Patent Publication Number: US-9836512-B1

Title: Systems and methods for identifying similar hosts

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
     This application claims the benefit under 35 U.S.C. §119 of U.S. Provisional Application No. 62/334,652, filed on May 11, 2016, the disclosure of which is incorporated by reference in its entirety for all purposes. 
    
    
     TECHNICAL FIELD 
     The present disclosure is related to systems and methods for identifying potentially compromised hosts that are similar to a known compromised host in a network. More particularly, embodiments of the present disclosure include systems and methods that evaluate weighted attributes of the compromised host to identify the potentially compromised hosts. 
     BACKGROUND 
     Hackers can attack a network using multiple machines. Deception mechanisms can be implemented to identify a compromised server or network computer that was involved during the network attack. However, existing deception mechanisms are limited and burdensome to processing resources. For example, servers or network computers used in conjunction with a known compromised server or network computer may go undetected, leaving a network unsecure. Further, the severity of the threat posed by a detected compromised server or network computer is largely unknown. 
     SUMMARY 
     Provided are methods, including computer-implemented methods or methods implemented by a network device, devices including network devices, and computer-program products for using attributes associated with a known compromised host in a network to determine similar hosts. In particular, embodiments of the present disclosure provide systems, methods, and computer-readable products for identifying similar hosts. 
     In some embodiments, a method includes determining a query item. The query item is associated with a compromised host of a plurality of hosts. Examples of a host can include a domain controller, an active directory, a database, a server, an end user, a network-connected device or machine, and other suitable devices. The method further includes selecting an attribute associated with the query item, assigning an attribute weight to the attribute, identifying a query attribute value associated with the attribute and the query item, weighting the query attribute value using the attribute weight, and determining a first distance between the weighted query attribute value and a random value. The method further includes identifying a candidate item. The candidate item includes a host of the plurality of hosts. The method further includes identifying a candidate attribute value associated with the attribute and the candidate item, weighting the candidate attribute value using the attribute weight, determining a second distance between the candidate attribute value and the random value, determining a third distance between the first distance and the second distance, and characterizing the candidate item as a similar item to the query item when the third distance is within a threshold. 
     In some embodiments, a method includes identifying compromised hosts from a plurality of hosts, and determining a cluster for the compromised hosts. The cluster includes a cluster centroid, and includes compromised hosts that are similar. The method further includes computing a cluster quality parameter for the cluster. The cluster quality parameter is based on a scatter of the cluster. The method further includes weighting the cluster centroid with the cluster quality parameter to form a population centroid of the compromised hosts. The method further includes determining whether a host of the plurality of hosts is similar to the population centroid, and characterizing the host of the plurality of hosts as a similar item based on the determination. 
     In the following description, for the purposes of explanation, specific details are set forth in order to provide a thorough understanding of embodiments of the disclosure. However, it will be apparent that various embodiments may be practiced without these specific details. The figures and description are not intended to be restrictive. 
     The ensuing description provides exemplary embodiments only, and is not intended to limit the scope, applicability, or configuration of the disclosure. Rather, the ensuing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing an exemplary embodiment. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the disclosure as set forth in the appended claims. 
    
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
       Illustrative embodiments are described in detail below with reference to the following figures: 
         FIG. 1  illustrates an example of a network threat detection and analysis system, in which various implementations of a deception-based security system can be used; 
         FIGS. 2A-2D  provide examples of different installation configurations that can be used for different customer networks; 
         FIG. 3A-3B  illustrate examples of customer networks where some of the customer networks&#39; network infrastructure is “in the cloud,” that is, is provided by a cloud services provider; 
         FIG. 4  illustrates an example of an enterprise network; 
         FIG. 5  illustrates a general example of an Internet-of-Things network; 
         FIG. 6  illustrates an example of an Internet-of-Things network, here implemented in a private home; 
         FIG. 7  illustrates of an Internet-of-Things network, here implemented in a small business; 
         FIG. 8  illustrates an example of the basic operation of an industrial control system; 
         FIG. 9  illustrates an example of a SCADA system, here used for distributed monitoring and control; 
         FIG. 10  illustrates an example of a distributed control; 
         FIG. 11  illustrates an example of a PLC implemented in a manufacturing control process; 
         FIG. 12  illustrates an example of a network that may be installed at a physical site, on which described embodiments of the disclosure may be implemented; 
         FIG. 13  illustrates an example of a system for identifying similar hosts including a plurality of hosts on a network, a plurality of logging agents, and a similarity engine; 
         FIG. 14  illustrates an example of a host in a system for identifying similar hosts; 
         FIG. 15  illustrates an example of a similarity engine in a system for identifying similar hosts; 
         FIG. 16  is a flowchart illustrating an embodiment of a process for identifying similar hosts in a network; 
         FIG. 17  is a flowchart illustrating an embodiment of a process for determining a population centroid; 
         FIG. 18  is a flowchart illustrating an embodiment of a process for constructing attribute vectors; 
         FIG. 19  illustrates an example of a query item with attributes being compared to candidate items with attributes; 
         FIG. 20  is a flowchart illustrating an embodiment of a process for comparing a query item to candidate items to determine similar items; 
         FIG. 21  is a flowchart illustrating an embodiment of a process for updating attribute weights using feedback on similar items; and 
         FIG. 22  is an example of a cloud network, on which described embodiments of the disclosure may be implemented. 
     
    
    
