Illusive Networks Ltd

Tom Sela

Tom Kahana

Tomer Shamul

Dolev Ben-Shushan

Hadar Yudovich

Matan Kubovsky

Ofer Israeli

Gil Shulman

Gabi Katz

Lee Abe Teichner

Yariv Hashai

Magal Baz

Alon Kafri

Shani Margulis

Nimrod Lavi

Sharon Bittan

A system for sanitizing an organization's network against attacker breach, including a data collector, gathering information about network hosts, an analyzer constructing the organization's network topology, a machine learning engine categorizing the hosts into organizational units and identifying key assets of the organization, a security rules engine mapping real-time data, and inferring security rules that prescribe on which specific hosts which specific credentials are permitted to be stored, and a user interface including an analyst dashboard enabling an analyst to visualize in real-time activities within the organizations' network, to automatically infer security rules for the network, to activate the security rules in the network, and to eliminate potential attack vectors for which the activated security rules are violated, and an attacker view visualizing the organization's network, identifying security rule violations across the organization's network, and enabling removal of credential-based security rule violations by use of actions.

Organization attack surface management

A security system for point of sale (POS) terminals, including one or more POS processors for injecting decoy credit cards numbers into memories of corresponding one or more POS terminals, a secure database including entries of the decoy credit card numbers and, for each entry, a corresponding identifier of a specific POS terminal and a corresponding date & time, and a security manager receiving a notification of attempted use of a specific decoy credit card number, extracting the POS identifier and the date & time corresponding to the specific decoy credit card number from the database, identifying legitimate credit card numbers that were processed by the identified POS terminal during a time period including the date & time corresponding to the specific decoy credit card number, and alerting an authority that the legitimate credit card numbers may have been compromised.

Defense against credit card theft from point-of-sale terminals

A system for detecting malicious activity in networks, including a deception manager having administrative credentials for a network, planting deceptions within network hosts, and distributing a decoy agent to each endemic decoy host (EDH), each deception including information regarding decoy communication ports of an EDH, each EDH having a group of ports, referred to as decoy ports, for connection by an attacker from a network host that the attacker has breached, wherein each decoy agent is programmed to alert the deception management server, and to proxy communication with the attacker to a trap server, in response to the decoy agent identifying the attacker attempting a connection to the decoy agent's EDH via one of the decoy ports, and a forensic collector that collects, from the breached network host, forensics of the attacker's activity, when the decoy agent acts as a proxy between the attacker and the trap server.

Detecting malicious activity by using endemic network hosts as decoys

A system for generating and deploying custom deceptions for a network, including an administrator computer for generating custom deception entities (CDEs), each CDE including parameters including inter alia (i) a type of entity, (ii) conditions for deployment of the CDE, and (iii) a deception type, and a management server, comprising an application programming interface for use by the administrator computer to generate CDEs through the medium of a formal language for specifying deceptions, and a translator for translating formal language CDEs to deceptions that are installable in network endpoint computers, wherein the management computer receives a request from a network endpoint computer to retrieve CDEs, selects CDEs that are relevant to the requesting network endpoint computer based on the parameters of the CDE, translates the requested CDEs to installable deceptions, and transmits the installable deceptions to the network endpoint computer for installation thereon.

User-customized deceptions and their deployment in networks

A system to detect attackers who attempt to breach an enterprise network and attackers who have already breached the enterprise network, including an open source intelligence (OSINT) discoverer scanning the Internet to discover data related to an enterprise that is available online, an OSINT replacer generating deceptive files by replacing placeholders within template files with deceptive information, based on the data discovered by the OSINT discoverer, an OSINT distributor planting the deceptive files generated by the OSINT replacer within designated OSINT resources, and a deception management server that alerts an administrator in response to an attacker attempting to make a connection within the network using information in a deceptive file planted by the OSINT distributor.

Open source intelligence deceptions

Growing community of inventors

Holon, Israel

Tom Sela