Acalvio Technologies, Inc.

Malwarebytes Corporation

Shadow Networks, Inc.

Yadong Zhang

Johnson L Wu

Craig A Schultz

Steven M Silva

Eric Winsborrow

Ching-Hai Tsai

Methods and systems are presented of presenting false and/or decoy content to an intruder operating on a computer system by obfuscating critical files on a computer storage device with data that directs subsequent infiltration and propagation to designated decoy hosts and decoy applications. Method and systems are provided for selectively presenting different contents to different viewers/users of application resource files for the purpose of preventing the valuable content from being read, tampered with, exfiltrated, or used as a means to perform subsequent attacks on network resources.

Alternate files returned for suspicious processes in a compromised computer network

A shadow network, which can be a virtual reproduction of a real, physical, base computer network, is described. Shadow networks duplicate the topology, services, host, and network traffic of the base network using shadow hosts, which are low interaction, minimal-resource-using host emulators. The shadow networks are connected to the base network through virtual switches, etc. in order to form a large obfuscated network. When a hacker probes into a host emulator, a more resource-intensive virtual machine can be swapped in to take its place. When a connection is attempted from a host emulator to a physical computer, the a host emulator can step in to take the place of the physical computer, and software defined networking (SDN) can prevent collisions between the duplicated IP addresses. Replicating the shadow networks within the network introduces problems for hackers and allows a system administrator easier ways to identify intrusions.

Network infrastructure obfuscation

A deployment simulator application receives information about an anti-malware application that is to be deployed to and installed on client devices connected to a network. The deployment simulator application identifies the clients that will receive the deployed anti-malware application and performs a series of tests on the client to determine whether the anti-malware application will be able to successfully install remotely on the client. The deployment simulator application may report the results of the deployment simulation tests to an administrative client.

Anti-malware installation deployment simulator

Growing community of inventors

Sunnyvale, CA, United States of America

Yadong Zhang