     DETAILED DESCRIPTION 
     Network deception mechanisms, often referred to as “honeypots,” “honey tokens,” and “honey nets,” among others, defend a network from threats by distracting or diverting the threat. Honeypot-type deception mechanisms can be installed in a network for a particular site, such as a business office, to act as decoys in the site&#39;s network. Honeypot-type deception mechanisms are typically configured to be indistinguishable from active, production systems in the network. Additionally, such deception mechanisms are typically configured to be attractive to a network threat by having seemingly valuable data and/or by appearing vulnerable to infiltration. Though these deception mechanisms can be indistinguishable from legitimate parts of the site network, deception mechanisms are not part of the normal operation of the network, and would not be accessed during normal, legitimate use of the site network. Because normal users of the site network would not normally use or access a deception mechanism, any use or access to the deception mechanism is suspected to be a threat to the network. 
     “Normal” operation of a network generally includes network activity that conforms with the intended purpose of a network. For example, normal or legitimate network activity can include the operation of a business, medical facility, government office, education institution, or the ordinary network activity of a private home. Normal network activity can also include the non-business-related, casual activity of users of a network, such as accessing personal email and visiting websites on personal time, or using network resources for personal use. Normal activity can also include the operations of network security devices, such as firewalls, anti-virus tools, intrusion detection systems, intrusion protection systems, email filters, adware blockers, and so on. Normal operations, however, exclude deceptions mechanisms, in that deception mechanisms are not intended to take part in business operations or casual use. As such, network users and network systems do not normally access deceptions mechanisms except perhaps for the most routine network administrative tasks. Access to a deception mechanism, other than entirely routine network administration, may thus indicate a threat to the network. 
     Threats to a network can include active attacks, where an attacker interacts or engages with systems in the network to steal information or do harm to the network. An attacker may be a person, or may be an automated system. Examples of active attacks include denial of service (DoS) attacks, distributed denial of service (DDoS) attacks, spoofing attacks, “man-in-the-middle” attacks, attacks involving malformed network requests (e.g. Address Resolution Protocol (ARP) poisoning, “ping of death,” etc.), buffer, heap, or stack overflow attacks, and format string attacks, among others. Threats to a network can also include self-driven, self-replicating, and/or self-triggering malicious software. Malicious software can appear innocuous until activated, upon which the malicious software may attempt to steal information from a network and/or do harm to the network. Malicious software is typically designed to spread itself to other systems in a network. Examples of malicious software include ransomware, viruses, worms, Trojan horses, spyware, keyloggers, rootkits, and rogue security software, among others. 
     An attack on a network may involve multiple compromised devices. However, existing deception mechanisms may not detect all of the devices involved in the attack. For example, a honeypot may only detect a portion of all compromised devices involved in a network attack. Accordingly, networks may remain unsecure even if a compromised device is detected. Further, if a group of compromised devices is detected in the attack, the severity of the threat posed by each of the detected compromised devices is often difficult to determine. 
     According to embodiments of the present disclosure, attributes of a known compromised device can be evaluated to identify candidate items (e.g., other hosts or devices on a network) that share similar attributes to the compromised device. Further, attributes can be weighted to determine a threat severity of a candidate item. User feedback can also be provided to update the weight or threat level associated with attributes. As an advantage, potentially compromised devices, which may have gone undetected by honeypots in a network, can be identified using attributes of a known compromised device. Further, the severity of the threat posed by the potentially compromised devices can be assessed by weighting the attributes. 
     I. Deception-Based Security Systems 
       FIG. 1  illustrates an example of a network threat detection and analysis system  100 , in which various implementations of a deception-based security system can be used. The network threat detection and analysis system  100 , or, more briefly, network security system  100 , provides security for a site network  104  using deceptive security mechanisms, a variety of which may be called “honeypots.” The deceptive security mechanisms may be controlled by and inserted into the site network  104  using a deception center  108  and sensors  110 , which may also be referred to as deception sensors, installed in the site network  104 . In some implementations, the deception center  108  and the sensors  110  interact with a security services provider  106  located outside of the site network  104 . The deception center  108  may also obtain or exchange data with sources located on the Internet  150 . 
     Security mechanisms designed to deceive, sometimes referred to as “honeypots,” may also be used as traps to divert and/or deflect unauthorized use of a network away from the real network assets. A deception-based security mechanism may be a computer attached to the network, a process running on one or more network systems, and/or some other device connected to the network. A security mechanism may be configured to offer services, real or emulated, to serve as bait for an attack on the network. Deception-based security mechanisms that take the form of data, which may be called “honey tokens,” may be mixed in with real data in devices in the network. Alternatively or additionally, emulated data may also be provided by emulated systems or services. 
     Deceptive security mechanisms can also be used to detect an attack on the network. Deceptive security mechanisms are generally configured to appear as if they are legitimate parts of a network. These security mechanisms, however, are not, in fact, part of the normal operation of the network. Consequently, normal activity on the network is not likely to access the security mechanisms. Thus any access over the network to the security mechanism is automatically suspect. 
     The network security system  100  may deploy deceptive security mechanisms in a targeted and dynamic fashion. Using the deception center  108  the system  100  can scan the site network  104  and determine the topology of the site network  104 . The deception center  108  may then determine devices to emulate with security mechanisms, including the type and behavior of the device. The security mechanisms may be selected and configured specifically to attract the attention of network attackers. The security mechanisms may also be selected and deployed based on suspicious activity in the network. Security mechanisms may be deployed, removed, modified, or replaced in response to activity in the network, to divert and isolate network activity related to an apparent attack, and to confirm that the network activity is, in fact, part of a real attack. 
     The site network  104  is a network that may be installed among the buildings of a large business, in the office of a small business, at a school campus, at a hospital, at a government facility, or in a private home. The site network  104  may be described as a local area network (LAN) or a group of LANS. The site network  104  may be one site belonging to an organization that has multiple site networks  104  in one or many geographical locations. In some implementations, the deception center  108  may provide network security to one site network  104 , or to multiple site networks  104  belonging to the same entity. 
     The site network  104  is where the networking devices and users of the an organizations network may be found. The site network  104  may include network infrastructure devices, such as routers, switches hubs, repeaters, wireless base stations, and/or network controllers, among others. The site network  104  may also include computing systems, such as servers, desktop computers, laptop computers, tablet computers, personal digital assistants, and smart phones, among others. The site network  104  may also include other analog and digital electronics that have network interfaces, such as televisions, entertainment systems, thermostats, refrigerators, and so on. 
     The deception center  108  provides network security for the site network  104  (or multiple site networks for the same organization) by deploying security mechanisms into the site network  104 , monitoring the site network  104  through the security mechanisms, detecting and redirecting apparent threats, and analyzing network activity resulting from the apparent threat. To provide security for the site network  104 , in various implementations the deception center  108  may communicate with sensors  110  installed in the site network  104 , using network tunnels  120 . As described further below, the tunnels  120  may allow the deception center  108  to be located in a different sub-network (“subnet”) than the site network  104 , on a different network, or remote from the site network  104 , with intermediate networks (possibly including the Internet  150 ) between the deception center  108  and the site network  104 . 
     In some implementations, the network security system  100  includes a security services provider  106 . In these implementations, the security services provider  106  may act as a central hub for providing security to multiple site networks, possibly including site networks controlled by different organizations. For example, the security services provider  106  may communicate with multiple deception centers  108  that each provide security for a different site network  104  for the same organization. In some implementations, the security services provider  106  is located outside the site network  104 . In some implementations, the security services provider  106  is controlled by a different entity than the entity that controls the site network. For example, the security services provider  106  may be an outside vendor. In some implementations, the security services provider  106  is controlled by the same entity as that controls the site network  104 . 
     In some implementations, when the network security system  100  includes a security services provider  106 , the sensors  110  and the deception center  108  may communicate with the security services provider  106  in order to be connected to each other. For example, the sensors  110 , which may also be referred to as deception sensors, may, upon powering on in the site network  104 , send information over a network connection  112  to the security services provider  106 , identifying themselves and the site network  104  in which they are located. The security services provider  106  may further identify a corresponding deception center  108  for the site network  104 . The security services provider  106  may then provide the network location of the deception center  108  to the sensors  110 , and may provide the deception center  108  with the network location of the sensors  110 . A network location may take the form of, for example, an Internet Protocol (IP) address. With this information, the deception center  108  and the sensors  110  may be able to configure tunnels  120  to communicate with each other. 
     In some implementations, the network security system  100  does not include a security services provider  106 . In these implementations, the sensors  110  and the deception center  108  may be configured to locate each other by, for example, sending packets that each can recognize as coming for the other. Using these packets, the sensors  110  and deception center  108  may be able to learn their respective locations on the network. Alternatively or additionally, a network administrator can configure the sensors  110  with the network location of the deception center  108 , and vice versa. 
     In various implementations, the sensors  110  are a minimal combination of hardware and/or software, sufficient to form a network connection with the site network  104  and a tunnel  120  with the deception center  108 . For example, a sensor  110  may be constructed using a low-power processor, a network interface, and a simple operating system. In various implementations, the sensors  110  provide the deception center  108  with visibility into the site network  104 , such as for example being able to operate as a node in the site network  104 , and/or being able to present or project deceptive security mechanisms into the site network  104 , as described further below. Additionally, in various implementations, the sensors  110  may provide a portal through which a suspected attack on the site network  104  can be redirected to the deception center  108 , as is also described below. 
     In various implementations, the deception center  108  may be configured to profile the site network  104 , deploy deceptive security mechanisms for the site network  104 , detect suspected threats to the site network  104 , analyze the suspected threat, and analyze the site network  104  for exposure and/or vulnerability to the supposed threat. 
     To provide the site network  104 , the deception center  108  may include a deception profiler  130 . In various implementations, the deception profiler may  130  derive information  114  from the site network  104 , and determine, for example, the topology of the site network  104 , the network devices included in the site network  104 , the software and/or hardware configuration of each network device, and/or how the network is used at any given time. Using this information, the deception profiler  130  may determine one or more deceptive security mechanisms to deploy into the site network  104 . 
     In various implementations, the deception profiler may configure an emulated network  116  to emulate one or more computing systems. Using the tunnels  120  and sensors  110 , the emulated computing systems may be projected into the site network  104 , where they serve as deceptions. The emulated computing systems may include address deceptions, low-interaction deceptions, and/or high-interaction deceptions. In some implementations, the emulated computing systems may be configured to resemble a portion of the network. In these implementations, this network portion may then be projected into the site network  104 . 
     In various implementations, a network threat detection engine  140  may monitor activity in the emulated network  116 , and look for attacks on the site network  104 . For example, the network threat detection engine  140  may look for unexpected access to the emulated computing systems in the emulated network  116 . The network threat detection engine  140  may also use information  114  extracted from the site network  104  to adjust the emulated network  116 , in order to make the deceptions more attractive to an attack, and/or in response to network activity that appears to be an attack. Should the network threat detection engine  140  determine that an attack may be taking place, the network threat detection engine  140  may cause network activity related to the attack to be redirected to and contained within the emulated network  116 . 
     In various implementations, the emulated network  116  is a self-contained, isolated, and closely monitored network, in which suspect network activity may be allowed to freely interact with emulated computing systems. In various implementations, questionable emails, files, and/or links may be released into the emulated network  116  to confirm that they are malicious, and/or to see what effect they have. Outside actors can also be allowed to access emulated system, steal data and user credentials, download malware, and conduct any other malicious activity. In this way, the emulated network  116  not only isolated a suspected attack from the site network  104 , but can also be used to capture information about an attack. Any activity caused by suspect network activity may be captured in, for example, a history of sent and received network packets, log files, and memory snapshots. 
     In various implementations, activity captured in the emulated network  116  may be analyzed using a targeted threat analysis engine  160 . The threat analysis engine  160  may examine data collected in the emulated network  116  and reconstruct the course of an attack. For example, the threat analysis engine  160  may correlate various events seen during the course of an apparent attack, including both malicious and innocuous events, and determine how an attacker infiltrated and caused harm in the emulated network  116 . In some cases, the threat analysis engine  160  may use threat intelligence  152  from the Internet  150  to identify and/or analyze an attack contained in the emulated network  116 . The threat analysis engine  160  may also confirm that suspect network activity was not an attack. The threat analysis engine  160  may produce indicators that describe the suspect network activity, including indicating whether the suspect activity was or was not an actual threat. The threat analysis engine  160  may share these indicators with the security community  180 , so that other networks can be defended from the attack. The threat analysis engine  160  may also send the indicators to the security services provider  106 , so that the security services provider  106  can use the indicators to defend other site networks. 
     In various implementations, the threat analysis engine  160  may also send threat indicators, or similar data, to a behavioral analytics engine  170 . The behavioral analytics engine  170  may be configured to use the indicators to probe  118  the site network  104 , and see whether the site network  104  has been exposed to the attack, or is vulnerable to the attack. For example, the behavioral analytics engine  170  may search the site network  104  for computing systems that resemble emulated computing systems in the emulated network  116  that were affected by the attack. In some implementations, the behavioral analytics engine  170  can also repair systems affected by the attack, or identify these systems to a network administrator. In some implementations, the behavioral analytics engine  170  can also reconfigure the site network&#39;s  104  security infrastructure to defend against the attack. 
     In some implementations, the behavioral analytics engine  170  includes two engines that may be used to analyze a site network for an attack or suspected attack: an adversary trajectory engine  190  and a similarity engine  185 . 
     The adversary trajectory engine  190  may analyze the various ways in which an attack may have occurred in a site network. Using this information, and possibly also other indicators (e.g., attributes as described in  FIGS. 12-22  below), the adversary trajectory engine  190  may trace the possible path of a specific incident in the site network. This path may point to network devices in the site network that could have been affected by the incident. These network devices can be checked to determine whether they have, in fact, been affected. 
     The similarity engine  185  may use the indicators to identify similar hosts. For example, given emulated network devices in the network, the similarity engine  185  may determine query items from, for example, the indicators, and use the query items to identify similar network devices (e.g., candidate items) in the site network. In some examples, similarity engine  185  can evaluate attributes of a known compromised device against attributes of other devices in the network. When the attributes of devices in the network are similar to attributes of the known compromised device, similarity engine  185  can identify these devices as candidate items (e.g., potentially compromised devices). Further, similarity engine  185  can determine weights for attributes to assess a severity of the threat posed by each of the candidate items and the known compromised device. Alternatively or additionally, the similarity engine  185  may receive query items generated from network devices in the site network, and may use those query items to find similar network devices in the site network. The similarity engine  185  is described in further detail below with respect to  FIGS. 12-22 . 
     The adversary trajectory engine  190  and the similarity engine  185  are each described in further detail below. 
     Using the adversary trajectory engine  190  and/or the similarity engine  185 , the behavioral analytics engine  170  may produce a network analysis. The network analysis may indicate, for example, whether the site network has been exposed to a particular attack, which (if any) network devices may have been affected by the attack, how the network devices were affected by the attack, and/or how the site network&#39;s security can be improved. The network analysis can be used to scrub the effects of an attack from the site network, and/or to increase the security of the site network. 
     The behavioral analytics engine  170  can work in conjunction with a Security Information and Event Management (SIEM)  172  system. In various implementations, SIEM includes software and/or services that can provide real-time analysis of security alerts generates by network hardware and applications. In various implementations, the deception center  108  can communicate with the SIEM  172  system to obtain information about computing and/or networking systems in the site network  104 . 
     Using deceptive security mechanisms, the network security system  100  may thus be able to distract and divert attacks on the site network  104 . The network security system  100  may also be able to allow, using the emulated network  116 , and attack to proceed, so that as much can be learned about the attack as possible. Information about the attack can then be used to find vulnerabilities in the site network  104 . Information about the attack can also be provided to the security community  180 , so that the attack can be thwarted elsewhere. 
     II. Customer Installations 
     The network security system, such as the deception-based system described above, may be flexibly implemented to accommodate different customer networks.  FIGS. 2A-2D  provide examples of different installation configurations  200   a - 200   d  that can be used for different customer networks  202 . A customer network  202  may generally be described as a network or group of networks that is controlled by a common entity, such as a business, a school, or a person. The customer network  202  may include one or more site networks  204 . The customer network&#39;s  202  site networks  204  may be located in one geographic location, may be behind a common firewall, and/or may be multiple subnets within one network. Alternatively or additionally, a customer network&#39;s  202  site networks  204  may be located in different geographic locations, and be connected to each other over various private and public networks, including the Internet  250 . 
     Different customer networks  202  may have different requirements regarding network security. For example, some customer networks  202  may have relatively open connections to outside networks such as the Internet  250 , while other customer networks  202  have very restricted access to outside networks. The network security system described in  FIG. 1  may be configurable to accommodate these variations. 
       FIG. 2A  illustrates one example of an installation configuration  200   a , where a deception center  208  is located within the customer network  202 . In this example, being located within the customer network  202  means that the deception center  208  is connected to the customer network  202 , and is able to function as a node in the customer network  202 . In this example, the deception center  208  may be located in the same building or within the same campus as the site network  204 . Alternatively or additionally, the deception center  208  may be located within the customer network  202  but at a different geographic location than the site network  204 . The deception center  208  thus may be within the same subnet as the site network  204 , or may be connected to a different subnet within the customer network. 
     In various implementations, the deception center  208  communicates with sensors  210 , which may also be referred to as deception sensors, installed in the site network over network tunnels  220  In this example, the network tunnels  220  may cross one or more intermediate within the customer network  202 . 
     In this example, the deception center  208  is able to communicate with a security services provider  206  that is located outside the customer network  202 , such as on the Internet  250 . The security services provider  206  may provide configuration and other information for the deception center  208 . In some cases, the security services provider  206  may also assist in coordinating the security for the customer network  202  when the customer network  202  includes multiple site networks  204  located in various geographic areas. 
       FIG. 2B  illustrates another example of an installation configuration  200   b , where the deception center  208  is located outside the customer network  202 . In this example, the deception center  208  may connected to the customer network  202  over the Internet  250 . In some implementations, the deception center  208  may be co-located with a security services provider, and/or may be provided by the security services provider. 
     In this example, the tunnels  220  connect the deception center  208  to the sensors  210  through a gateway  262 . A gateway is a point in a network that connects the network to another network. For example, in this example, the gateway  262  connects the customer network  202  to outside networks, such as the Internet  250 . The gateway  262  may provide a firewall, which may provide some security for the customer network  202 . The tunnels  220  may be able to pass through the firewall using a secure protocol, such as Secure Socket Shell (SSH) and similar protocols. Secure protocols typically require credentials, which may be provided by the operator of the customer network  202 . 
       FIG. 2C  illustrates another example of an installation configuration  200   c , where the deception center  208  is located inside the customer network  202  but does not have access to outside networks. In some implementations, the customer network  202  may require a high level of network security. In these implementations, the customer network&#39;s  202  connections to the other networks may be very restricted. Thus, in this example, the deception center  208  is located within the customer network  202 , and does not need to communicate with outside networks. The deception center  208  may use the customer networks  202  internal network to coordinate with and establish tunnels  220  to the sensors  210 . Alternatively or additionally, a network administrator may configure the deception center  208  and sensors  210  to enable them to establish the tunnels  220 . 
       FIG. 2D  illustrates another example of an installation configuration  200   d . In this example, the deception center  208  is located inside the customer network  202 , and further is directly connected to the site network  204 . Directly connected, in this example, can mean that the deception center  208  is connected to a router, hub, switch, repeater, or other network infrastructure device that is part of the site network  204 . Directly connected can alternatively or additionally mean that the deception center  208  is connected to the site network  204  using a Virtual Local Area Network (VLAN). For example, the deception center  208  can be connected to VLAN trunk port. In these examples, the deception center  208  can project deceptions into the site network  204  with or without the use of sensors, such as are illustrated in  FIGS. 2A-2C . 
     In the example of  FIG. 2D , the deception center  208  can also optionally be connected to an outside security services provider  206 . The security services provider  206  can manage the deception center  208 , including providing updated security data, sending firmware upgrades, and/or coordinating different deception centers  208  for different site networks  204  belonging to the same customer network  202 . In some implementations, the deception center  208  can operate without the assistances of an outside security services provider  206 . 
     III. Customer Networks 
     The network security system, such as the deception-based system discussed above, can be used for variety of customer networks. As noted above, customer networks can come in wide variety of configurations. For example, a customer network may have some of its network infrastructure “in the cloud.” A customer network can also include a wide variety of devices, including what may be considered “traditional” network equipment, such as servers and routers, and non-traditional, “Internet-of-Things” devices, such as kitchen appliances. Other examples of customer networks include established industrial networks, or a mix of industrial networks and computer networks. 
       FIG. 3A-3B  illustrate examples of customer networks  302   a - 302   b  where some of the customer networks&#39;  302   a - 302   b  network infrastructure is “in the cloud,” that is, is provided by a cloud services provider  354 . These example customer networks  302   a - 302   b  may be defended by a network security system that includes a deception center  308  and sensors  310 , which may also be referred to as deception sensors, and may also include an off-site security services provider  306 . 
     A cloud services provider is a company that offers some component of cloud computer—such as Infrastructure as a Service (IaaS), Software as a Service (SaaS) or Platform as Service (PaaS)—to other businesses and individuals. A cloud services provider may have a configurable pool of computing resources, including, for example, networks, servers, storage, applications, and services. These computing resources can be available on demand, and can be rapidly provisioned. While a cloud services provider&#39;s resources may be shared between the cloud service provider&#39;s customers, from the perspective of each customer, the individual customer may appear to have a private network within the cloud, including for example having dedicated subnets and IP addresses. 
     In the examples illustrated in  FIGS. 3A-3B , the customer networks&#39;  302   a - 302   b  network is partially in a site network  304 , and partially provided by the cloud services provider  354 . In some cases, the site network  304  is the part of the customer networks  302   a - 302   b  that is located at a physical site owned or controlled by the customer network  302   a - 302   b . For example, the site network  304  may be a network located in the customer network&#39;s  302   a - 302   b  office or campus. Alternatively or additionally, the site network  304  may include network equipment owned and/or operated by the customer network  302  that may be located anywhere. For example, the customer networks&#39;  302   a - 302   b  operations may consist of a few laptops owned by the customer networks  302   a - 302   b , which are used from the private homes of the lap tops&#39; users, from a co-working space, from a coffee shop, or from some other mobile location. 
     In various implementations, sensors  310  may be installed in the site network  304 . The sensors  310  can be used by the network security system to project deceptions into the site network  304 , monitor the site network  304  for attacks, and/or to divert suspect attacks into the deception center  308 . 
     In some implementations, the sensors  310  may also be able to project deceptions into the part of the customer networks  302   a - 302   b  network that is provided by the cloud services provider  354 . In most cases, it may not be possible to install sensors  310  inside the network of the cloud services provider  354 , but in some implementations, this may not be necessary. For example, as discussed further below, the deception center  308  can acquire the subnet address of the network provided by the cloud services provider  354 , and use that subnet address the create deceptions. Though these deceptions are projected form the sensors  310  installed in the site network  304 , the deceptions may appear to be within the subnet provided by the cloud services provider  354 . 
