7. The method of claim 1 , wherein the second authentication level is determined based on a failed login attempt by the user.
8. The method of claim 1 , wherein the second authentication level is determined based on a signal received from a host application.
9. A method of operating a host-based security system comprising:
generating a set of decoy files from a first set of documents, in each document of the set, embedding a beacon;
determining a first authentication level for a user;
displaying a first quantity of decoy files corresponding to the authentication level;
determining a second authentication level for the user; and
upon determining the second authentication level, displaying a second quantity of decoy files.
10. The method of claim 9 , wherein the first quantity of decoy files is zero and the second quantity of decoy files is greater than zero.
11. The method of claim 9 , wherein the first quantity of decoy files is greater than zero.
12. The method of claim 11 , wherein the second quantity of decoy files is greater than the first quantity of decoy files.
13. The method of claim 11 , wherein the second quantity of decoy files is less than the first quantity of decoy files.
14. The method of claim 9 , wherein the second authentication level is determined based on a failed login attempt by the user.
15. The method of claim 9 , wherein the second authentication level is determined based on a signal received from a host application.
16. A method of operating a host-based security system comprising:
generating a set of decoy files;
determining a first authentication level for a user;
displaying a first quantity of decoy files corresponding to the authentication level;
determining a second authentication level for the user; and
upon determining the second authentication level, displaying a second quantity of decoy files;
wherein the second quantity of decoy files is less than the first quantity of decoy files.
17. The method of claim 16 , wherein the set of decoy files includes a decoy file having an embedded beacon.
18. The method of claim 16 , wherein the second authentication level is determined based on a failed login attempt by the user.
19. The method of claim 16 , wherein the second authentication level is determined based on a signal received from a host application.