Highly collaborative deceptive network alliance
According to one embodiment, a method, computer system, and computer program product for preventing intrusions on a network is provided. The present invention may include generating a sandbox environment responsive to detecting an attacker in the network, wherein the sandbox environment comprises dynamically generated data tailored to the target of the attacker; and moving the attacker to the sandbox environment.
1. A processor-implemented method for preventing intrusions on a network, the method comprising:
responsive to detecting an attacker in the network, identifying a target file of the attacker;
identifying content factors of the identified file including the title, size, and file format;
dynamically generating, using Markov chains or a generative adversarial network (GAN), one or more decoy files comprising a plurality of text content based on a text content comprising the target file, and wherein the content factors of the one or more decoy files match the content factors of the target file;
generating a sandbox environment comprising the one or more decoy files; and
moving the attacker to the sandbox environment.
2. The method of claim 1 , wherein the sandbox environment further comprises one or more decoy individuals.
3. The method of claim 1 , further comprising:
predicting an intrusion to the network based on activity of the attacker within the sandbox environment.
4. The method of claim 3 , further comprising:
performing a mitigation action based on the predicted intrusion.
5. The method of claim 1 , wherein the plurality of text content is modified to align a probability distribution of the plurality of text content with human-written language.
6. The method of claim 1 , wherein the network further comprises one or more decoy individuals.
7. The method of claim 1 , wherein the sandbox environment further comprises a dynamically generated username and home directory structure.
8. A computer system for preventing intrusions on a network, the computer system comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
responsive to detecting an attacker in the network, identifying a target file of the attacker;
identifying content factors of the identified file including the title, size, and file format;
dynamically creating one or more decoy files comprising a plurality of text content based on a text content comprising the target file, and wherein the content factors of the one or more decoy files match the content factors of the target file;
generating a sandbox environment comprising the one or more decoy files; and
moving the attacker to the sandbox environment.
9. The computer system of claim 8 , wherein the sandbox environment further comprises one or more decoy individuals.
10. The computer system of claim 8 , further comprising:
predicting an intrusion to the network based on activity of the attacker within the sandbox environment.
11. The computer system of claim 10 , further comprising:
performing a mitigation action based on the predicted intrusion.
12. The computer system of claim 8 , wherein the plurality of text content is modified to align a probability distribution of the plurality of text content with human-written language.
13. The computer system of claim 8 , wherein the network further comprises one or more decoy individuals.
14. The computer system of claim 8 , wherein the sandbox environment further comprises a dynamically generated username and home directory structure.
15. A computer program product for preventing intrusions on a network, the computer program product comprising:
one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor to cause the processor to perform a method comprising:
responsive to detecting an attacker in the network, identifying a target file of the attacker;
identifying content factors of the identified file including the title, size, and file format;
dynamically creating one or more decoy files comprising a plurality of text content based on a text content comprising the target file, and wherein the content factors of the one or more decoy files match the content factors of the target file;
generating a sandbox environment comprising the one or more decoy files; and
moving the attacker to the sandbox environment.
16. The computer program product of claim 15 , wherein the sandbox environment further comprises one or more decoy individuals.
17. The computer program product of claim 15 , further comprising:
predicting an intrusion to the network based on activity of the attacker within the sandbox environment.
18. The computer program product of claim 17 , further comprising:
performing a mitigation action based on the predicted intrusion.
19. The computer program product of claim 15 , wherein the plurality of text content is modified to align a probability distribution of the plurality of text content with human-written language.
20. The computer program product of claim 15 , wherein the network further comprises one or more decoy individuals.