     In illustrated examples, the deception center  308  is installed inside the customer networks  302   a - 302   b . Though not illustrated here, the deception center  308  can also be installed outside the customer networks  302   a - 302   b , such as for example somewhere on the Internet  350 . In some implementations, the deception center  308  may reside at the same location as the security service provider  306 . When located outside the customer networks  302   a - 302   b , the deception center  308  may connect to the sensors  310  in the site network  304  over various public and/or private networks. 
       FIG. 3A  illustrates an example of a configuration  300   a  where the customer network&#39;s  302   a  network infrastructure is located in the cloud and the customer network  302   a  also has a substantial site network  304 . In this example, the customer may have an office where the site network  304  is located, and where the customer&#39;s employees access and use the customer network  302   a . For example, developers, sales and marketing personnel, human resources and finance employees, may access the customer network  302   a  from the site network  304 . In the illustrated example, the customer may obtain applications and services from the cloud services provider  354 . Alternatively or additionally, the cloud services provider  354  may provide data center services for the customer. For example, the cloud services provider  354  may host the customer&#39;s repository of data (e.g., music provided by a streaming music service, or video provided by a streaming video provider). In this example, the customer&#39;s own customers may be provided data directly from the cloud services provider  354 , rather than from the customer network  302   a.    
       FIG. 3B  illustrates and example of a configuration  300   b  where the customer network&#39;s  302   b  network is primarily or sometimes entirely in the cloud. In this example, the customer network&#39;s  302   b  site network  304  may include a few laptops, or one or two desktop servers. These computing devices may be used by the customer&#39;s employees to conduct the customer&#39;s business, while the cloud services provider  354  provides the majority of the network infrastructure needed by the customer. For example, a very small company may have no office space and no dedicated location, and have as computing resources only the laptops used by its employees. This small company may use the cloud services provider  354  to provide its fixed network infrastructure. The small company may access this network infrastructure by connecting a laptop to any available network connection (e.g., in a co-working space, library, or coffee shop). When no laptops are connected to the cloud services provider  354 , the customer network  302  may be existing entirely within the cloud. 
     In the example provided above, the site network  304  can be found wherever the customer&#39;s employees connect to a network and can access the cloud services provider  354 . Similarly, the sensors  310  can be co-located with the employees&#39; laptops. For example, whenever an employee connects to a network, she can enable a sensor  310 , which can then project deceptions into the network around her. Alternatively or additionally, sensors  310  can be installed in a fixed location (such as the home of an employee of the customer) from which they can access the cloud services provider  354  and project deceptions into the network provided by the cloud services provider  354 . 
     The network security system, such as the deception-based system discussed above, can provide network security for a variety of customer networks, which may include a diverse array of devices.  FIG. 4  illustrates an example of an enterprise network  400 , which is one such network that can be defended by a network security system. The example enterprise network  400  illustrates examples of various network devices and network clients that may be included in an enterprise network. The enterprise network  400  may include more or fewer network devices and/or network clients, and/or may include network devices, additional networks including remote sites  452 , and/or systems not illustrated here. Enterprise networks may include networks installed at a large site, such as a corporate office, a university campus, a hospital, a government office, or a similar entity. An enterprise network may include multiple physical sites. Access to an enterprise networks is typically restricted, and may require authorized users to enter a password or otherwise authenticate before using the network. A network such as illustrated by the example enterprise network  400  may also be found at small sites, such as in a small business. 
     The enterprise network  400  may be connected to an external network  450 . The external network  450  may be a public network, such as the Internet. A public network is a network that has been made accessible to any device that can connect to it. A public network may have unrestricted access, meaning that, for example, no password or other authentication is required to connect to it. The external network  450  may include third-party telecommunication lines, such as phone lines, broadcast coaxial cable, fiber optic cables, satellite communications, cellular communications, and the like. The external network  450  may include any number of intermediate network devices, such as switches, routers, gateways, servers, and/or controllers that are not directly part of the enterprise network  400  but that facilitate communication between the network  400  and other network-connected entities, such as a remote site  452 . 
     Remote sites  452  are networks and/or individual computers that are generally located outside the enterprise network  400 , and which may be connected to the enterprise network  400  through intermediate networks, but that function as if within the enterprise network  400  and connected directly to it. For example, an employee may connect to the enterprise network  400  while at home, using various secure protocols, and/or by connecting to a Virtual Private Network (VPN) provided by the enterprise network  400 . While the employee&#39;s computer is connected, the employee&#39;s home is a remote site  452 . Alternatively or additionally, the enterprise network&#39;s  400  owner may have a satellite office with a small internal network. This satellite office&#39;s network may have a fixed connection to the enterprise network  400  over various intermediate networks. This satellite office can also be considered a remote site. 
     The enterprise network  400  may be connected to the external network  450  using a gateway device  404 . The gateway device  404  may include a firewall or similar system for preventing unauthorized access while allowing authorized access to the enterprise network  400 . Examples of gateway devices include routers, modems (e.g. cable, fiber optic, dial-up, etc.), and the like. 
     The gateway device  404  may be connected to a switch  406   a . The switch  406   a  provides connectivity between various devices in the enterprise network  400 . In this example, the switch  406   a  connects together the gateway device  404 , various servers  408 ,  412 ,  414 ,  416 ,  418 , an another switch  406   b . A switch typically has multiple ports, and functions to direct packets received on one port to another port. In some implementations, the gateway device  404  and the switch  406   a  may be combined into a single device. 
     Various servers may be connected to the switch  406   a . For example, a print server  408  may be connected to the switch  406   a . The print server  408  may provide network access to a number of printers  410 . Client devices connected to the enterprise network  400  may be able to access one of the printers  410  through the printer server  408 . 
     Other examples of servers connected to the switch  406   a  include a file server  412 , database server  414 , and email server  416 . The file server  412  may provide storage for and access to data. This data may be accessible to client devices connected to the enterprise network  400 . The database server  414  may store one or more databases, and provide services for accessing the databases. The email server  416  may host an email program or service, and may also store email for users on the enterprise network  400 . 
     As yet another example, a server rack  418  may be connected to the switch  406 . The server rack  418  may house one or more rack-mounted servers. The server rack  418  may have one connection to the switch  406   a , or may have multiple connections to the switch  406   a . The servers in the server rack  418  may have various purposes, including providing computing resources, file storage, database storage and access, and email, among others. 
     An additional switch  406   b  may also be connected to the first switch  406   a . The additional switch  406   b  may be provided to expand the capacity of the network. A switch typically has a limited number of ports (e.g., 8, 16, 32, 64 or more ports). In most cases, however, a switch can direct traffic to and from another switch, so that by connecting the additional switch  406   b  to the first switch  406   a , the number of available ports can be expanded. 
     In this example, a server  420  is connected to the additional switch  406   b . The server  420  may manage network access for a number of network devices or client devices. For example, the server  420  may provide network authentication, arbitration, prioritization, load balancing, and other management services as needed to manage multiple network devices accessing the enterprise network  400 . The server  420  may be connected to a hub  422 . The hub  422  may include multiple ports, each of which may provide a wired connection for a network or client device. A hub is typically a simpler device than a switch, and may be used when connecting a small number of network devices together. In some cases, a switch can be substituted for the hub  422 . In this example, the hub  422  connects desktop computers  424  and laptop computers  426  to the enterprise network  400 . In this example, each of the desktop computers  424  and laptop computers  426  are connected to the hub  422  using a physical cable. 
     In this example, the additional switch  406   b  is also connected to a wireless access point  428 . The wireless access point  428  provides wireless access to the enterprise network  400  for wireless-enabled network or client devices. Examples of wireless-enabled network and client devices include laptops  430 , tablet computers  432 , and smart phones  434 , among others. In some implementations, the wireless access point  428  may also provide switching and/or routing functionality. 
     The example enterprise network  400  of  FIG. 4  is defended from network threats by a network threat detection and analysis system, which uses deception security mechanisms to attract and divert attacks on the network. The deceptive security mechanisms may be controlled by and inserted into the enterprise network  400  using a deception center  498  and sensors  490 , which may also be referred to as deception sensors, installed in various places in the enterprise network  400 . In some implementations, the deception center  498  and the sensors  490  interact with a security services provider  496  located outside of the enterprise network  400 . The deception center  498  may also obtain or exchange data with sources located on external networks  450 , such as the Internet. 
     In various implementations, the sensors  490  are a minimal combination of hardware and/or software, sufficient to form a network connection with the enterprise network  400  and a network tunnel  480  with the deception center  498 . For example, a sensor  490  may be constructed using a low-power processor, a network interface, and a simple operating system. In some implementations, any of the devices in the enterprise network (e.g., the servers  408 ,  412 ,  416 ,  418  the printers  410 , the computing devices  424 ,  426 ,  430 ,  432 ,  434 , or the network infrastructure devices  404 ,  406   a ,  406   b ,  428 ) can be configured to act as a sensor. 
     In various implementations, one or more sensors  490  can be installed anywhere in the enterprise network  400 , include being attached switches  406   a , hubs  422 , wireless access points  428 , and so on. The sensors  490  can further be configured to be part of one or more VLANs. The sensors  490  provide the deception center  498  with visibility into the enterprise network  400 , such as for example being able to operate as a node in the enterprise network  400 , and/or being able to present or project deceptive security mechanisms into the enterprise network  400 . Additionally, in various implementations, the sensors  490  may provide a portal through which a suspected attack on the enterprise network  400  can be redirected to the deception center  498 . 
     The deception center  498  provides network security for the enterprise network  400  by deploying security mechanisms into the enterprise network  400 , monitoring the enterprise network  400  through the security mechanisms, detecting and redirecting apparent threats, and analyzing network activity resulting from the apparent threat. To provide security for the enterprise network  400 , in various implementations the deception center  498  may communicate with sensors  490  installed in the enterprise network  400 , using, for example, network tunnels  480 . The tunnels  480  may allow the deception center  498  to be located in a different sub-network (“subnet”) than the enterprise network  400 , on a different network, or remote from the enterprise network  400 , with intermediate networks between the deception center  498  and the enterprise network  400 . In some implementations, the enterprise network  400  can include more than one deception center  498 . In some implementations, the deception center may be located off-site, such as in an external network  450 . 
     In some implementations, the security services provider  496  may act as a central hub for providing security to multiple site networks, possibly including site networks controlled by different organizations. For example, the security services provider  496  may communicate with multiple deception centers  498  that each provide security for a different enterprise network  400  for the same organization. As another example, the security services provider  496  may coordinate the activities of the deception center  498  and the sensors  490 , such as enabling the deception center  498  and the sensors  490  to connect to each other. In some implementations, the security services provider  496  is located outside the enterprise network  400 . In some implementations, the security services provider  496  is controlled by a different entity than the entity that controls the site network. For example, the security services provider  496  may be an outside vendor. In some implementations, the security services provider  496  is controlled by the same entity as that controls the enterprise network  400 . In some implementations, the network security system does not include a security services provider  496 . 
       FIG. 4  illustrates one example of what can be considered a “traditional” network, that is, a network that is based on the interconnection of computers. In various implementations, a network security system, such as the deception-based system discussed above, can also be used to defend “non-traditional” networks that include devices other than traditional computers, such as for example mechanical, electrical, or electromechanical devices, sensors, actuators, and control systems. Such “non-traditional” networks may be referred to as the Internet of Things (IoT). The Internet of Things encompasses newly-developed, every-day devices designed to be networked (e.g., drones, self-driving automobiles, etc.) as well as common and long-established machinery that has augmented to be connected to a network (e.g., home appliances, traffic signals, etc.). 
       FIG. 5  illustrates a general example of an IoT network  500 . The example IoT network  500  can be implemented wherever sensors, actuators, and control systems can be found. For example, the example IoT network  500  can be implemented for buildings, roads and bridges, agriculture, transportation and logistics, utilities, air traffic control, factories, and private homes, among others. In various implementations, the IoT network  500  includes cloud service  554  that collects data from various sensors  510   a - 510   d ,  512   a - 512   d , located in various locations. Using the collected data, the cloud service  554  can provide services  520 , control of machinery and equipment  514 , exchange of data with traditional network devices  516 , and/or exchange of data with user devices  518 . In some implementations, the cloud service  554  can work with a deception center  528  and/or a security service provider  526  to provide security for the network  500 . 
     A cloud service, such as the illustrated cloud service  554 , is a resource provided over the Internet  550 . Sometimes synonymous with “cloud computing,” the resource provided by the cloud services is in the “cloud” in that the resource is provided by hardware and/or software at some location remote from the place where the resource is used. Often, the hardware and software of the cloud service is distributed across multiple physical locations. Generally, the resource provided by the cloud service is not directly associated with specific hardware or software resources, such that use of the resource can continue when the hardware or software is changed. The resource provided by the cloud service can often also be shared between multiple users of the cloud service, without affecting each user&#39;s use. The resource can often also be provided as needed or on-demand. Often, the resource provided by the cloud service  554  is automated, or otherwise capable of operating with little or no assistance from human operators. 
     Examples of cloud services include software as a service (SaaS), infrastructure as a service (IaaS), platform as a service (PaaS), desktop as a service (DaaS), managed software as a service (MSaaS), mobile backend as a service (MBaaS), and information technology management as a service (ITMaas). Specific examples of cloud services include data centers, such as those operated by Amazon Web Services and Google Web Services, among others, that provide general networking and software services. Other examples of cloud services include those associated with smartphone applications, or “apps,” such as for example apps that track fitness and health, apps that allow a user to remotely manage her home security system or thermostat, and networked gaming apps, among others. In each of these examples, the company that provides the app may also provide cloud-based storage of application data, cloud-based software and computing resources, and/or networking services. In some cases, the company manages the cloud services provided by the company, including managing physical hardware resources. In other cases, the company leases networking time from a data center provider. 
     In some cases, the cloud service  554  is part of one integrated system, run by one entity. For example, the cloud service  554  can be part of a traffic control system. In this example, sensors  510   a - 510   d ,  512   a - 512   d  can be used to monitor traffic and road conditions. In this example, the cloud service  554  can attempt to optimize the flow of traffic and also provide traffic safety. For example, the sensors  510   a - 510   d ,  512   a - 512   d  can include a sensor  512   a  on a bridge that monitors ice formation. When the sensor  512   a  detects that ice has formed on the bridge, the sensor  512   a  can alert the cloud service  554 . The cloud service  554 , can respond by interacting with machinery and equipment  514  that manages traffic in the area of the bridge. For example, the cloud service  554  can turn on warning signs, indicating to drivers that the bridge is icy. Generally, the interaction between the sensor  512 , the cloud service  554 , and the machinery and equipment  514  is automated, requiring little or no management by human operators. 
     In various implementations, the cloud service  554  collects or receives data from sensors  510   a - 510   d ,  512   a - 512   d , distributed across one or more networks. The sensors  510   a - 510   d ,  512   a - 512   d  include devices capable of “sensing” information, such as air or water temperature, air pressure, weight, motion, humidity, fluid levels, noise levels, and so on. The sensors  510   a - 510   d ,  512   a - 512   d  can alternatively or additionally include devices capable of receiving input, such as cameras, microphones, touch pads, keyboards, key pads, and so on. In some cases, a group of sensors  510   a - 510   d  may be common to one customer network  502 . For example, the sensors  510   a - 510   d  may be motion sensors, traffic cameras, temperature sensors, and other sensors for monitoring traffic in a city&#39;s metro area. In this example, the sensors  510   a - 510   d  can be located in one area of the city, or be distribute across the city, and be connected to a common network. In these cases, the sensors  510   a - 510   d  can communicate with a gateway device  562 , such as a network gateway. The gateway device  562  can further communicate with the cloud service  554 . 
     In some cases, in addition to receiving data from sensors  510   a - 510   d  in one customer network  502 , the cloud service  554  can also receive data from sensors  512   a - 512   d  in other sites  504   a - 504   c . These other sites  504   a - 504   c  can be part of the same customer network  502  or can be unrelated to the customer network  502 . For example, the other sites  504   a - 504   c  can each be the metro area of a different city, and the sensors  512   a - 512   d  can be monitoring traffic for each individual city. 
     Generally, communication between the cloud service  554  and the sensors  510   a - 510   d ,  512   a - 512   d  is bidirectional. For example, the sensors  510   a - 510   d ,  512   a - 512   d  can send information to the cloud service  554 . The cloud service  554  can further provide configuration and control information to the sensors  510   a - 510   d ,  512   a - 512   d . For example, the cloud service  554  can enable or disable a sensor  510   a - 510   d ,  512   a - 512   d  or modify the operation of a sensor  510   a - 510   d ,  512   a - 512   d , such as changing the format of the data provided by a sensor  510   a - 510   d ,  512   a - 512   d  or upgrading the firmware of a sensor  510   a - 510   d ,  512   a - 512   d.    
     In various implementations, the cloud service  554  can operate on the data received from the sensors  510   a - 510   d ,  512   a - 512   d , and use this data to interact with services  520  provided by the cloud service  554 , or to interact with machinery and equipment  514 , network devices  516 , and/or user devices  518  available to the cloud service  554 . Services  520  can include software-based services, such as cloud-based applications, website services, or data management services. Services  520  can alternatively or additionally include media, such as streaming video or music or other entertainment services. Services  520  can also include delivery and/or coordination of physical assets, such as for example package delivery, direction of vehicles for passenger pickup and drop-off, or automate re-ordering and re-stocking of supplies. In various implementations, services  520  may be delivered to and used by the machinery and equipment  514 , the network devices  516 , and/or the user devices  518 . 
     In various implementations, the machinery and equipment  514  can include physical systems that can be controlled by the cloud service  554 . Examples of machinery and equipment  514  include factory equipment, trains, electrical street cars, self-driving cars, traffic lights, gate and door locks, and so on. In various implementations, the cloud service  554  can provide configuration and control of the machinery and equipment  514  in an automated fashion. 
     The network devices  516  can include traditional networking equipment, such as server computers, data storage devices, routers, switches, gateways, and so on. In various implementations, the cloud service  554  can provide control and management of the network devices  516 , such as for example automated upgrading of software, security monitoring, or asset tracking. Alternatively or additionally, in various implementations the cloud service  554  can exchange data with the network devices  516 , such as for example providing websites, providing stock trading data, or providing online shopping resources, among others. Alternatively or additionally, the network devices  516  can include computing systems used by the cloud service provider to manage the cloud service  554 . 
     The user devices  518  can include individual personal computers, smart phones, tablet devices, smart watches, fitness trackers, medical devices, and so on that can be associated with an individual user. The cloud service  554  can exchange data with the user devices  518 , such as for example provide support for applications installed on the user devices  518 , providing websites, providing streaming media, providing directional navigation services, and so on. Alternatively or additionally, the cloud service  554  may enable a user to use a user device  518  to access and/or view other devices, such as the sensors  510   a - 510   d ,  512   a - 512   d , the machinery and equipment  514 , or the network devices  516 . 
     In various implementations, the services  520 , machinery and equipment  514 , network devices  516 , and user devices  518  may be part of one customer network  506 . In some cases, this customer network  506  is the same as the customer network  502  that includes the sensors  510   a - 510   d . In some cases, the services  520 , machinery and equipment  514 , network devices  516 , and user devices  518  are part of the same network, and may instead be part of various other networks  506 . 
     In various implementations, customer networks can include a deception center  598 . The deception center  598  provides network security for the IoT network  500  by deploying security mechanisms into the IoT network  500 , monitoring the IoT network  500  through the security mechanisms, detecting and redirecting apparent threats, and analyzing network activity resulting from the apparent threat. To provide security for the IoT network  500 , in various implementations the deception center  598  may communicate with the sensors  510   a - 5106   d ,  512   a - 5012  installed in the IoT network  500 , for example through the cloud service  554 . In some implementations, the IoT network  500  can include more than one deception center  598 . For example, each of customer network  502  and customer networks or other networks  506  can include a deception center  528 . 
     In some implementations, the deception center  598  and the sensors  510   a - 510   d ,  512   a - 512   d  interact with a security services provider  596 . In some implementations, the security services provider  596  may act as a central hub for providing security to multiple site networks, possibly including site networks controlled by different organizations. For example, the security services provider  596  may communicate with multiple deception centers  598  that each provide security for a different IoT network  500  for the same organization. As another example, the security services provider  596  may coordinate the activities of the deception center  598  and the sensors  510   a - 510   d ,  512   a - 512   d , such as enabling the deception center  598  and the sensors  510   a - 510   d ,  512   a - 512   d  to connect to each other. In some implementations, the security services provider  596  is integrated into the cloud service  554 . In some implementations, the security services provider  596  is controlled by a different entity than the entity that controls the site network. For example, the security services provider  596  may be an outside vendor. In some implementations, the security services provider  596  is controlled by the same entity as that controls the IoT network  500 . In some implementations, the network security system does not include a security services provider  596 . 
     IoT networks can also include small networks of non-traditional devices.  FIG. 6  illustrates an example of a customer network that is a small network  600 , here implemented in a private home. A network for a home is an example of small network that may have both traditional and non-traditional network devices connected to the network  600 , in keeping with an Internet of Things approach. Home networks are also an example of networks that are often implemented with minimal security. The average homeowner is not likely to be a sophisticated network security expert, and may rely on his modem or router to provide at least some basic security. The homeowner, however, is likely able to at least set up a basic home network. A deception-based network security device may be as simple to set up as a home router or base station, yet provide sophisticated security for the network  600 . 
     The example network  600  of  FIG. 6  may be a single network, or may include multiple sub-networks. These sub-networks may or may not communicate with each other. For example, the network  600  may include a sub-network that uses the electrical wiring in the house as a communication channel. Devices configured to communicate in this way may connect to the network using electrical outlets, which also provide the devices with power. The sub-network may include a central controller device, which may coordinate the activities of devices connected to the electrical network, including turning devices on and off at particular times. One example of a protocol that uses the electrical wiring as a communication network is X10. 
     The network  600  may also include wireless and wired networks, built into the home or added to the home solely for providing a communication medium for devices in the house. Examples of wireless, radio-based networks include networks using protocols such as Z-Wave™, Zigbee™ (also known as Institute of Electrical and Electronics Engineers (IEEE) 802.15.4), Bluetooth™, and Wi-Fi (also known as IEEE 802.11), among others. Wireless networks can be set up by installing a wireless base station in the house. Alternatively or additionally, a wireless network can be established by having at least two devices in the house that are able to communicate with each other using the same protocol. 
     Examples of wired networks include Ethernet (also known as IEEE 802.3), token ring (also known as IEEE 802.5), Fiber Distributed Data Interface (FDDI), and Attached Resource Computer Network (ARCNET), among others. A wired network can be added to the house by running cabling through the walls, ceilings, and/or floors, and placing jacks in various rooms that devices can connect to with additional cables. The wired network can be extended using routers, switches, and/or hubs. In many cases, wired networks may be interconnected with wireless networks, with the interconnected networks operating as one seamless network. For example, an Ethernet network may include a wireless base station that provides a Wi-Fi signal for devices in the house. 
     As noted above, a small network  600  implemented in a home is one that may include both traditional network devices and non-traditional, everyday electronics and appliances that have also been connected to the network  600 . Examples of rooms where one may find non-traditional devices connected to the network are the kitchen and laundry rooms. For example, in the kitchen a refrigerator  604 , oven  606 , microwave  608 , and dishwasher  610  may be connected to the network  600 , and in the laundry room a washing machine  612  may be connected to the network  600 . By attaching these appliances to the network  600 , the homeowner can monitor the activity of each device (e.g., whether the dishes are clean, the current state of a turkey in the oven, or the washing machine cycle) or change the operation of each device without needing to be in the same room or even be at home. The appliances can also be configured to resupply themselves. For example, the refrigerator  604  may detect that a certain product is running low, and may place an order with a grocery delivery service for the product to be restocked. 
     The network  600  may also include environmental appliances, such as a thermostat  602  and a water heater  614 . By having these devices connected to the network  600 , the homeowner can monitor the current environment of the house (e.g., the air temperature or the hot water temperature), and adjust the settings of these appliances while at home or away. Furthermore, software on the network  600  or on the Internet  650  may track energy usage for the heating and cooling units and the water heater  614 . This software may also track energy usage for the other devices, such as the kitchen and laundry room appliances. The energy usage of each appliance may be available to the homeowner over the network  600 . 
