Patent ID: 9705920
Date: 2017-07-11
CPC Classifications: G06F,H04L

Claim:
1. A non-transitory computer-readable medium embodying active decoy data executable in at least one computing device, the active decoy data including at least one predetermined feature configured to entice an unauthorized individual to access the active decoy data, the active decoy data being exfiltrated from a protected computing environment, wherein when executed the active decoy data causes the at least one computing device to at least: unwrap a plurality of executable instructions within the active decoy data, wherein a functionality associated with the plurality of executable instructions is unidentifiable or obfuscated when the plurality of executable instructions are wrapped; determine whether the active decoy data is being executed in the protected computing environment by determining whether the at least one computing device embodies a particular characteristic of the protected computing environment; responsive to determining that the active decoy data is not being executed in the protected computing environment, cause a usage of at least one of a predetermined percentage of processing resources or a predetermined percentage of memory resources; and the non-transitory computer-readable medium further embodying a service executable in the at least one computing device, wherein the service transmits a notification to a central reporting site in response to detecting the usage, the notification including information identifying the at least one computing device upon which the active decoy data is being executed, the notification further comprising a deployment instance identifier of the active decoy data.