Granted Patent B2

US 12,368,755 · App. 17/752,024 · Granted Jul 22, 2025

Inventors: Ben Whitham (Campbell, AU); David Liebowitz (Bruce, AU); Kiriya Keat (Narrabundah, AU); Connor Brendish (Nicholls, AU)

Assignee: Penten Pty Ltd

H04L63/1491G06F21/565G06F21/566G06F21/6218G06F2221/034G06Q10/10

Abstract

Claims (90)

1. A method for automatically modifying honeyfiles for a file system, comprising:

implementing a user agent on the file system;

training models of user behavior on the file system by observation of real files on the file system, wherein:

interactions with real files are temporal events;

the temporal events are selected from a list comprising at least: create; copy; add content; delete content; and add comment; and

a time between the temporal events is sampled;

providing simple exclusion rules; and

using the trained models to generate user agent actions that automatically modify honeyfiles for a file system, wherein the modifications to the honeyfiles comprise at least one of:

creating multiple draft versions of honeyfiles;

copying files;

deleting files;

adding content in files;

deleting content in files;

replacing content in files; and

adding comments to files.

2. The method of claim 1 , wherein:

the adding content in files uses text generation methods to add topical content;

the replacing content in files uses text replacement methods to replace topical content; and

deleting content in files uses text deletion methods to delete topical content.

3. The method of claim 1 , wherein the modifications to the honeyfiles further comprises simulating having multiple users interact with a file.

4. The method of claim 3 , wherein the multiple users comprise simulated system users who are simulated to read a honeyfile.

5. The method of claim 3 , wherein the multiple users comprise simulated multiple authors who are simulated to modify a honeyfile.

6. The method of claim 1 , wherein the time between the temporal events is sampled, comprises:

observing the temporal events;

estimating parameters of a temporal distribution based on the observed temporal events; and

sampling the temporal distribution to determine the time for the user agent to automatically modify honeyfiles for a file system.

7. The method of claim 1 , wherein the time between the temporal events is sampled from a Poisson distribution.

8. The method of claim 1 , wherein the simple exclusion rules comprise not modifying honeyfiles that do not exist.

9. The method of claim 1 , wherein the modifications to the honeyfiles cause the honeyfile metadata to be modified.

10. A method of manipulating a lifecycle of honeyfiles for a file system, comprising:

creating a honeyfile for the file system automatically;

simulating users who manipulate with the honeyfile to modify content of the honeyfile;

saving the modified honeyfile to the file system.

11. The method of claim 10 , wherein following the saving the modified honeyfile to the file system, further comprising:

deleting the modified honeyfile from the file system.

12. The method of claim 10 , wherein the simulating users comprises:

implementing a user agent on the file system; and

running the user agent on a trained model to automatically manipulate the honeyfile to modify content of the honeyfile.

13. The method of claim 10 , wherein modifying the content of the honeyfile comprises at least one of:

creating multiple draft versions of honeyfiles;

copying files;

deleting files;

adding content in files;

deleting content in files;

replacing content in files; and

adding comments to files.

14. The method of claim 12 , wherein the trained model is trained by:

observing interactions with real files as temporal events;

sampling the temporal events from a list of temporal events comprising at least: create; copy; add content; delete content; and add comment; and

sampling a time between the temporal events.

15. A method of automatically manipulating a lifecycle of a honeyfile on a file system, comprising:

implementing a learning algorithm on a file system;

identifying a real file;

training the learning algorithm by observing temporal events involving the real file;

training a model with the learning algorithm;

implementing a user agent on the file system;

creating a honeyfile on the file system;

deploying the honeyfile on the file system;

using the trained model to generate user agent actions;

evaluating the honeyfile; and

either:

deleting the honeyfile; or

re-using the trained model to generate user agent actions to automatically modify the honeyfile.

16. The method of claim 15 , wherein automatically training the learning algorithm by observing temporal events involving the real file comprises causing the learning algorithm to observe:

the types of temporal events that a real user performs on the real file; and

the time durations between the temporal events that a real user performs on the real file.

17. The method of claim 15 , wherein automatically modifying the honeyfile comprises at least one of modifying the content of the honeyfile or simulating having multiple users interact with a file.

18. The method of claim 15 , wherein evaluating the honeyfile comprises at least one or more of: how well camouflaged is the file; how attractive is the file to the intruder; or how much sensitive content is exposed.

19. The method of claim 17 , wherein simulating having multiple users interact with a file comprises generating a typical number of automatic modifications for normal workdays, evenings, and weekends.

20. A system for automatically modifying honeyfiles for a file system, comprising:

a server connected via an electronic communications network to a file system of at least one user device, the server:

comprising:

a processor/controller;

a database including a file set; and

an interface; and

configured to execute the steps of:

implementing a user agent on a system;

training models of user behavior on the system, wherein:

interactions with files are temporal events;

the temporal events are sampled from a list comprising at least: create; copy; add content; delete content; and add comment; and

a time between the temporal events is sampled;

providing simple exclusion rules; and

running the user agent on the trained user behavior model to automatically modify honeyfiles for a file system; wherein the modifications to the honeyfiles comprise at least one of:

creating multiple draft versions of honeyfiles;

copying files;

deleting files;

adding content in files;

deleting content in files;

replacing content in files; and

adding comments to files.

Assignments (1)

Priority Claims (1)

Continuity (3)

References Cited (39)