     In the living room, various home electronics may be on the network  600 . These electronics may have once been fully analog or may have been standalone devices, but now include a network connection for exchanging data with other devices in the network  600  or with the Internet  650 . The home electronics in this example include a television  618 , a gaming system  620 , and a media device  622  (e.g., a video and/or audio player). Each of these devices may play media hosted, for example, on network attached storage  636  located elsewhere in the network  600 , or media hosted on the Internet  650 . 
     The network  600  may also include home safety and security devices, such as a smoke detector  616 , an electronic door lock  624 , and a home security system  626 . Having these devices on the network may allow the homeowner to track the information monitored and/or sensed by these devices, both when the homeowner is at home and away from the house. For example, the homeowner may be able to view a video feed from a security camera  628 . When the safety and security devices detect a problem, they may also inform the homeowner. For example, the smoke detector  616  may send an alert to the homeowner&#39;s smartphone when it detects smoke, or the electronic door lock  624  may alert the homeowner when there has been a forced entry. Furthermore, the homeowner may be able to remotely control these devices. For example, the homeowner may be able to remotely open the electronic door lock  624  for a family member who has been locked out. The safety and security devices may also use their connection to the network to call the fire department or police if necessary. 
     Another non-traditional device that may be found in the network  600  is the family car  630 . The car  630  is one of many devices, such as laptop computers  638 , tablet computers  646 , and smartphones  642 , that connect to the network  600  when at home, and when not at home, may be able to connect to the network  600  over the Internet  650 . Connecting to the network  600  over the Internet  650  may provide the homeowner with remote access to his network. The network  600  may be able to provide information to the car  630  and receive information from the car  630  while the car is away. For example, the network  600  may be able to track the location of the car  630  while the car  630  is away. 
     In the home office and elsewhere around the house, this example network  600  includes some traditional devices connected to the network  600 . For example, the home office may include a desktop computer  632  and network attached storage  636 . Elsewhere around the house, this example includes a laptop computer  638  and handheld devices such as a tablet computer  646  and a smartphone  642 . In this example, a person  640  is also connected to the network  600 . The person  640  may be connected to the network  600  wirelessly through personal devices worn by the person  640 , such as a smart watch, fitness tracker, or heart rate monitor. The person  640  may alternatively or additionally be connected to the network  600  through a network-enabled medical device, such as a pacemaker, heart monitor, or drug delivery system, which may be worn or implanted. 
     The desktop computer  632 , laptop computer  638 , tablet computer  646 , and/or smartphone  642  may provide an interface that allows the homeowner to monitor and control the various devices connected to the network. Some of these devices, such as the laptop computer  638 , the tablet computer  646 , and the smartphone  642  may also leave the house, and provide remote access to the network  600  over the Internet  650 . In many cases, however, each device on the network may have its own software for monitoring and controlling only that one device. For example, the thermostat  602  may use one application while the media device  622  uses another, and the wireless network provides yet another. Furthermore, it may be the case that the various sub-networks in the house do not communicate with each other, and/or are viewed and controlled using software that is unique to each sub-network. In many cases, the homeowner may not have one unified and easily understood view of his entire home network  600 . 
     The small network  600  in this example may also include network infrastructure devices, such as a router or switch (not shown) and a wireless base station  634 . The wireless base station  634  may provide a wireless network for the house. The router or switch may provide a wired network for the house. The wireless base station  634  may be connected to the router or switch to provide a wireless network that is an extension of the wired network. The router or switch may be connected to a gateway device  648  that connects the network  600  to other networks, including the Internet  650 . In some cases, a router or switch may be integrated into the gateway device  648 . The gateway device  648  is a cable modem, digital subscriber line (DSL) modem, optical modem, analog modem, or some other device that connects the network  600  to an ISP. The ISP may provide access to the Internet  650 . Typically, a home network only has one gateway device  648 . In some cases, the network  600  may not be connected to any networks outside of the house. In these cases, information about the network  600  and control of devices in the network  600  may not be available when the homeowner is not connected to the network  600 ; that is, the homeowner may not have access to his network  600  over the Internet  650 . 
     Typically, the gateway device  648  includes a hardware and/or software firewall. A firewall monitors incoming and outgoing network traffic and, by applying security rules to the network traffic, attempts to keep harmful network traffic out of the network  600 . In many cases, a firewall is the only security system protecting the network  600 . While a firewall may work for some types of intrusion attempts originating outside the network  600 , the firewall may not block all intrusion mechanisms, particularly intrusions mechanisms hidden in legitimate network traffic. Furthermore, while a firewall may block intrusions originating on the Internet  650 , the firewall may not detect intrusions originating from within the network  600 . For example, an infiltrator may get into the network  600  by connecting to signal from the Wi-Fi base station  634 . Alternatively, the infiltrator may connect to the network  600  by physically connecting, for example, to the washing machine  612 . The washing machine  612  may have a port that a service technician can connect to service the machine. Alternatively or additionally, the washing machine  612  may have a simple Universal Serial Bus (USB) port. Once an intruder has gained access to the washing machine  612 , the intruder may have access to the rest of the network  600 . 
     To provide more security for the network  600 , a deception-based network security device  660  can be added to the network  600 . In some implementations, the security device  660  is a standalone device that can be added to the network  600  by connecting it to a router or switch. In some implementations, the security device  660  can alternatively or additionally be connected to the network&#39;s  600  wireless sub-network by powering on the security device  660  and providing it with Wi-Fi credentials. The security device  660  may have a touchscreen, or a screen and a keypad, for inputting Wi-Fi credentials. Alternatively or additionally, the homeowner may be able to enter network information into the security device by logging into the security device  660  over a Bluetooth™ or Wi-Fi signal using software on a smartphone, tablet, or laptop, or using a web browser. In some implementations, the security device  660  can be connected to a sub-network running over the home&#39;s electrical wiring by connecting the security device  660  to a power outlet. In some implementations, the security device  660  may have ports, interfaces, and/or radio antennas for connecting to the various sub-networks that can be included in the network  600 . This may be useful, for example, when the sub-networks do not communicate with each other, or do not communicate with each other seamlessly. Once powered on and connected, the security device  660  may self-configure and monitor the security of each sub-network in the network  600  that it is connected to. 
     In some implementations, the security device  660  may be configured to connect between the gateway device  648  and the network&#39;s  600  primary router, and/or between the gateway device  648  and the gateway device&#39;s  648  connection to the wall. Connected in one or both of these locations, the security device  660  may be able to control the network&#39;s  600  connection with outside networks. For example, the security device can disconnect the network  600  from the Internet  650 . 
     In some implementations, the security device  660 , instead of being implemented as a standalone device, may be integrated into one or more of the appliances, home electronics, or computing devices (in this example network  600 ), or in some other device not illustrated here. For example, the security device  660 —or the functionality of the security device  660 —may be incorporated into the gateway device  648  or a desktop computer  632  or a laptop computer  638 . As another example, the security device  660  can be integrated into a kitchen appliance (e.g., the refrigerator  604  or microwave  608 ), a home media device (e.g., the television  618  or gaming system  620 ), or the home security system  626 . In some implementations, the security device  660  may be a printed circuit board that can be added to another device without requiring significant changes to the other device. In some implementations, the security device  660  may be implemented using an Application Specific Integrated Circuit (ASIC) or Field Programmable Gate Array (FPGA) that can be added to the electronics of a device. In some implementations, the security device  660  may be implemented as a software module or modules that can run concurrently with the operating system or firmware of a networked device. In some implementations, the security device  660  may have a physical or virtual security barrier that prevents access to it by the device that it is integrated into. In some implementations, the security device&#39;s  660  presence in another device may be hidden from the device into which the security device  660  is integrated. 
     In various implementations, the security device  660  may scan the network  600  to determine which devices are present in the network  600 . Alternatively or additionally, the security device  660  may communicate with a central controller in the network  600  (or multiple central controllers, when there are sub-networks, each with their own central controller) to learn which devices are connected to the network  600 . In some implementations, the security device  660  may undergo a learning period, during which the security device  660  learns the normal activity of the network  600 , such as what time of day appliances and electronics are used, what they are used for, and/or what data is transferred to and from these devices. During the learning period, the security device  660  may alert the homeowner to any unusual or suspicious activity. The homeowner may indicate that this activity is acceptable, or may indicate that the activity is an intrusion. As described below, the security device  660  may subsequently take preventive action against the intrusion. 
     Once the security device  660  has learned the topology and/or activity of the network  600 , the security device  660  may be able to provide deception-based security for the network  600 . In some implementations, the security device  660  may deploy security mechanisms that are configured to emulate devices that could be found in the network  600 . In some implementations, the security device  660  may monitor activity on the network  600 , including watching the data sent between the various devices on the network  600 , and between the devices and the Internet  650 . The security device  660  may be looking for activity that is unusual, unexpected, or readily identifiable as suspect. Upon detecting suspicious activity in the network  600 , the security device  660  may deploy deceptive security mechanisms. 
     In some implementations, the deceptive security mechanisms are software processes running on the security device  660  that emulate devices that may be found in the network  600 . In some implementations, the security device  660  may be assisted in emulating the security devices by another device on the network  600 , such as the desktop computer  632 . From the perspective of devices connected to the network  600 , the security mechanisms appear just like any other device on the network, including, for example, having an Internet Protocol (IP) address, a Media Access Control (MAC) address, and/or some other identification information, having an identifiable device type, and responding to or transmitting data just as would the device being emulated. The security mechanisms may be emulated by the security device  660  itself; thus, while, from the point of view of the network  600 , the network  600  appears to have additional devices, no physical equivalent (other than the security device  660 ) can be found in the house. 
     The devices and data emulated by a security mechanism are selected such that the security mechanism is an attractive target for intrusion attempts. Thus, the security mechanism may emulate valuable data, and/or devices that are easily hacked into, and/or devices that provide easy access to the reset of the network  600 . Furthermore, the security mechanisms emulate devices that are likely to be found in the network  600 , such as a second television, a second thermostat, or another laptop computer. In some implementations, the security device  660  may contact a service on the Internet  650  for assistance in selecting devices to emulate and/or for how to configure emulated devices. The security devices  660  may select and configure security mechanisms to be attractive to intrusions attempts, and to deflect attention away from more valuable or vulnerable network assets. Additionally, the security mechanisms can assist in confirming that an intrusion into the network  600  has actually taken place. 
     In some implementations, the security device  660  may deploy deceptive security mechanisms in advance of detecting any suspicious activity. For example, having scanned the network, the security device  660  may determine that the network  600  includes only one television  618  and one smoke detector  616 . The security device  660  may therefore choose to deploy security mechanisms that emulate a second television and a second smoke detector. With security mechanisms preemptively added to the network, when there is an intrusion attempt, the intruder may target the security mechanisms instead of valuable or vulnerable network devices. The security mechanisms thus may serve as decoys and may deflect an intruder away from the network&#39;s  600  real devices. 
     In some implementations, the security mechanisms deployed by the security device  660  may take into account specific requirements of the network  600  and/or the type of devices that can be emulated. For example, in some cases, the network  600  (or a sub-network) may assign identifiers to each device connected to the network  600 , and/or each device may be required to adopt a unique identifier. In these cases, the security device  660  may assign an identifier to deployed security mechanisms that do not interfere with identifiers used by actual devices in the network  600 . As another example, in some cases, devices on the network  600  may register themselves with a central controller and/or with a central service on the Internet  650 . For example, the thermostat  602  may register with a service on the Internet  650  that monitors energy use for the home. In these cases, the security mechanisms that emulate these types of devices may also register with the central controller or the central service. Doing so may improve the apparent authenticity of the security mechanism, and may avoid conflicts with the central controller or central service. Alternatively or additionally, the security device  660  may determine to deploy security mechanisms that emulate other devices, and avoid registering with the central controller or central service. 
     In some implementations, the security device  660  may dynamically adjust the security mechanisms that it has deployed. For example, when the homeowner adds devices to the network  600 , the security device  660  may remove security mechanisms that conflict with the new devices, or change a security mechanism so that the security mechanism&#39;s configuration is not incongruous with the new devices (e.g., the security mechanisms should not have the same MAC address as a new device). As another example, when the network owner removes a device from the network  600 , the security device  660  may add a security mechanism that mimics the device that was removed. As another example, the security device may change the activity of a security mechanism, for example, to reflect changes in the normal activity of the home, changes in the weather, the time of year, the occurrence of special events, and so on. 
     The security device  660  may also dynamically adjust the security mechanisms it has deployed in response to suspicious activity it has detected on the network  600 . For example, upon detecting suspicious activity, the security device  660  may change the behavior of a security mechanism or may deploy additional security mechanisms. The changes to the security mechanisms may be directed by the suspicious activity, meaning that if, for example, the suspicious activity appears to be probing for a wireless base station  634 , the security device  660  may deploy a decoy wireless base station. 
     Changes to the security mechanisms are meant not only to attract a possible intrusion, but also to confirm that an intrusion has, in fact occurred. Since the security mechanisms are not part of the normal operation of the network  600 , normal occupants of the home are not expected to access the security mechanisms. Thus, in most cases, any access of a security mechanism is suspect. Once the security device  660  has detected an access to a security mechanism, the security device  660  may next attempt to confirm that an intrusion into the network  600  has taken place. An intrusion can be confirmed, for example, by monitoring activity at the security mechanism. For example, login attempts, probing of data emulated by the security mechanism, copying of data from the security mechanism, and attempts to log into another part of the network  600  from the security mechanism indicate a high likelihood that an intrusion has occurred. 
     Once the security device  660  is able to confirm an intrusion into the network  600 , the security device  660  may alert the homeowner. For example, the security device  660  may sound an audible alarm, send an email or text message to the homeowner or some other designated persons, and/or send an alert to an application running on a smartphone or tablet. As another example, the security device  660  may access other network devices and, for example, flash lights, trigger the security system&#39;s  626  alarm, and/or display messages on devices that include display screens, such as the television  618  or refrigerator  604 . In some implementations, depending on the nature of the intrusion, the security device  660  may alert authorities such as the police or fire department. 
     In some implementations, the security device  660  may also take preventive actions. For example, when an intrusion appears to have originated outside the network  600 , the security device  660  may block the network&#39;s  600  access to the Internet  650 , thus possibly cutting off the intrusion. As another example, when the intrusion appears to have originated from within the network  600 , the security device  660  may isolate any apparently compromised devices, for example by disconnecting them from the network  600 . When only its own security mechanisms are compromised, the security device  660  may isolate itself from the rest of the network  600 . As another example, when the security device  660  is able to determine that the intrusion very likely included physical intrusion into the house, the security device  660  may alert the authorities. The security device  660  may further lock down the house by, for example, locking any electronic door locks  624 . 
     In some implementations, the security device  660  may be able to enable a homeowner to monitor the network  600  when a suspicious activity has been detected, or at any other time. For example, the homeowner may be provided with a software application that can be installed on a smartphone, tablet, desktop, and/or laptop computer. The software application may receive information from the security device  660  over a wired or wireless connection. Alternatively or additionally, the homeowner may be able to access information about his network through a web browser, where the security device  660  formats webpages for displaying the information. Alternatively or additionally, the security device  660  may itself have a touchscreen or a screen and key pad that provide information about the network  600  to the homeowner. 
     The information provided to the homeowner may include, for example, a list and/or graphic display of the devices connected to the network  600 . The information may further provide a real-time status of each device, such as whether the device is on or off, the current activity of the device, data being transferred to or from the device, and/or the current user of the device, among other things. The list or graphic display may update as devices connect and disconnect from the network  600 , such as for example laptops and smartphones connecting to or disconnecting from a wireless sub-network in the network  600 . The security device  660  may further alert the homeowner when a device has unexpectedly been disconnected from the network  600 . The security device  660  may further alert the homeowner when an unknown device connects to the network  600 , such as for example when a device that is not known to the homeowner connects to the Wi-Fi signal. 
     The security device  660  may also maintain historic information. For example, the security device  660  may provide snapshots of the network  600  taken once a day, once a week, or once a month. The security device  660  may further provide a list of devices that have, for example, connected to the wireless signal in the last hour or day, at what times, and for how long. The security device  660  may also be able to provide identification information for these devices, such as MAC addresses or usernames. As another example, the security device  660  may also maintain usage statistics for each device in the network  600 , such as for example the times at which each device was in use, what the device was used for, how much energy the device used, and so on. 
     The software application or web browser or display interface that provides the homeowner with information about his network  600  may also enable the homeowner to make changes to the network  600  or to devices in the network  600 . For example, through the security device  660 , the homeowner may be able to turn devices on or off, change the configuration of a device, change a password for a device or for the network, and so on. 
     In some implementations, the security device  660  may also display currently deployed security mechanisms and their configuration. In some implementations, the security device  660  may also display activity seen at the security mechanisms, such as for example a suspicious access to a security mechanism. In some implementations, the security device  660  may also allow the homeowner to customize the security mechanisms. For example, the homeowner may be able to add or remove security mechanisms, modify data emulated by the security mechanisms, modify the configuration of security mechanism, and/or modify the activity of a security mechanism. 
     A deception-based network security device  660  thus can provide sophisticated security for a small network. The security device  660  may be simple to add to a network, yet provide comprehensive protection against both external and internal intrusions. Moreover, the security device  660  may be able to monitor multiple sub-networks that are each using different protocols. The security device  660 , using deceptive security mechanisms, may be able to detect and confirm intrusions into the network  600 . The security device  660  may be able to take preventive actions when an intrusion occurs. The security device  660  may also be able to provide the homeowner with information about his network, and possibly also control over devices in the network. 
       FIG. 7  illustrates another example of a small network  700 , here implemented in a small business. A network in a small business may have both traditional and non-traditional devices connected to the network  700 . Small business networks are also examples of networks that are often implemented with minimal security. A small business owner may not have the financial or technical resources, time, or expertise to configure a sophisticated security infrastructure for her network  700 . The business owner, however, is likely able to at least set up a network  700  for the operation of the business. A deception-based network security device that is at least as simple to set up as the network  700  itself may provide inexpensive and simple yet sophisticated security for the network  700 . 
     The example network  700  may be one, single network, or may include multiple sub-networks. For example, the network  700  may include a wired sub-network, such as an Ethernet network, and a wireless sub-network, such as an 802.11 Wi-Fi network. The wired sub-network may be implemented using cables that have been run through the walls and/or ceilings to the various rooms in the business. The cables may be connected to jacks in the walls that devices can connect to in order to connect to the network  700 . The wireless network may be implemented using a wireless base station  720 , or several wireless base stations, which provide a wireless signal throughout the business. The network  700  may include other wireless sub-networks, such as a short-distance Bluetooth™ network. In some cases, the sub-networks communicate with one another. For example, the Wi-Fi sub-network may be connected to the wired Ethernet sub-network. In some cases, the various sub-networks in the network  700  may not be configured to or able to communicate with each other. 
     As noted above, the small business network  700  may include both computers, network infrastructure devices, and other devices not traditionally found in a network. The network  700  may also include electronics, machinery, and systems that have been connected to the network  700  according to an Internet-of-Things approach. Workshop machinery that was once purely analog may now have computer controls. Digital workshop equipment may be network-enabled. By connecting shop equipment and machinery to the network  700 , automation and efficiency of the business can be improved and orders, materials, and inventory can be tracked. Having more devices on the network  700 , however, may increase the number of vulnerabilities in the network  700 . Devices that have only recently become network-enabled may be particularly vulnerable because their security systems have not yet been hardened through use and attack. A deception-based network security device may provide simple-to-install and sophisticated security for a network that may otherwise have only minimal security. 
     The example small business of  FIG. 7  includes a front office. In the front office, the network may include devices for administrative tasks. These devices may include, for example, a laptop computer  722  and a telephone  708 . These devices may be attached to the network  700  in order to, for example, access records related to the business, which may be stored on a server  732  located elsewhere in the building. In the front office, security devices for the building may also be found, including, for example, security system controls  724  and an electronic door lock  726 . Having the security devices on the network  700  may enable the business owner to remotely control access to the building. The business owner may also be able to remotely monitor the security of building, such as for example being able to view video streams from security cameras  742 . The front office may also be where environmental controls, such as a thermostat  702 , are located. Having the thermostat  702  on the network  700  may allow the business owner to remotely control the temperature settings. A network-enabled thermostat  702  may also track energy usage for the heating and cooling systems. The front office may also include safety devices, such as a network-connected smoke alarm  728 . A network-connected smoke alarm may be able to inform the business owner that there is a problem in the building be connecting to the business owner&#39;s smartphone or computer. 
     Another workspace in this example small business is a workshop. In the workshop, the network  700  may include production equipment for producing the goods sold by the business. The production equipment may include, for example, manufacturing machines  704  (e.g. a milling machine, a Computer Numerical Control (CNC) machine, a 3D printer, or some other machine tool) and a plotter  706 . The production equipment may be controlled by a computer on the network  700 , and/or may receive product designs over the network  700  and independently execute the designs. In the workshop, one may also find other devices related to the manufacturing of products, such as radiofrequency identification (RFID) scanners, barcode or Quick Response (QR) code generators, and other devices for tracking inventory, as well as electronic tools, hand tools, and so on. 
     In the workshop and elsewhere in the building, mobile computing devices and people  738  may also be connected to the network  700 . Mobile computing devices include, for example, tablet computers  734  and smartphones  736 . These devices may be used to control production equipment, track supplies and inventory, receive and track orders, and/or for other operations of the business. People  738  may be connected to the network through network-connected devices worn or implanted in the people  738 , such as for example smart watches, fitness trackers, heart rate monitors, drug delivery systems, pacemakers, and so on. 
     At a loading dock, the example small business may have a delivery van  748  and a company car  746 . When these vehicles are away from the business, they may be connected to the network  700  remotely, for example over the Internet  750 . By being able to communicate with the network  700 , the vehicles may be able to receive information such as product delivery information (e.g., orders, addresses, and/or delivery times), supply pickup instructions, and so on. The business owner may also be able to track the location of these vehicles from the business location, or over the Internet  750  when away from the business, and/or track who is using the vehicles. 
     The business may also have a back office. In the back office, the network  700  may include traditional network devices, such as computers  730 , a multi-function printer  716 , a scanner  718 , and a server  732 . In this example, the computers  730  may be used to design products for manufacturing in the workshop, as well as for management of the business, including tracking orders, supplies, inventory, and/or human resources records. The multi-function printer  716  and scanner  718  may support the design work and the running of the business. The server  732  may store product designs, orders, supply records, and inventory records, as well as administrative data, such as accounting and human resources data. 
     The back office may also be where a gateway device  770  is located. The gateway device  770  connects the small business to other networks, including the Internet  750 . Typically, the gateway device  770  connects to an ISP, and the ISP provides access to the Internet  750 . In some cases, a router may be integrated into the gateway device  770 . In some cases, gateway device  770  may be connected to an external router, switch, or hub, not illustrated here. In some cases, the network  700  is not connected to any networks outside of the business&#39;s own network  700 . In these cases, the network  700  may not have a gateway device  770 . 
