Abstract:
Software traps per application that attract malicious software are created by mimicking the behavior of the application. In an embodiment, the software traps are comprised of mimicked entities which will be created and monitored to detect malicious code activity using an additional layer to the application.

Description:
BACKGROUND 
       [0001]    Computing systems are suffering from malicious code attacks- 13  there are many types of attacks, but there are two general purposes:
       1. Disrupt the system operation   2. Get confidential information       
 
         [0004]    A computing system application is subjected to 3 vectors of malicious software attacks: 
         [0000]    1. Inner device attack—one malicious app can “attack” another app on the same device
 
2. Outside original—malicious man-in-the-middle (external to device) can attack the app
 
3. Inner-app—a component inside the app can attack other parts of the app
 
         [0005]    There are existing methods for attracting attacking software called “honeypots” focusing on identifying malicious internet traffic, coming from outside the perimeter, which can result in viruses and malicious software brought to the perimeter. 
         [0006]    Internet servers are creating complex honeypots to fight this malicious software—but once malicious software gets inside the device or even applications inside the device these methods will not work. 
         [0007]    Traditional software honey pots are covering mostly #2 and do not address #1 and #3. 
         [0008]    Furthermore, honey pots server services are static and complex, meaning servers inside the local network that will “attract” hackers require each of which must be set up specifically and managed by itself. 
         [0009]    There are also solutions for mimicking a full application—such solutions can be effective in detecting in device attacks but not in application malware. 
         [0010]    A mobile application in most smart phone system is in a “sand box” environment—a per application micro virtual machine, which will protect the application security and resources. 
         [0011]    Attacks on applications are still possible, and the “sand box” environment prevents from creating a central security protection in the system. 
       SUMMARY 
       [0012]    The purpose of the invention is to provide ability to detect all types of attacks and the nature of an attack. 
         [0013]    The invention methods will create software traps which will attract malicious software by creating software objects (files, network resources) which are similar to those created by the application. 
         [0014]    The invention method is about mimicking software objects which are referenced by the application such as files and network resources (potentially internet resources). Such software objects will be created by an additional layer which is monitoring the system calls of the applications. These software objects will have the same characteristics as the original and will be referenced in the same way. 
         [0015]    Any reference to such software objects is considered a potential attack, as the original software is not intended to address them. A monitoring software can detect the type of actions/changes done on these software objects. 
     
    
     
       DETAILED DESCRIPTION 
       Brief Description of the Drawings 
         [0016]      FIG. 1  Described a system description of the software trap generation and monitoring method 
       
    
    
       [0017]    The method described is good for any computing system, which comprised a CPU, execution memory, storage memory, 10 devices and a networked—wired of wireless. 
         [0018]    Specifically this can be a smart phone or a tablet. 
         [0019]    The invention method works in several steps:
       1. Monitoring an application and detecting references to software objects such as files or network resources.   2. Creating mimicked objects with the same characteristics as the original detected objects.   3. Creating same references to the mimicked objects as to the original objects   4. Detecting references to the mimicked objects (if the original software is working properly it will never issue such references).       
 
         [0024]      FIG. 1  describes the software elements in the system for the generation of mimicked software objects and their monitoring for the detection of malicious software activities. 
         [0025]    An application  11  is installed. 
         [0026]    For generic computing systems there can be a single security program  12  for the whole system, which can handle multiple applications. 
         [0027]    As an alternative a security layer  12  is created per application (this is a must in certain mobile phone systems) and will be installed together with it as one application and “sandbagged” together with it. This will have an advantage, as its operations would look to attacker software as the original application. 
         [0028]    The security layer/program will have several elements:
       1. Object reference monitor  13     2. Mimicked object creator  14     3. Mimicked object monitor.  15         
 
         [0032]    The object reference monitor  13  will observe all system calls made by the application. It will observe if this is a new reference to an object or a repetitive reference. The software objects can be files  17   a  or network resource  16   a  (potentially internet resources). 
         [0033]    The mimicked object creator  14  will create mimicked software objects like these referenced ( 16   b ,  17   b ). They will have the same characteristics as the original software objects (file size, network characteristics). In addition, all actions/references done to the original object will be done on them (read, write, transfer, copy). It is expected that malicious software aiming to attack this application will reference these software objects. An unlimited number of such software objects can be created per application. 
         [0034]    Also, since certain software objects can be referenced by multiple applications, a mimicked object will be created per reference per application. Under one embodiment, there will be a reference triggering mechanisms  18  in each object, which will generate an interrupt to the operating system  19  once such a reference is made. All references to a mimicked object will be done only by a malicious code. 
         [0035]    It should be noted that illegal references may be done by the application itself—due to malware in it. 
         [0036]    The operating system can call mimicked object monitoring  15  which will reference the reported mimicked object and observe what changes where done on its content. 
         [0037]    Under another embodiment, there will be no such mechanism, but the mimicked object monitoring  15  will from time to time examine the content of the object for any changes done on them. 
         [0038]    It can detect if content is erased or changed of transferred. 
         [0039]    Once such a detection is done the OS  19  will be notified and it can take actions.