Patent ID: 9571517
Date: 2017-02-14
CPC Classifications: H04L

Claim:
1. A method comprising: receiving an indication of a cyberthreat to data security from an external source; determining one or more characteristics of the cyberthreat using information from the external source; mapping the one or more characteristics to one or more steps of an instruction; dynamically determining one or more agents to execute the one or more steps of the instruction in order to simulate the one or more characteristics of the cyberthreat within a target network, wherein the target network includes: initiating execution of the instruction by the one or more agents to enable the one or more characteristics of the cyberthreat at the target network; receiving feedback data associated with a level of success of the one or more agents in enabling the one or more characteristics of the cyberthreat at the target network, wherein the feedback data includes data associated with: generating an analysis, based on at least a portion of the feedback data, that includes an effectiveness of the target network in detecting the cyberthreat in order to improve a capability of the one or more security devices or the one or more host computing devices at detecting or responding to the cyberthreat; wherein the one or more characteristics of the cyberthreat are indicative of a presence of a malware being executed and comprise at least one of: creating a specific file; creating a network communication on a specific port or to a specific destination; creating or modifying a user account, a directory, or a registry; or removing a service; wherein the one or more steps of the instruction are configured when executed to at least one of: create the specific file; create the network communication on the specific port or to the specific destination; create or access the user account, directory, or registry; or remove the service; and wherein the one or more steps of the instruction when executed simulate the presence of the malware within the target network without executing the malware in the target network in order to test whether the target network detects and reacts to the simulated presence of the malware within the target network.