     The back office is also where the network  700  may have a deception-based network security device  760 . The security device  760  may be a standalone device that may be enabled as soon as it is connected to the network  700 . Alternatively or additionally, the security device  760  may be integrated into another device connected to the network  700 , such as the gateway device  770 , a router, a desktop computer  730 , a laptop computer  722 , the multi-function printer  716 , or the thermostat  702 , among others. When integrated into another device, the security device  760  may use the network connection of the other device, or may have its own network connection for connecting to the network  700 . The security device  760  may connect to the network  700  using a wired connection or a wireless connection. 
     Once connected to the network  700 , the security device  760  may begin monitoring the network  700  for suspect activity. In some implementations, the security device  760  may scan the network  700  to learn which devices are connected to the network  700 . In some cases, the security device  760  may learn the normal activity of the network  700 , such as what time the various devices are used, for how long, by whom, for what purpose, and what data is transferred to and from each device, among other things. 
     In some implementations, having learned the configuration and/or activity of the network  700 , the security device  760  may deploy deceptive security mechanisms. These security mechanisms may emulate devices that may be found on the network  700 , including having an identifiable device type and/or network identifiers (such as a MAC address and/or IP address), and being able to send and receive network traffic that a device of a certain time would send and receive. For example, for the example small business, the security device  760  may configure a security mechanism to emulate a 3D printer, a wide-body scanner, or an additional security camera. The security device  760  may further avoid configuring a security mechanism to emulate a device that is not likely to be found in the small business, such as a washing machine. The security device  760  may use the deployed security mechanisms to monitor activity on the network  700 . 
     In various implementations, when the security device  760  detects suspect activity, the security device  760  may deploy additional security mechanisms. These additional security mechanisms may be selected based on the nature of suspect activity. For example, when the suspect activity appears to be attempting to break into the shop equipment, the security device  760  may deploy a security mechanism that looks like shop equipment that is easy to hack. In some implementations, the security device  760  may deploy security mechanisms only after detecting suspect activity on the network  700 . 
     The security device  760  selects devices to emulate that are particularly attractive for an infiltration, either because the emulated device appears to have valuable data or because the emulated device appears to be easy to infiltrate, or for some other reason. In some implementations, the security device  760  connects to a service on the Internet  750  for assistance in determining which devices to emulate and/or how to configure the emulated device. Once deployed, the security mechanisms serve as decoys to attract the attention of a possible infiltrator away from valuable network assets. In some implementations, the security device  760  emulates the security mechanisms using software processes. In some implementations, the security device  760  may be assisted in emulating security mechanisms by a computer  730  on the network. 
     In some implementations, the security device  760  may deploy security mechanisms prior to detecting suspicious activity on the network  700 . In these implementations, the security mechanisms may present more attractive targets for a possible, future infiltration, so that if an infiltration occurs, the infiltrator will go after the security mechanisms instead of the actual devices on the network  700 . 
     In various implementations, the security device  760  may also change the security mechanisms that it has deployed. For example, the security device  760  may add or remove security mechanisms as the operation of the business changes, as the activity on the network  700  changes, as devices are added or removed from the network  700 , as the time of year changes, and so on. 
     Besides deflecting a possible network infiltration away from valuable or vulnerable network devices, the security device  760  may use the security mechanisms to confirm that the network  700  has been infiltrated. Because the security mechanisms are not part of actual devices in use by the business, any access to them over the network is suspect. Thus, once the security device  760  detects an access to one of its security mechanisms, the security device  760  may attempt to confirm that this access is, in fact, an unauthorized infiltration of the network  700 . 
     To confirm that a security mechanism has been infiltrated, the security device  760  may monitor activity seen at the security mechanism. The security device  760  may further deploy additional security mechanisms, to see if, for example, it can present an even more attractive target to the possible infiltrator. The security device  760  may further look for certain activity, such as log in attempts to other devices in the network, attempts to examine data on the security mechanism, attempts to move data from the security mechanism to the Internet  750 , scanning of the network  700 , password breaking attempts, and so on. 
     Once the security device  760  has confirmed that the network  700  has been infiltrated, the security device  760  may alert the business owner. For example, the security device  760  may sound an audible alarm, email or send text messages to the computers  730  and/or handheld devices  734 ,  736 , send a message to the business&#39;s cars  746 ,  748 , flash lights, or trigger the security system&#39;s  724  alarm. In some implementations, the security device  760  may also take preventive measures. For example, the security device  760  may disconnect the network  700  from the Internet  750 , may disconnect specific devices from the network  700  (e.g., the server  732  or the manufacturing machines  704 ), may turn some network-connected devices off, and/or may lock the building. 
     In various implementations, the security device  760  may allow the business owner to monitor her network  700 , either when an infiltration is taking place or at any other time. For example, the security device  760  may provide a display of the devices currently connected to the network  700 , including flagging any devices connected to the wireless network that do not appear to be part of the business. The security device  760  may further display what each device is currently doing, who is using them, how much energy each device is presently using, and/or how much network bandwidth each device is using. The security device  760  may also be able to store this information and provide historic configuration and/or usage of the network  700 . 
     The security device  760  may have a display it can use to show information to the business owner. Alternatively or additionally, the security device  760  may provide this information to a software application that can run on a desktop or laptop computer, a tablet, or a smartphone. Alternatively or additionally, the security device  760  may format this information for display through a web browser. The business owner may further be able to control devices on the network  700  through an interface provided by the security device  760 , including, for example, turning devices on or off, adjusting settings on devices, configuring user accounts, and so on. The business owner may also be able to view any security mechanisms presently deployed, and may be able to re-configure the security mechanisms, turn them off, or turn them on. 
     IoT networks can also include industrial control systems. Industrial control system is a general term that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS) and other control system configurations, such as Programmable Logic Controllers (PLCs), often found in the industrial sectors and infrastructures. Industrial control systems are often found in industries such as electrical, water and wastewater, oil and natural gas, chemical, transportation, pharmaceutical, pulp and paper, food and beverage, and discrete manufacturing (e.g., automotive, aerospace, and durable goods). While a large percentage of industrial control systems may be privately owned and operated, federal agencies also operate many industrial processes, such as air traffic control systems and materials handling (e.g., Postal Service mail handling). 
       FIG. 8  illustrates an example of the basic operation of an industrial control system  800 . Generally, an industrial control system  800  may include a control loop  802 , a human-machine interface  806 , and remote diagnostics and maintenance  808 . In some implementations, the example industrial control system can be defended by a network threat detection and analysis system, which can include a deception center  898  and a security services provider  896 . 
     A control loop  802  may consist of sensors  812 , controller  804  hardware such as PLCs, actuators  810 , and the communication of variables  832 ,  834 . The sensors  812  may be used for measuring variables in the system, while the actuators  810  may include, for example, control valves breakers, switches, and motors. Some of the sensors  812  may be deceptions sensors. Controlled variables  834  may be transmitted to the controller  804  from the sensors  812 . The controller  804  may interpret the controlled variables  834  and generates corresponding manipulated variables  832 , based on set points provided by controller interaction  830 . The controller  804  may then transmit the manipulated variables  832  to the actuators  810 . The actuators  810  may drive a controlled process  814  (e.g., a machine on an assembly line). The controlled process  814  may accept process inputs  822  (e.g., raw materials) and produce process outputs  824  (e.g., finished products). New information  820  provided to the controlled process  814  may result in new sensor  812  signals, which identify the state of the controlled process  814  and which may also transmitted to the controller  804 . 
     In some implementations, at least some of the sensors  812  can also provide the deception center  898  with visibility into the industrial control system  800 , such as for example being able to present or project deceptive security mechanisms into the industrial control system. Additionally, in various implementations, the sensors  812  may provide a portal through which a suspected attack on the industrial control system can be redirected to the deception center  898 . The deception center  898  and the sensors  812  may be able to communicate using network tunnels  880 . 
     The deception center  898  provides network security for the industrial control system  800  by deploying security mechanisms into the industrial control system  800 , monitoring the industrial control system through the security mechanisms, detecting and redirecting apparent threats, and analyzing network activity resulting from the apparent threat. In some implementations, the industrial control system  800  can include more than one deception center  898 . In some implementations, the deception center may be located off-site, such as on the Internet. 
     In some implementations, the deception center  898  may interact with a security services provider  896  located outside the industrial control system  800 . The security services provider  896  may act as a central hub for providing security to multiple sites that are part of the industrial control system  800 , and/or for multiple separate, possibly unrelated, industrial control systems. For example, the security services provider  896  may communicate with multiple deception centers  898  that each provide security for a different industrial control system  800  for the same organization. As another example, the security services provider  896  may coordinate the activities of the deception center  898  and the sensors  812 , such as enabling the deception center  898  and the sensors  812  to connect to each other. In some implementations, the security services provider  896  is located outside the industrial control system  800 . In some implementations, the security services provider  896  is controlled by a different entity than the entity that controls the site network. For example, the security services provider  896  may be an outside vendor. In some implementations, the security services provider  896  is controlled by the same entity as that controls the industrial control system. In some implementations, the network security system does not include a security services provider  896 . 
     The human-machine interface  806  provides operators and engineers with an interface for controller interaction  830 . Controller interaction  830  may include monitoring and configuring set points and control algorithms, and adjusting and establishing parameters in the controller  804 . The human-machine interface  806  typically also receives information from the controller  804  that allows the human-machine interface  806  to display process status information and historical information about the operation of the control loop  802 . 
     The remote diagnostics and maintenance  808  utilities are typically used to prevent, identify, and recover from abnormal operation or failures. For diagnostics, the remote diagnostics and maintenance utilities  808  may monitor the operation of each of the controller  804 , sensors  812 , and actuators  810 . To recover after a problem, the remote diagnostics and maintenance  808  utilities may provide recovery information and instructions to one or more of the controller  804 , sensors  812 , and/or actuators  810 . 
     A typical industrial control system contains many control loops, human-machine interfaces, and remote diagnostics and maintenance tools, built using an array of network protocols on layered network architectures. In some cases, multiple control loops are nested and/or cascading, with the set point for one control loop being based on process variables determined by another control loop. Supervisory-level control loops and lower-level control loops typically operate continuously over the duration of a process, with cycle times ranging from milliseconds to minutes. 
     One type of industrial control system that may include many control loops, human-machine interfaces, and remote diagnostics and maintenance tools is a supervisory control and data acquisition (SCADA) system. SCADA systems are used to control dispersed assets, where centralized data acquisition is typically as important as control of the system. SCADA systems are used in distribution systems such as, for example, water distribution and wastewater collection systems, oil and natural gas pipelines, electrical utility transmission and distribution systems, and rail and other public transportation systems, among others. SCADA systems typically integrate data acquisition systems with data transmission systems and human-machine interface software to provide a centralized monitoring and control system for numerous process inputs and outputs. SCADA systems are typically designed to collect field information, transfer this information to a central computer facility, and to display the information to an operator in a graphic and/or textual manner. Using this displayed information, the operator may, in real time, monitor and control an entire system from a central location. In various implementations, control of any individual sub-system, operation, or task can be automatic, or can be performed by manual commands. 
       FIG. 9  illustrates an example of a SCADA system  900 , here used for distributed monitoring and control. This example SCADA system  900  includes a primary control center  902  and three field sites  930   a - 930   c . A backup control center  904  provides redundancy in case of there is a malfunction at the primary control center  902 . The primary control center  902  in this example includes a control server  906 —which may also be called a SCADA server or a Master Terminal Unit (MTU)—and a local area network (LAN)  908 . The primary control center  902  may also include a human-machine interface station  908 , a data historian  910 , engineering workstations  912 , and various network equipment such as printers  914 , each connected to the LAN  918 . 
     The control server  906  typically acts as the master of the SCADA system  900 . The control server  906  typically includes supervisory control software that controls lower-level control devices, such as Remote Terminal Units (RTUs) and PLCs, located at the field sites  930   a - 930   c . The software may tell the system  900  what and when to monitor, what parameter ranges are acceptable, and/or what response to initiate when parameters are outside of acceptable values. 
     The control server  906  of this example may access Remote Terminal Units and/or PLCs at the field sites  930   a - 930   c  using a communications infrastructure, which may include radio-based communication devices, telephone lines, cables, and/or satellites. In the illustrated example, the control server  906  is connected to a modem  916 , which provides communication with serial-based radio communication  920 , such as a radio antenna. Using the radio communication  920 , the control server  906  can communicate with field sites  930   a - 930   b  using radiofrequency signals  922 . Some field sites  930   a - 930   b  may have radio transceivers for communicating back to the control server  906 . 
     A human-machine interface station  908  is typically a combination of hardware and software that allows human operators to monitor the state of processes in the SCADA system  900 . The human-machine interface station  908  may further allow operators to modify control settings to change a control objective, and/or manually override automatic control operations, such as in the event of an emergency. The human-machine interface station  908  may also allow a control engineer or operator to configure set points or control algorithms and parameters in a controller, such as a Remote Terminal Unit or a PLC. The human-machine interface station  908  may also display process status information, historical information, reports, and other information to operators, administrators, mangers, business partners, and other authorized users. The location, platform, and interface of a human-machine interface station  908  may vary. For example, the human-machine interface station  908  may be a custom, dedicated platform in the primary control center  902 , a laptop on a wireless LAN, or a browser on a system connected to the Internet. 
     The data historian  910  in this example is a database for logging all process information within the SCADA system  900 . Information stored in this database can be accessed to support analysis of the system  900 , for example for statistical process control or enterprise level planning. 
     The backup control center  904  may include all or most of the same components that are found in the primary control center  902 . In some cases, the backup control center  904  may temporarily take over for components at the primary control center  902  that have failed or have been taken offline for maintenance. In some cases, the backup control center  904  is configured to take over all operations of the primary control center  902 , such as when the primary control center  902  experiences a complete failure (e.g., is destroyed in a natural disaster). 
     The primary control center  902  may collect and log information gathered by the field sites  930   a - 930   c  and display this information using the human-machine interface station  908 . The primary control center  902  may also generate actions based on detected events. The primary control center  902  may, for example, poll field devices at the field sites  930   a - 930   c  for data at defined intervals (e.g., 5 or 60 seconds), and can send new set points to a field device as required. In addition to polling and issuing high-level commands, the primary control center  902  may also watch for priority interrupts coming from the alarm systems at the field sites  930   a - 930   c.    
     In this example, the primary control center  902  uses point-to-point connections to communication with three field sites  930   a - 930   c , using radio telemetry for two communications with two of the field sites  930   a - 930   b . In this example, the primary control center  902  uses a wide area network (WAN)  960  to communicate with the third field site  930   c . In other implementations, the primary control center  902  may use other communication topologies to communicate with field sites. Other communication topologies include rings, stars, meshes, trees, lines or series, and busses or multi-drops, among others. Standard and proprietary communication protocols may be used to transport information between the primary control center  902  and field sites  930   a - 930   c . These protocols may use telemetry techniques such as provided by telephone lines, cables, fiber optics, and/or radiofrequency transmissions such as broadcast, microwave, and/or satellite communications. 
     The field sites  930   a - 930   c  in this example perform local control of actuators and monitor local sensors. For example, a first field site  930   a  may include a PLC  932 . A PLC is a small industrial computer originally designed to perform the logic functions formerly executed by electrical hardware (such as relays, switches, and/or mechanical timers and counters). PLCs have evolved into controllers capable of controlling complex processes, and are used extensively in both SCADA systems and distributed control systems. Other controllers used at the field level include process controllers and Remote Terminal Units, which may provide the same level of control as a PLC but may be designed for specific control applications. In SCADA environments, PLCs are often used as field devices because they are more economical, versatile, flexible, and configurable than special-purpose controllers. 
     The PLC  932  at a field site, such as the first field site  930   a , may control local actuators  934 ,  936  and monitor local sensors  938 ,  940 ,  942 . Examples of actuators include valves  934  and pumps  936 , among others. Examples of sensors include level sensors  938 , pressure sensors  940 , and flow sensors  942 , among others. Any of the actuators  934 ,  936  or sensors  938 ,  940 ,  942  may be “smart” actuators or sensors, more commonly called intelligent electronic devices (LEDs). Intelligent electronic devices may include intelligence for acquiring data, communicating with other devices, and performing local processing and control. An intelligent electronic device could combine an analog input sensor, analog output, low-level control capabilities, a communication system, and/or program memory in one device. The use of intelligent electronic devices in SCADA systems and distributed control systems may allow for automatic control at the local level. Intelligent electronic devices, such as protective relays, may communicate directly with the control server  906 . Alternatively or additionally, a local Remote Terminal Unit may poll intelligent electronic devices to collect data, which it may then pass to the control server  906 . 
     Field sites  930   a - 930   c  are often equipped with remote access capability that allows field operators to perform remote diagnostics and repairs. For example, the first remote  930   a  may include a modem  916  connected to the PLC  932 . A remote access  950  site may be able to, using a dial up connection, connect to the modem  916 . The remote access  950  site may include its own modem  916  for dialing into to the field site  930   a  over a telephone line. At the remote access  950  site, an operator may use a computer  952  connected to the modem  916  to perform diagnostics and repairs on the first field site  930   a.    
     The example SCADA system  900  includes a second field site  930   b , which may be provisioned in substantially the same way as the first field site  930   a , having at least a modem and a PLC or Remote Terminal that controls and monitors some number of actuators and sensors. 
     The example SCADA system  900  also includes a third field site  930   c  that includes a network interface card (NIC)  944  for communicating with the system&#39;s  900  WAN  960 . In this example, the third field site  930   c  includes a Remote Terminal Unit  946  that is responsible for controlling local actuators  934 ,  936  and monitoring local sensors  938 ,  940 ,  942 . A Remote Terminal Unit, also called a remote telemetry unit, is a special-purpose data acquisition and control unit typically designed to support SCADA remote stations. Remote Terminal Units may be field devices equipped with wireless radio interfaces to support remote situations where wire-based communications are unavailable. In some cases, PLCs are implemented as Remote Terminal Units. 
     The SCADA system  900  of this example also includes a regional control center  970  and a corporate enterprise network  980 . The regional control center  970  may provide a higher level of supervisory control. The regional control center  970  may include at least a human-machine interface station  908  and a control server  906  that may have supervisory control over the control server  906  at the primary control center  902 . The corporate enterprise network  980  typically has access, through the system&#39;s  900  WAN  960 , to all the control centers  902 ,  904  and to the field sites  930   a - 930   c . The corporate enterprise network  980  may include a human-machine interface station  908  so that operators can remotely maintain and troubleshoot operations. 
     Another type of industrial control system is the distributed control system (DCS). Distributed control systems are typically used to control production systems within the same geographic location for industries such as oil refineries, water and wastewater management, electric power generation plants, chemical manufacturing plants, and pharmaceutical processing facilities, among others. These systems are usually process control or discrete part control systems. Process control systems may be processes that run continuously, such as manufacturing processes for fuel or steam flow in a power plant, for petroleum production in a refinery, or for distillation in a chemical plant. Discrete part control systems have processes that have distinct processing steps, typically with a distinct start and end to each step, such as found in food manufacturing, electrical and mechanical parts assembly, and parts machining. Discrete-based manufacturing industries typically conduct a series of steps on a single item to create an end product. 
     A distributed control system typically uses a centralized supervisory control loop to mediate a group of localized controllers that share the overall tasks of carrying out an entire production process. By modularizing the production system, a distributed control system may reduce the impact of a single fault on the overall system. A distributed control system is typically interfaced with a corporate network to give business operations a view of the production process. 
       FIG. 10  illustrates an example of a distributed control system  1000 . This example distributed control system  1000  encompasses a production facility, including bottom-level production processes at a field level  1004 , supervisory control systems at a supervisory level  1002 , and a corporate or enterprise layer. 
     At the supervisory level  1002 , a control server  1006 , operating as a supervisory controller, may communicate with subordinate systems via a control network  1018 . The control server  1006  may send set points to distributed field controllers, and may request data from the distributed field controllers. The supervisory level  1002  may include multiple control servers  1006 , with one acting as the primary control server and the rest acting as redundant, back-up control servers. The supervisory level  1002  may also include a main human-machine interface  1008  for use by operators and engineers, a data historian  1010  for logging process information from the system  1000 , and engineering workstations  1012 . 
     At the field level  1004 , the system  1000  may include various distributed field controllers. In the illustrated example, the distributed control system  1000  includes a machine controller  1020 , a PLC  1032 , a process controller  1040 , and a single loop controller  1044 . The distributed field controllers may each control local process actuators, based on control server  1006  commands and sensor feedback from local process sensors. 
     In this example, the machine controller  1020  drives a motion control network  1026 . Using the motion control network  1026 , the machine controller  1020  may control a number of servo drives  1022 , which may each drive a motor. The machine controller  1020  may also drive a logic control bus  1028  to communicate with various devices  1024 . For example, the machine controller  1020  may use the logic control bus  1028  to communicate with pressure sensors, pressure regulators, and/or solenoid valves, among other devices. One or more of the devices  1024  may be an intelligent electronic device. A human-machine interface  1008  may be attached to the machine controller  1020  to provide an operator with local status information about the processes under control of the machine controller  1020 , and/or local control of the machine controller  1020 . A modem  1016  may also be attached to the machine controller  1020  to provide remote access to the machine controller  1020 . 
     The PLC  1032  in this example system  1000  uses a fieldbus  1030  to communicate with actuators  1034  and sensors  1036  under its control. These actuators  1034  and sensors  1036  may include, for example, direct current (DC) servo drives, alternating current (AC) servo drives, light towers, photo eyes, and/or proximity sensors, among others. A human-machine interface  1008  may also be attached to the fieldbus  1030  to provide operators with local status and control for the PLC  1032 . A modem  1016  may also be attached to the PLC  1032  to provide remote access to the PLC  1032 . 
     The process controller  1040  in this example system  1000  also uses a fieldbus  1030  to communicate with actuators and sensors under its control, one or more of which may be intelligent electronic devices. The process controller  1040  may communicate with its fieldbus  1030  through an input/output (I/O) server  1042 . An I/O server is a control component typically responsible for collecting, buffering, and/or providing access to process information from control sub-components. An I/O server may be used for interfacing with third-party control components. Actuators and sensors under control of the process controller  1040  may include, for example, pressure regulators, pressure sensors, temperature sensors, servo valves, and/or solenoid valves, among others. The process controller  1040  may be connected to a modem  1016  so that a remote access  1050  site may access the process controller  1040 . The remote access  1050  site may include a computer  1052  for use by an operator to monitor and control the process controller  1040 . The computer  1052  may be connected to a local modem  1016  for dialing in to the modem  1016  connected to the process controller  1040 . 
     The illustrated example system  1000  also includes a single loop controller  1044 . In this example, the single loop controller  1044  interfaces with actuators  1034  and sensors  1036  with point-to-point connections, instead of a fieldbus. Point-to-point connections require a dedicated connection for each actuator  1034  and each sensor  1036 . Fieldbus networks, in contrast, do not need point-to-point connections between a controller and individual field sensors and actuators. In some implementations, a fieldbus allows greater functionality beyond control, including field device diagnostics. A fieldbus can accomplish control algorithms within the fieldbus, thereby avoiding signal routing back to a PLC for every control operation. Standard industrial communication protocols are often used on control networks and fieldbus networks. 
     The single loop controller  1044  in this example is also connected to a modem  1016 , for remote access to the single loop controller. 
     In addition to the supervisory level  1002  and field level  1004  control loops, the distributed control system  1000  may also include intermediate levels of control. For example, in the case of a distributed control system controlling a discrete part manufacturing facility, there could be an intermediate level supervisor for each cell within the plant. This intermediate level supervisor could encompass a manufacturing cell containing a machine controller that processes a part, and a robot controller that handles raw stock and final products. Additionally, the distributed control system could include several of these cells that manage field-level controllers under the main distributed control system supervisory control loop. 
