Context-aware knowledge system and methods for deploying deception mechanisms

1. A method comprising:

identifying a network for deploying one or more deception mechanisms, wherein a deception mechanism emulates one or more characteristics of a machine on the network;

determining one or more asset densities of the network, wherein an asset density is associated with a real-time determination of a total number of assets connected to the network;

determining a summary statistic associated with one or more historical attacks on the network;

determining a probability of an attack on the network, wherein determining the probability includes using the one or more asset densities or the summary statistic;

using the probability to dynamically determine a number of deception mechanisms to deploy in the network, wherein as the probability changes, the number of deception mechanisms to deploy in the network is updated in real time; and

dynamically deploying the number of deception mechanisms or the updated number of deception mechanisms in the network in real-time.

2. The method of claim 1 , wherein the network is a portion of another network.

3. The method of claim 2 , wherein an asset density of the one or more asset densities is a total number of critical assets in the network divided by a total number of critical assets in the other network.

4. The method of claim 2 , wherein an asset density of the one or more asset densities is a total number of assets in the network divided by a total number of assets in the other network.

5. The method of claim 1 , wherein the network is identified by computing an importance score, and wherein the importance score is computed using the one or more asset densities and machine information associated with the network.

6. The method of claim 1 , further comprising:

identifying a central node of the network, wherein a deception mechanism of the number of deception mechanisms is deployed on or near the central node.

7. The method of claim 1 , wherein the summary statistic includes a mean, median, or mode of a probability distribution of the one or more historical attacks.

8. The method of claim 7 , wherein the probability distribution of a number of historical attacks includes one or more probability distributions across one or more time periods.

9. The method of claim 1 , wherein the summary statistic is updated when a request to access a deception mechanism is received, wherein updating the summary statistic includes:

determining a new summary statistic using a number of new attacks associated with the network, wherein the new attacks include attacks that occurred after the historical attacks; and

updating the summary statistic using the new summary statistic.

10. The method of claim 1 , further comprising:

determining one or more configurations for one or more of the deployed deception mechanisms.

11. The method of claim 10 , wherein the one or more configurations are determined using a population distribution of machine information in the network, and wherein the population distribution identifies machine information associated with one or more machines in the network.

12. The method of claim 11 , wherein the machine information includes at least one or more of a MAC address, a host name, an identifier of an operating system, or an identifier of a network service.

13. The method of claim 10 , wherein a configuration includes at least one or more of a MAC address, a host name, an operating system, or a network service, and wherein the host name is determined by:

determining a pattern for host names based on one or more machines in the network; and

determining the host name according to the pattern.

14. The method of claim 10 , further comprising:

detecting a request to access a deception mechanism;

determining a configuration of the accessed deception mechanism; and

updating the one or more configurations for the one or more of the deployed deception mechanisms using the configuration of the accessed deception mechanism.

15. The method of claim 1 , further comprising:

determining a schedule to deploy a deception mechanism.

16. The method of claim 15 , wherein the schedule is determined using the historical attacks on the network.

17. The method of claim 15 , wherein the schedule includes one or more of a connect time or a disconnect time, wherein the connect time indicates when to connect a deception mechanism to the network, and wherein the disconnect time indicates when to disconnect a deception mechanism from the network.

18. The method of claim 1 , wherein historical attacks are identified using at least one or more of a security operations center, a computer security incident response team, an intrusion detection system, or an intrusion prevention system.

19. A system comprising:

one or more processors; and

a non-transitory computer-readable medium containing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:

identify a network for deploying one or more deception mechanisms, wherein a deception mechanism emulates one or more characteristics of a machine on the network;

determine one or more asset densities of the network, wherein an asset density is associated with a real-time determination of a total number of assets connected to the network;

determine a summary statistic associated with one or more historical attacks on the network;

determine a probability of an attack on the network, wherein determining the probability includes using the one or more asset densities or the summary statistic

using the probability to dynamically determine a number of deception mechanisms to deploy in the network, wherein as the probability changes, the number of deception mechanisms to deploy in the network is updated in real-time; and

dynamically deploy the number of deception mechanisms or the updated number of deception mechanisms in the network in real-time.

20. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium of a network device, including instructions that, when executed by the one or more processors, cause the one or more processors to:

identify a network for deploying one or more deception mechanisms, wherein a deception mechanism emulates one or more characteristics of a machine on the network;

determine one or more asset densities of the network, wherein an asset density is associated with a real-time determination of a total number of assets connected to the network;

determine a summary statistic associated with one or more historical attacks on the network;

determine a probability of an attack on the network, wherein determining the probability includes using the one or more asset densities or the summary statistic

using the probability to dynamically determine a number of deception mechanisms to deploy in the network, wherein as the probability changes, the number of deception mechanisms to deploy in the network is updated in real-time; and

dynamically deploy the number of deception mechanisms or the updated number of deception mechanisms in the network in real-time.