Automatic decoy derivation through patch transformation
A method and system for implementing security patches on a computer system is disclosed. The method includes finding one or more security patches; analyzing one of the one or more security patches to find one or more localized security fixes within the one or more security patches; and transforming a security patch within the one or more security patches into a honey patch that is configured to report security violations.
1. A computer-implemented method for implementing security patches on a computer system comprising:
training the computer system to determine characteristics of security patches by analyzing known security patches;
finding one or more security patches;
analyzing, in response to the training, one of the one or more security patches to find one or more localized security fixing patches within the one or more security patches; and
transforming the security fixing patch within the one or more security patches into a honey patch that is configured to report security violations; and
compiling the honey patch to create a decoy system configured to detect a presence of attackers within the computer system, the decoy system alerting a system in the network as to the existence of an attack on the network.
2. The computer-implemented method of claim 1 , wherein:
analyzing one of the one or more security patches comprises analyzing source code of the one or more security patches to identify sections of the source code for a security fix.
3. The computer-implemented method of claim 2 , wherein:
transforming the security patch comprises adding source code that calls an alert service.
4. The computer-implemented method of claim 2 , wherein:
analyzing known security patches comprises converting source code into abstract syntax trees to determine changes of the security patch.
5. The computer-implemented method of claim 1 , wherein:
characteristics of security patches include keywords that correlate with security patches.
6. The computer-implemented method of claim 1 , wherein:
characteristics of security patches include commonly used functions that correlate with security patches.
7. The computer-implemented method of claim 1 , wherein:
training the computer system comprises assigning weights to one or more of the following characteristics: variable and function names; type casts; logical and mathematical operators; function calls; variable assignments; and “return” and “goto” statements.
8. The computer-implemented method of claim 1 , wherein:
training the computer system comprises a simple Bayes learning phase and a fix pattern learning phase.
9. A computer system comprising:
a processor; and
memory;
wherein the processor is configured to perform the method comprising:
training the computer system to determine characteristics of security patches by analyzing known security patches;
finding one or more security patches;
analyzing, in response to the training, one of the one or more security patches to find one or more localized security fixing patches within the one or more security patches; and
transforming the security fixing patch within the one or more security patches into a honey patch that is configured to report security violations;
compiling the honey patch to create a decoy system configured to detect a presence of attackers within the computer system, the decoy system alerting a system in the network as to the existence of an attack on the network.
10. The computer system of claim 9 , wherein:
analyzing one of the one or more security patches comprises analyzing source code of the one or more security patches to identify sections of the source code for a security fix.
11. The computer system of claim 10 , wherein:
transforming the security patch comprises adding source code that calls an alert service.
12. The computer system of claim 10 , wherein:
analyzing known security patches comprises converting source code into abstract syntax trees to determine changes of the security patch.
13. The computer system of claim 9 , wherein:
characteristics of security patches include keywords that correlate with security patches.
14. The computer system of claim 9 , wherein:
characteristics of security patches include commonly used functions that correlate with security patches.
15. The computer system of claim 9 , wherein:
training the computer system comprises assigning weights to one or more of the following characteristics: variable and function names; type casts; logical and mathematical operators; function calls; variable assignments; and “return” and “goto” statements.
16. The computer system of claim 9 , wherein:
training the computer system comprises a simple Bayes learning phase and a fix pattern learning phase.