     In various implementations, the distributed control system may include a corporate or enterprise layer, where an enterprise network  1080  may connect to the example production facility. The enterprise network  1080  may be, for example, located at a corporate office co-located with the facility, and connected to the control network  1018  in the supervisory level  1002 . The enterprise network  1080  may provide engineers and managers with control and visibility into the facility. The enterprise network  1080  may further include Manufacturing Execution Systems (MES)  1092 , control systems for managing and monitoring work-in-process on a factory floor. An MES can track manufacturing information in real time, receiving up-to-the-minute data from robots, machine monitors and employees. The enterprise network  1080  may also include Management Information Systems (MIS)  1094 , software and hardware applications that implement, for example, decision support systems, resource and people management applications, project management, and database retrieval applications, as well as basic business functions such as order entry and accounting. The enterprise network  1080  may further include Enterprise Resource Planning (ERP) systems  1096 , business process management software that allows an organization to use a system of integrated applications to manage the business and automate many back office functions related to technology, services, and human resources. 
     The enterprise network  1080  may further be connected to a WAN  1060 . Through the WAN  1060 , the enterprise network  1080  may connect to a distributed plant  1098 , which may include control loops and supervisory functions similar to the illustrated facility, but which may be at a different geographic location. The WAN  1060  may also connect the enterprise network to the outside world  1090 , that is, to the Internet and/or various private and public networks. In some cases, the WAN  1060  may itself include the Internet, so that the enterprise network  1080  accesses the distributed plant  1098  over the Internet. 
     As described above, SCADA systems and distributed control systems use Programmable Logic Controllers (PLCs) as the control components of an overall hierarchical system. PLCs can provide local management of processes through feedback control, as described above. In a SCADA implementation, a PLC can provide the same functionality as a Remote Terminal Unit. When used in a distributed control system, PLCs can be implemented as local controllers within a supervisory scheme. PLCs can have user-programmable memory for storing instructions, where the instructions implement specific functions such as I/O control, logic, timing, counting, proportional-integral-derivative (PID) control, communication, arithmetic, and data and file processing. 
       FIG. 11  illustrates an example of a PLC  1132  implemented in a manufacturing control process. The PLC  1132  in this example monitors and controls various devices over fieldbus network  1130 . The PLC  1132  may be connected to a LAN  1118 . An engineering workstation  1112  may also be connected to the LAN  1118 , and may include a programming interface that provides access to the PLC  1132 . A data historian  1110  on the LAN  1118  may store data produced by the PLC  1132 . 
     The PLC  1132  in this example may control a number of devices attached to its fieldbus network  1130 . These devices may include actuators, such as a DC servo drive  1122 , an AC drive  1124 , a variable frequency drive  1134 , and/or a light tower  1138 . The PLC  1132  may also monitor sensors connected to the fieldbus network  1130 , such as proximity sensors  1136 , and/or a photo eye  1142 . A human-machine interface  1108  may also be connected to the fieldbus network  1130 , and may provide local monitoring and control of the PLC  1132 . 
     Most industrial control systems were developed years ago, long before public and private networks, desktop computing, or the Internet were a common part of business operations. These well-established industrial control systems were designed to meet performance, reliability, safety, and flexibility requirements. In most cases, they were physically isolated from outside networks and based on proprietary hardware, software, and communication protocols that included basic error detection and correction capabilities, but lacked secure communication capabilities. While there was concern for reliability, maintainability, and availability when addressing statistical performance and failure, the need for cyber security measures within these systems was not anticipated. At the time, security for industrial control systems mean physically securing access to the network and the consoles that controlled the systems. 
     Internet-based technologies have since become part of modern industrial control systems. Widely available, low-cost IP devices have replaced proprietary solutions, which increases the possibility of cyber security vulnerabilities and incidents. Industrial control systems have adopted Internet-based solutions to promote corporate connectivity and remote access capabilities, and are being designed and implemented using industry standard computers, operating systems (OS) and network protocols. As a result, these systems may to resemble computer networks. This integration supports new networking capabilities, but provides less isolation for industrial control systems from the outside world than predecessor systems. Networked industrial control systems may be exposed to similar threats as are seen in computer networks, and an increased likelihood that an industrial control system can be compromised. 
     Industrial control system vendors have begun to open up their proprietary protocols and publish their protocol specifications to enable third-party manufacturers to build compatible accessories. Organizations are also transitioning from proprietary systems to less expensive, standardized technologies such as Microsoft Windows and Unix-like operating systems as well as common networking protocols such as TCP/IP to reduce costs and improve performance. Another standard contributing to this evolution of open systems is Open Platform Communications (OPC), a protocol that enables interaction between control systems and PC-based application programs. The transition to using these open protocol standards provides economic and technical benefits, but also increases the susceptibility of industrial control systems to cyber incidents. These standardized protocols and technologies have commonly known vulnerabilities, which are susceptible to sophisticated and effective exploitation tools that are widely available and relatively easy to use. 
     Industrial control systems and corporate networking systems are often interconnected as a result of several changes in information management practices, operational, and business needs. The demand for remote access has encouraged many organizations to establish connections to the industrial control system that enable of industrial control systems engineers and support personnel to monitor and control the system from points outside the control network. Many organizations have also added connections between corporate networks and industrial control systems networks to allow the organization&#39;s decision makers to obtain access to critical data about the status of their operational systems and to send instructions for the manufacture or distribution of product. 
     In early implementations this might have been done with custom applications software or via an OPC server/gateway, but, in the past ten years this has been accomplished with TCP/IP networking and standardized IP applications like File Transfer Protocol (FTP) or Extensible Markup Language (XML) data exchanges. Often, these connections were implemented without a full understanding of the corresponding security risks. In addition, corporate networks are often connected to strategic partner networks and to the Internet. Control systems also make more use of WANs and the Internet to transmit data to their remote or local stations and individual devices. This integration of control system networks with public and corporate networks increases the accessibility of control system vulnerabilities. These vulnerabilities can expose all levels of the industrial control system network architecture to complexity-induced error, adversaries and a variety of cyber threats, including worms and other malware. 
     Many industrial control system vendors have delivered systems with dial-up modems that provide remote access to ease the burdens of maintenance for the technical field support personnel. Remote access can be accomplished, for example, using a telephone number, and sometimes an access control credential (e.g., valid ID, and/or a password). Remote access may provide support staff with administrative-level access to a system. Adversaries with war dialers—simple personal computer programs that dial consecutive phone numbers looking for modems—and password cracking software could gain access to systems through these remote access capabilities. Passwords used for remote access are often common to all implementations of a particular vendor&#39;s systems and may have not been changed by the end user. These types of connections can leave a system highly vulnerable because people entering systems through vendor-installed modems are may be granted high levels of system access. 
     Organizations often inadvertently leave access links such as dial-up modems open for remote diagnostics, maintenance, and monitoring. Also, control systems increasingly utilize wireless communications systems, which can be vulnerable. Access links not protected with authentication and/or encryption have the increased risk of adversaries using these unsecured connections to access remotely controlled systems. This could lead to an adversary compromising the integrity of the data in transit as well as the availability of the system, both of which can result in an impact to public and plant safety. Data encryption may be a solution, but may not be the appropriate solution in all cases. 
     Many of the interconnections between corporate networks and industrial control systems require the integration of systems with different communications standards. The result is often an infrastructure that is engineered to move data successfully between two unique systems. Because of the complexity of integrating disparate systems, control engineers often fail to address the added burden of accounting for security risks. Control engineers may have little training in security and often network security personnel are not involved in security design. As a result, access controls designed to protect control systems from unauthorized access through corporate networks may be minimal. Protocols, such as TCP/IP and others have characteristics that often go unchecked, and this may counter any security that can be done at the network or the application levels. 
     Public information regarding industrial control system design, maintenance, interconnection, and communication may be readily available over the Internet to support competition in product choices as well as to enable the use of open standards. Industrial control system vendors also sell toolkits to help develop software that implements the various standards used in industrial control system environments. There are also many former employees, vendors, contractors, and other end users of the same industrial control system equipment worldwide who have inside knowledge about the operation of control systems and processes. 
     Information and resources are available to potential adversaries and intruders of all calibers around the world. With the available information, it is quite possible for an individual with very little knowledge of control systems to gain unauthorized access to a control system with the use of automated attack and data mining tools and a factory-set default password. Many times, these default passwords are never changed. 
     IV. Similarity Engine 
     In various implementations, the systems and methods discussed above can be used to implement detection of potentially compromised devices by evaluating attributes of known compromised devices against attributes of other hosts in the network. In certain embodiments, compromised devices can be detected, attributes associated with the compromised devices can be identified, and attributes of other hosts in the network can be evaluated to detect hosts with similar attributes to the compromised devices (e.g., candidate items). 
     Attackers may carry out an attack on a network using multiple hosts. Examples of a host can include a domain controller, an active directory, a server, an end user, a network-connected device or machine, and other suitable devices. Using deception mechanisms, it is possible to identify hosts that are likely to have been compromised by an attacker. For example, deception mechanisms can be executed to analyze the compromised hosts to determine whether the attacker exploited a specific vulnerability or malware to carry out the attack. During an attack, an attacker may access files on different hosts; access a second host from a first host using multiple vulnerabilities; create or transfer files; deploy malware; perform file system changes; and access sensitive files or records. These activities may be captured using logging agents that create logs. In one embodiment, an attribute set can be constructed for the compromised hosts using data from these logs. In another embodiment, an attribute set may be defined by a user (e.g., network administrator) using an interface. This attribute set can be analyzed using the disclosed systems and methods to identify items (e.g., hosts, devices, servers, and other suitable devices) that share similar attributes to the attributes of a known compromised device. The similar items can be removed from the network as items that are likely or potentially to be compromised, or likely to become compromised, quarantined, and/or used as hosts for deception mechanisms. 
     In some embodiments, a deception mechanism can emulate one or more characteristics of a host on the network. For example, a deception mechanism can be a virtual host or a light-weight virtual host. A light-weight virtual host can include less memory and computing power than a virtual host. In some embodiments, a light-weight virtual host includes more limited functions than a virtual host. In some embodiments, a virtual host or a light-weight virtual host can be configured similarly to a host on a network. In other examples, a deception mechanism can be a deception sensor, which can project a deception mechanism onto the network. In other examples, a deception mechanism can be a computer security mechanism that detects, deflects, or, in some manner, counteract attempts at unauthorized use of information systems (e.g., a honeypot). In other examples, a deception mechanism can be as described in each of U.S. Provisional Application Nos. 62/268,362, filed on Dec. 16, 2015, and 62/258,926, filed on Nov. 23, 2015, (e.g., a deception container, a deception interface, or a host mimicking a deception mechanism), the disclosures of each of which are herein incorporated by reference in their entirety for all purposes. In some embodiments, a deception container can include a host on the network that is nested inside of the deception container. The deception container can match the operating system of the host and intercept communications to the host. In some embodiments, a deception interface can include a separate system that acts as an interface to a host on the network. The deception interface can receive communications sent to the host and determine whether to forward the communications to the host. In some embodiments, a host on the network can mimic a deception mechanism in order to act as a deterrent to potential attacks of the host. 
     In the following description, for the purposes of explanation, specific details are set forth in order to provide a thorough understanding of embodiments of the invention. However, it will be apparent that various embodiments may be practiced without these specific details. The figures and description are not intended to be restrictive. 
     The ensuing description provides exemplary embodiments only, and is not intended to limit the scope, applicability, or configuration of the disclosure. Rather, the ensuing description of the exemplary embodiments will provide those skilled in the art with an enabling description for implementing an exemplary embodiment. It should be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the invention as set forth in the appended claims. 
     Specific details are given in the following description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments. 
     Also, it is noted that individual embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed, but could have additional steps not included in a figure. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination can correspond to a return of the function to the calling function or the main function. 
     The term “machine-readable storage medium” or “computer-readable storage medium” includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other mediums capable of storing, containing, or carrying instruction(s) and/or data. 
     A machine-readable storage medium or computer-readable storage medium may include a non-transitory medium in which data can be stored and that does not include carrier waves and/or transitory electronic signals propagating wirelessly or over wired connections. Examples of a non-transitory medium may include, but are not limited to, a magnetic disk or tape, optical storage media such as compact disk (CD) or digital versatile disk (DVD), flash memory, memory or memory devices. A computer-program product may include code and/or machine-executable instructions that may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, etc. 
     Furthermore, embodiments may be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks (e.g., a computer-program product) may be stored in a machine-readable medium. A processor(s) may perform the necessary tasks. 
     Systems depicted in some of the figures may be provided in various configurations. In some embodiments, the systems may be configured as a distributed system where one or more components of the system are distributed across one or more networks in a cloud computing system. 
       FIG. 12  illustrates an example of a network  1200  that can be installed at a physical site. The example network  1200  illustrates examples of various network devices and network hosts that can be included in a network. The network  1200  can include more or fewer network devices and/or network hosts, and/or can include network devices, additional networks, and/or systems not illustrated here. The network  1200  can be part of an enterprise network or a cloud network, as described further below. An enterprise network can also be a cloud network. Enterprise networks can include networks for a large site, such as a corporate office, a university campus, a hospital, a government office, or a similar entity. An enterprise network can include multiple physical sites. Access to an enterprise networks is typically restricted, and can require authorized users to enter a password or otherwise authenticate before using the network. A network such as illustrated by the example network  1200  can also be found at small sites, such as in a private home. 
     The network  1200  can be connected to an external network  1202 . The external network  1202  can be a public network, such as the Internet, or a private network, such as a network that uses private IP addresses. A public network is a network that can be shared by any number of entities, including network devices illustrated in  FIG. 12 . A public network can have unrestricted access, such that any user can connect to it. The external network  1202  can include third-party telecommunication lines, such as phone lines, broadcast coaxial cable, fiber optic cables, satellite communications, cellular communications, and the like. The external network  1202  can include any number of intermediate network devices, such as switches, routers, gateways, servers, and/or controllers that are not directly part of the network  1200  but that facilitate communication between the network  1200  and other network-connected entities. 
     The network  1200  can be connected to the external network  1202  using a gateway device  1204 . The gateway device  1204  can include a firewall or similar system for preventing unauthorized access while allowing authorized access to the network  1200 . Examples of gateway devices include routers, modems (e.g. cable, fiber optic, dial-up, etc.), and the like. 
     The gateway device  1204  can be connected to a switch  1206   a . The switch  1206   a  provides connectivity between various devices in the network  1200 . The switch  1206   a  can, such as for example in the example network  1200 , connect the network to a gateway device  1204 . A switch typically has multiple ports, and functions to direct packets received on one port to another port. In some implementations, the gateway device  1204  and the switch  1206   a  can be combined into a single device. 
     Various servers can be connected to the switch  1206   a . For example, a server can include a print server  1208  connected to the switch  1206   a . The print server  1208  can provide network access to a number of printers  1210 . Devices connected to the network  1200  can be configured to access any of the printers  1210  through the print server  1208 . Other examples of production servers connected to the switch  1206   a  include a file server  1212 , database server  1214 , and email server  1216 . The file server  1212  can provide storage for and access to data. This data can be accessible to devices connected to the network  1200 . The database server  1214  can store one or more databases, and provide services for accessing the databases. The email server  1216  can host an email program or service, and can also store email for users on the network  1200 . As yet another example, a server rack  1218  can be connected to the switch  1206 . The server rack  1218  can house one or more rack-mounted servers. The server rack  1218  can further provide one connection to the switch  1206   a , or can provide multiple connections to the switch  1206   a . The servers in the server rack  1218  can have various purposes, including providing computing resources, file storage, database storage and access, e-mail, or other purposes. While certain illustrative examples of production servers are described with respect to  FIG. 12 , one of ordinary skill in the art will appreciate that other production servers may be provided (e.g., an HTTP server, a web server, a video server, an audio or music server, or any other suitable server that provides content or services to devices and users of a network). 
     An additional switch  1206   b  can also be connected to the switch  1206   a . The additional switch  1206   b  can be provided to expand the capacity of the network. A switch typically has a limited number of ports (e.g., 8, 16, 32, 64 or more ports). In most cases, however, a switch can direct traffic to and from another switch, so that by connecting the additional switch  1206   b  to the first switch  1206   a , the number of available ports can be expanded. 
     In this example, a server  1220  is connected to the additional switch  1206   b . The server  1220  can manage network access for a number of network devices or devices. For example, the server  1220  can provide network authentication, arbitration, prioritization, load balancing, and other management services as needed to manage multiple network devices accessing the network  1200 . The server  1220  can be connected to a hub  1222 . The hub  1222  can include multiple ports, each of which can provide a wired connection for a network or device. The hub  1222  is typically a simpler device than a switch, and can be used when connecting a small number of network devices together. In some cases, a switch can be substituted for the hub  1222 . In this example, the hub  1222  connects desktop computers  1224  and laptop computers  1226  to the network  1200 . Each of the desktop computers  1224  and laptop computers  1226  are typically connected to the hub  1222  using a physical cable. 
     In this example, the additional switch  1206   b  is also connected to a wireless access point  1228 . The wireless access point  1228  provides wireless access to the network for wireless-enabled network or devices. Examples of wireless-enabled network and devices include laptops  1230 , tablets  1232 , and smart phones  1234  or personal digital assistants (PDAs). In some implementations, the wireless access point  1228  can also provide switching and/or routing functionality. 
     The example of  FIG. 12  further illustrates examples of potential threats to the network  1200 . A first example is an unauthorized access  1250 . An unauthorized access  1250  can take the form of attempts to bypass deception and/or authentication mechanisms at the gateway device  1204 . For example, an outside entity can attempt to determine passwords or deception codes that would allow the outside entity to enter the network. Unauthorized access  1250  can also occur at a device that is legitimately connected to the network  1200 . For example, an unauthorized user can attempt to authenticate as an authorized user (e.g., by determining the authorized user&#39;s password). 
     A second example of a potential network threat is malicious software  1252 . Malicious software can include viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and other malware type software programs. Malicious software  1252  can take the form of executable code, scripts, active content, and other software. Malicious software  1252  can enter the network as benign data (e.g., as data attached to email or some other file that enters the network  1200  legitimately), and/or can be deliberately placed in the network  1200  by an outside entity. Malicious software  1252  can affect only particular network devices, or can spread and affect all devices in the network. 
     A third example of a potential network threat is unauthorized data copying  1254 . Unauthorized data copying  1254  can involve copying of data (e.g., from a file server  1212  or email server  1216 ) by an outside entity and unauthorized entity. Unauthorized data copying  1254  can also occur when a user that is otherwise authorized to use the network  1200  attempts to copy data that the user is not authorized to access. 
     A fourth example of a potential threat to is unauthorized access or use  1256  by a user that is authorized to use the network  1200 . A legitimate user of the network  1200  can exceed his or her use by, for example, attempting to log in to a server, accessing files, violating a use or security policy, and/or using network resources, each of which the user is not authorized to use or access. 
       FIG. 13  illustrates an example of a system  1300  for identifying similar hosts. System  1300  includes a plurality of hosts  1304   a - n  on a network  1302 , a logging agent  1305 , a database  1306 , and a similarity engine  1308 . The plurality of hosts  1304   a - n  may include a query item (e.g., a compromised host or population centroid of a plurality of compromised hosts), as well as one or more candidate items to be compared to the query item. Although illustrated as having three hosts  1304   a - n  on network  1302 , it is contemplated that any number n of hosts may be present on network  1302 . Further, although illustrated as existing outside of network  1302 , it is contemplated that logging agent  1305 , database  1306 , and/or similarity engine  1308  may also reside on network  1302 . 
     In this embodiment, each host  1304   a - n  is in communication with a logging agent  1305 . In one embodiment, logging agent  1305  is in a scanner (not shown), and all of the data collected by the scanner is stored in a database. Logging agent  1305  monitors hosts  1304   a - n  and create logs of collected data from hosts  1304   a - n  that are stored in database  1306 . The collected data may include any data regarding hosts  1304   a - n , such as attribute data. Attribute data may include machine data, vulnerability data, malware data, authentication data, file system changes, and/or intrusion detection data, as described further herein. As described further below, the attribute data can represent the attributes associated with a particular host. Further, the attribute data for a query item can be compared against the attribute data for one or more candidate items to identify potentially compromised devices. 
     Attribute data collected by logging agent  1305  and stored in database  1306  may be provided to similarity engine  1308 . Similarity engine  1308  analyzes the attribute data of a query item of hosts  1304   a - n  and compares it to the attribute data of one or more candidate items of hosts  1304   a - n  to identify whether the attribute data of the query item is similar to the attribute data of the one or more candidate items, as described further herein. 
     Although illustrated as being separate from hosts  1304   a - n , it is contemplated that a logging agent can instead be present internally on each host  1304   a - n . Further, although a single logging agent  1305  is illustrated, it is contemplated that multiple similar or different logging agents can be present externally from or internally on each host  1304   a - n . An example of one such embodiment is described with respect to  FIG. 14 . 
       FIG. 14  illustrates an example of a host  1404   n  in a system  1400  for identifying similar hosts. Host  1404   n  may be similar to any or all of hosts  1304   a - n  of  FIG. 13 . Host  1404   n  is in communication with logging agents  1405   a - f . Logging agents  1405   a - f  may be similar to logging agent  1305  of  FIG. 13 . In some examples, each logging agent can correspond to a particular attribute that is identifiable from a query item. 
     Host  1404   n  provides a plurality of attribute data  1410   a - f  relating to host  1404   n  to logging agents  1405   a - f . For example, host  1404   n  may provide machine data to machine data logging agent  1405   a ; vulnerability data to vulnerability data logging agent  1405   b ; malware data to malware data logging agent  1405   c ; authentication data to authentication data logging agent  1405   d ; file system change data to file system changes logging agent  1405   e ; and/or intrusion detection data to intrusion detection logging agent  1405   f . Although shown and described as having six types of logging agents  1405   a - f  for six types of data, it is contemplated that any number of types and combinations of attribute data may be provided by host  1404   n  to any number of types and combinations of logging agents, including additional types of attribute data and/or logging agents that are not shown. Further, it is contemplated that the logging agents  1405   a - f  may be combined into fewer or broken down into a greater number of logging agents. Although illustrated as being separate from host  1404   n , it is contemplated that logging agents  1405   a - f  can instead be present internally on host  1404   n.    
     Machine data provided to machine data logging agent  1405   a  can include information associated with host  1404   n . Examples of machine data include a category of the host, a type of operating system of the host, a city in which the host is located, a country in which the host is located, a domain name system (DNS) for the host, an IP address of the host, a latitude in which the host is located, a longitude in which the host is located, a media access control (MAC) address of the host, a windows host name of the host (e.g., nt_host), a name of the user who owns or uses the host, a host name associated with the host, and a Peripheral Component Interconnect (PCI) domain of the host. Examples of a category of a host can include a domain controller, an active directory, a machine, a server host, and an end-user host. 
     Vulnerability data provided to vulnerability data logging agent  1405   b  can include information associated with detected vulnerabilities of host  1404   n . Exemplary types of vulnerability data include a category of a detected vulnerability and a severity of a detected vulnerability. Examples of attributes within a category of a detected vulnerability can include DOS and hardware. Examples of attributes within severity of a detected vulnerability can include critical, high and informational. 
     For example, the following attribute values could represent the number of times the following vulnerability attributes were detected on host  1404   n . 
                                         Vulnerability Attribute   Attribute Value                      DOS   12            Hardware   4           Critical   8           High   3           Informational   5                    
Thus, the vulnerability data of host n  1404   n  could be represented as:
 
     
       
         
           
               
               
               
               
               
               
             
               
                   
               
               
                   
                 DOS 
                 Hardware 
                 Critical 
                 High 
                 Informational 
               
               
                   
               
             
            
               
                 Host n 
                 12 
                 4 
                 8 
                 3 
                 5 
               
               
                   
               
            
           
         
       
     
     Malware data provided to malware data logging agent  1405   c  can include information associated with detected malware on host  1404   n . Examples of malware data include a signature (i.e., a name of the malware infection detected) and an action (i.e., an action taken by the host in response to the malware). Examples of signatures can include key logger and LeakTest. Examples of actions can include allowed, blocked, and deferred. 
     For example, the following attribute values could represent the number of times the following malware attributes were detected on host  1404   n . 
                                         Malware Attribute   Attribute Value                      Allowed   12            Blocked   4           Deferred   8           Key Logger   18            LeakTest   6                    
Thus, the malware data of host n  1404   n  could be represented as:
 
     
       
         
           
               
               
               
               
               
               
             
               
                   
               
               
                   
                 Allowed 
                 Blocked 
                 Deferred 
                 Key Logger 
                 LeakTest 
               
               
                   
               
             
            
               
                 Host n 
                 12 
                 4 
                 8 
                 18 
                 6 
               
               
                   
               
            
           
         
       
     
     Authentication data provided to authentication data logging agent  1405   d  can include information regarding log-in and log-out activities involving host  1404   n . Examples of authentication data include an action (i.e., the action performed on the resource on the host), app (i.e., the application involved in the activity), src (i.e., the source host involved in the authentication), and dest (i.e., the destination host involved in the authentication). Examples of actions can include success, failure and unknown. Examples of apps include ssh and splunk. 
     For example, the following attribute values could represent the number of times the following authentication attributes were detected on host  1404   n . 
                                         Authentication Attribute   Attribute Value                      Success   5           Failure   6           Unknown   4           Ssh   10            Splunk   5                    
Thus, the authentication data of host  1404   n  could be represented as:
 
     
       
         
           
               
               
               
               
               
               
             
               
                   
               
               
                   
                 Success 
                 Failure 
                 Unknown 
                 Ssh 
                 Splunk 
               
               
                   
               
             
            
               
                 Host n 
                 5 
                 6 
                 4 
                 10 
                 5 
               
               
                   
               
            
           
         
       
     
     File system changes provided to file system changes logging agent  1405   e  can include information associated with file system changes on host  1404   n . Examples of file system changes can include actions and change types. Examples of actions can include created, read, modified, and deleted. Examples of change types can include filesystem and AAA. 
     For example, the following attribute values could represent the number of times the following file system change attributes were detected on host  1404   n . 
                                         File System Change Attribute   Attribute Value                      Created   5           Read   6           Modified   3           Deleted   8           filesystem   17            AAA   5                    
Thus, the file system change data of host  1404   n  could be represented as:
 
     
       
         
           
               
               
               
               
               
               
               
             
               
                   
               
               
                   
                 Created 
                 Read 
                 Modified 
                 Deleted 
                 filesystem 
                 AAA 
               
               
                   
               
             
            
               
                 Host n 
                 5 
                 6 
                 3 
                 8 
                 17 
                 5 
               
               
                   
               
            
           
         
       
     
     Intrusion detection data provided to intrusion detection logging agent  1405   f  can include information associated with detected attacks on host  1404   n . Intrusion detection data may be gathered by one or more applications on host  1404   n , or may be gathered by other network monitoring devices. Examples of intrusion detection data can include intrusion detection system type (i.e., the type of intrusion detection system that generated the event) and severity. Examples of intrusion detection system types can include network, host and application. Examples of severity include critical, high, medium and low. 
     For example, the following attribute values could represent the number of times the following intrusion detection attributes were detected on host  1404   n . 
                                         Intrusion Detection Attribute   Attribute Value                      Network   12            Host   4           Application   8           Critical   8           High   7           Medium   5           Low   4                    
Thus, the intrusion detection data of host  1404   n  could be represented as:
 
     
       
         
           
               
               
               
               
               
               
               
               
             
               
                   
               
               
                   
                 Network 
                 Host 
                 Application 
                 Critical 
                 High 
                 Medium 
                 Low 
               
               
                   
               
             
            
               
                 Host n 
                 12 
                 4 
                 8 
                 8 
                 7 
                 5 
                 4 
               
               
                   
               
            
           
         
       
     
     As described further herein, the attribute data including host data, vulnerability data, malware data, authentication data, file system changes, and intrusion detection data is collected by logging agents  1405   a - f . Logging agents  1405   a - f  store the attribute data in a database  1406 . The database  1406  can be accessed by the similarity engine (not shown) to obtain attribute values  1407 . 
       FIG. 15  illustrates an example of a similarity engine  1508  in a system  1500  for identifying a similar item  1514 . Similarity engine  1508  may be similar to similarity engine  1308  of  FIG. 13 . Similarity engine  1508  receives attribute values  1507 . Attribute values  1507  may be similar to attribute values  1407  of  FIG. 14 . Similarity engine  1508  outputs similar items  1514   a  and/or non-similar items  1514   b . For example, similar items  1514   a  can correspond to one or more candidate items that are potentially compromised devices, and non-similar items  1514   b  can correspond to one or more items that are not potentially compromised devices. In this example, the similar items  1514   a  may include devices that share similar attributes with a known compromised device, and the non-similar items  1514   b  may include devices that do not share attributes with the known compromised device. 
     Similarity engine  1508  includes a plurality of engines  1512   a - g  for determining the similar items  1514   a . The engines include a query item selection engine  1512   a , an attribute selection engine  1512   b , an attribute weight engine  1512   c , a candidate item selection engine  1512   d , an attribute vector creation engine  1512   e , an attribute vector comparison engine  1512   f , and a similar item identification engine  1512   g . Although shown and described as having seven engines  1512   a - g , it is contemplated that any number and combination of engines may be provided by similarity engine  1508 , including additional engines performing additional functions that are not shown. It is contemplated that engines  1512   a - g  may be implemented on one or multiple servers associated with similarity engine  1508 . Further, it is contemplated that some or all of the data needed to perform the functions of engines  1512   a - g  may be provided or determined automatically by similarity engine  1508 , or may be specified by a user. For example, an interface can be configured to receive input corresponding to user feedback, which may be used to update one or more weights stored in attribute weight engine  1512   c.    
     Query item selection engine  1512   a  is configured to determine a query item from which to compare candidate items to determine if they are similar. The query item is associated with a compromised host of a plurality of hosts. In one embodiment, the query item may be a known compromised host. In another embodiment, the query item may not be a particular host, but may be an item defined by a set of attributes associated with one or more compromised hosts. In still another embodiment, the query item may be a population centroid of a plurality of compromised hosts. A process for determining a population centroid of a plurality of compromised hosts is described further herein with reference to  FIG. 17 . 
     Attribute selection engine  1512   b  is configured to select one or more attributes associated with the query item for comparison to attributes of candidate items to determine whether any similarities exist. Any or all of the attributes of the query item may be selected for comparison. In the embodiment in which the query item is associated with more than one compromised host, the selected attributes may be common attributes across multiple or all compromised hosts. For example, if a majority of compromised hosts of a population centroid were running an application that detected a critical intrusion, the “application” and “critical” attributes of the intrusion detection data (e.g., intrusion detection data described with respect to  FIG. 14 ) may be selected for comparison. In some embodiments, attribute selection engine  1512   b  selects attributes based on domain knowledge. Attribute selection engine  1512   b  may update or change the selected attributes for future iterations as similar items are characterized and confirmed. 
     Attribute weight engine  1512   c  is configured to assign initial attribute weights to the one or more attributes, and to update the attribute weights for future iterations as similar items are characterized and confirmed. In some cases, weights can be assigned to attributes of the attribute data to represent the importance of the attribute in a similarity determination by the similarity engine  1508 . For example, an attribute associated with a greater weight may be more important to the determination of whether an item is potentially compromised than an attribute associated with a lower weight. In some cases, the weight associated with an attribute can represent the severity of a threat to the network if the attribute has a defined value or value range. As a non-limiting example, malware data generated by logging agent  1505   c  may indicate a high likelihood of a potentially compromised device. In this non-limiting example, the malware data attribute may be assigned a greater weight than other attributes to represent a higher likelihood of a candidate item being potentially compromised if malware is detected at the candidate item. The attribute weights assigned may be any value (e.g., between 0 and 1, between 0 and 100, etc.). In some embodiments, attribute weight engine  1512   c  assigns attribute weights equally, and updates the attribute weights after similar items are determined. In some embodiments, attribute weight engine  1512   c  assigns attribute weights based on domain knowledge. For example, if the selected attributes include both an operating system type (e.g., in machine data described with respect to  FIG. 14 ) and a deleted file in the file system (e.g., in file system changes), it may be determined that the “deleted” attribute of the file system change data is more significant than the “OS” attribute of the machine data. This may be, for example, because the operating system type may not be as critical to the attack, because the same deleted file attack has occurred across multiple different operating systems, etc. Thus, in this example, the “deleted” attribute may be assigned a weight (e.g., 0.75) that is higher than the weight assigned to the “OS” attribute (e.g., 0.25). 
     Attribute weight engine  1512   c  is configured to weight the received attribute values  1507  (for both a query item and candidates items) according to their assigned weights, i.e., by multiplying the attribute value by its associated attribute weight. Attribute weight engine  1512   c  is also configured to update the attribute weights for future comparisons of the query item to candidate items, as similar items are characterized and confirmed (e.g., through feedback). This embodiment is described further with respect to  FIG. 21 . In some examples, attribute weight engine  1512   c  can be configured to receive input corresponding to user feedback (e.g., via an interface). Attribute weight engine  1512   c  can update one or more weights based on the user feedback. As a non-limiting example, if attribute weight engine  1512   c  receives input corresponding to user feedback indicating that file systems changes have not recently been involved in threats to the network, attribute weight engine  1512   c  may update the weight of the attribute for file system changes to a lower weight. In some examples, weights can be automatically updated based on detected compromised devices over time. In some examples, machine-learning techniques may be used to determine which attributes are increasingly involved in detected threats to the network, and as a result, the weights for these attributes may be updated automatically. 
     Candidate item selection engine  1512   d  is configured to select one or more candidate items (e.g., hosts on a network) with which to compare the determined query item. The candidate items may include all of the hosts on a network, a subset of hosts on the network, or a single host on the network. A subset of hosts may be selected as candidate items randomly or by using domain knowledge. For example, a subset of hosts may be selected as candidate items based on their colocation with the query item within the network. 
     Attribute vector creation engine  1512   e  is configured to construct attribute vectors for the one or more selected attributes using the attribute values  1507 . Attribute vector creation engine  1512   e  constructs the vectors for both the query item and the one or more candidate items. For example, if the “success”, “failure”, “unknown”, “ssh”, and “splunk” attributes of authentication data described with respect to  FIG. 14  are selected, an attribute vector, U, may be created as follows:
 
 U={u   2   ,u   3   ,u   4   ,u   5   }={u   success   ,u   failure   ,u   unknown   ,u   ssh   ,u   splunk }
 
By assigning each of these attributes the exemplary attribute values discussed above with respect to  FIG. 14 , the following vector would result:
 
 U={ 5,6,4,10,5}
 
The creation of attribute vectors is described further herein with reference to  FIG. 19 .
 
     Attribute vector creation engine  1512   e  may further be configured to normalize the attribute vector to remove the bias from high or low attribute values. In one embodiment, this is accomplished by converting the values in the vector to values between 0 and 1. In one example, the values may be converted to a scale between 0 and 1 by dividing each attribute value by the total number of logged events for a given attribute type. For the authentication attribute type in the example above, 15 authentication events were logged (i.e., 5 successes, 6 failures, and 4 unknowns; 10 involving the “ssh” application, and 5 involving the “splunk” application). Thus, the normalized attribute vector would be as follows:
 
 U ={(5÷15),(6÷15),(4÷15),(10÷15),(5÷15)}={0.33,0.4,0.27,0.67,0.33}
 
In one embodiment, individual attribute values of this vector would further be weighted by attribute weight engine  1512   c  before being compared by attribute vector comparison engine  1512   f.  
 
     Attribute vector comparison engine  1512   f  is configured to determine a distance between the attribute vector of a query item and a random vector (“query item distance”), to determine a distance between the attribute vector or one or more candidate items and the random vector (“candidate item distance”), and to determine a distance between the query item distance and the candidate item distance (“comparison value”). In one embodiment, a hash function is applied to the attribute vectors to determine Euclidian distances between those vectors and the random vector. The random vector may be of the same dimension as the attribute vectors. The random vector may be generated by any random number generating technique, such as an RNG (random number generator). For example, if an attribute vector has five elements, then the corresponding random vector will also have five elements. In this example, an element in the random vector can include a randomly-generated number generated using a general algorithm. In one embodiment, the query item distance is compared to each candidate item distance to generate a comparison value. 
     In another embodiment, the hash function computation is performed on many or all of the candidate items to generate their candidate item distances, before comparing them to the query item distance. The candidate item distances are used to create buckets of candidate items based on their candidate item distances as compared to the query item distance. The individual candidate item distances of the candidate items in the bucket closest to the query item distance can be compared to the query item distance to generate comparison values. This embodiment is described further herein with respect to  FIG. 20 . 
     Similar item identification engine  1512   g  is configured to determine whether the comparison values are within a threshold value. If they are within a threshold value, those candidate items may be characterized as similar items  1514   a  to the query item. Other candidate items not within the threshold value may be characterized as non-similar items  1514   b . The threshold value may be selected randomly or based on domain knowledge. Once similar items  1514   a  are identified, one or more can be used as a host for deception mechanisms, can be taken off the network as being likely compromised or likely to become compromised, or can be quarantined. 
       FIG. 16  is a flowchart illustrating an embodiment of a process for identifying similar hosts in a network. The steps of  FIG. 16  may be implemented by the various engines  1512   a - g  similarity engine  1508  of  FIG. 15 , for example. At step  1620 , a query item is determined. This step may be implemented by query item selection engine  1512   a  of  FIG. 15 , for example, and may be as described above with reference to  FIG. 15 . For example, a query item may correspond to one or more known compromised devices in a network. 
     At step  1625 , an attribute associated with the query item is selected. This step may be implemented by attribute selection engine  1512   b  of  FIG. 15 , for example, and may be as described above with reference to  FIG. 15 . Selecting an attribute may be performed automatically or may be based on input received from a user at an interface. 
     At step  1630 , a query attribute value associated with the attribute and the query item is identified. The query attribute value may be received from a logging agent associated with the query item, such as, for example, logging agents  1305  of  FIG. 13  and/or logging agents  1405   a - f  of  FIG. 14 . The logging agent may provide a query attribute value for a particular attribute when the query item is a compromised host. However, if the query item is a population centroid of a plurality of compromised hosts (as described further herein with respect to  FIG. 17 ), any number of logging agents may provide query attribute values for the particular attribute from the plurality of compromised hosts. These query attribute values for the particular attribute may then be combined according to any method (e.g., mean, median, mode, etc.) to determine the query attribute value to be used for the population centroid. 
     At step  1635 , a first distance between the query attribute value and a random value is determined. This distance may be the difference between the query attribute value and the random value. In one embodiment, this distance is the “query item distance” formulated by the attribute vector comparison engine  1512   f  of  FIG. 15  described above. As a non-limiting example, the query attribute value can be computed by calculating an absolute value of the query vector, and the random value can be computed by calculating an absolute value of the random vector. 
     At step  1640 , a candidate item is identified. This step may be implemented by candidate item selection engine  1512   d  of  FIG. 15 , for example, and may be as described above with reference to  FIG. 15 . 
     At step  1645 , a candidate attribute value associated with the attribute and the candidate item is identified. The candidate attribute value corresponds to the same attribute that was selected at step  1625 . The candidate attribute value may be received from a logging agent associated with the candidate item, such as, for example, one or more of logging agents  1306   a - n  of  FIG. 13  and logging agent  1406   n  of  FIG. 14 . 
     At step  1650 , a second distance between the candidate attribute value and the random value is determined. This distance may be the difference between the candidate attribute value and the random value. The random value is the same random value that was compared to the query attribute value at step  1635 . In one embodiment, this distance is the “candidate item distance” formulated by the attribute vector comparison engine  1512   f  of  FIG. 15  described above. 
     At step  1653 , a third distance between the first distance and the second distance is determined. This distance may be the difference between the query item distance and the candidate item distance. In one embodiment, this distance is the “comparison value” formulated by the attribute vector comparison engine  1512   f  of  FIG. 15  described above. 
     In scenarios where there is a large number of candidate items and a large number of query items, comparing each candidate item against each query item can be burdensome on processing resources. For example, n candidate items compared against n query items may correspond to n 2  number of calculations. Accordingly, in some implementations, a hash function (e.g., locality-sensitive hashing or other suitable hash function) can be implemented to generate buckets of candidate items or query items. A bucket can correspond to a subset of all candidate items or query items. In some examples, each bucket can correspond to a range of values. For instance, a first bucket can correspond to a first range of values, a second bucket can correspond to a second range of values, and so on. The hash function can be performed on the query item vector to generate a hash value, and that hash value can be compared against the ranges of values for the various buckets. If the hash value is within a range associated with a particular bucket, the query item can be compared against only the candidate items within the particular bucket. Advantageously, the load experienced at processing resources is significantly reduced because only the candidate items within the particular bucket are compared against a query item. Further, within a particular bucket, candidate items can be ranked according to the severity of the threat posed. 
     At step  1655 , it is determined whether the third distance is within a threshold. This step may be implemented by similar item identification engine  1512   g  of  FIG. 15 , for example, and may be as described above with reference to  FIG. 15 . If the third distance is within the threshold, the candidate item is characterized as a similar item  1614   a , and a next candidate item is identified at step  1640 . If the third distance is not within the threshold, the candidate item is characterized as a non-similar item  1614   b , and a next candidate item is identified at step  1640 . The process may repeat until all of the candidate items (or all of the candidate items within a bucket, as described above) have been compared to the query item. 
       FIG. 17  is a flowchart illustrating an embodiment of a process for determining a population centroid  1735 . The population centroid  1735  may be used as a query item in any of the systems and processes described herein, and may represent a plurality of compromised hosts. At step  1710 , a population of hosts is identified. The population of hosts may be, for example, all or a subset of hosts on a network. 
     At step  1715 , a population of compromised hosts from the population of hosts is identified. The compromised hosts within the population of hosts may be, for example, identified by one or more network security applications, intrusion detection systems, or deception mechanisms (e.g., honeypots) deployed in the network. 
     At step  1720 , the population of compromised hosts is clustered into k clusters using centroid-based clustering of their attribute values, where k is a number of clusters that may be specified in advance. Each cluster includes compromised hosts that are similar. The k clusters include k cluster centroids (i.e., each cluster has a cluster centroid). The compromised hosts are assigned to the nearest cluster centroid. 
     At step  1725 , k cluster quality parameters are computed. The cluster quality parameters are computed as a ratio of compromised hosts within the cluster scatter to compromised hosts between the cluster scatter for each of k clusters. At step  1730 , a weighted sum of k cluster centroids is computed. The weighted sum is computed using the k cluster quality parameters. This weighted sum corresponds to the population centroid  1735 . The population centroid  1735  may be used as a query item in any of the embodiments described further herein. 
       FIG. 18  is a flowchart illustrating an embodiment of a process for constructing attribute vectors according to some embodiments. A query item  1816  was previously selected as described herein. At step  1820 , attributes associated with the query item are selected. This step may be implemented by attribute selection engine  1512   b  of  FIG. 15 , for example, and may be as described above with reference to  FIG. 15 . 
     At step  1825 , attribute values  1807  are received from one or more logging agents, such as, for example, logging agent  1305  and/or logging agents  1405   a - f , and the attribute values are weighted using attribute weights  1855 . Attribute weights  1855  may be assigned and/or updated by, for example, attribute weight engine  1512   c  of  FIG. 15 , as described further herein. 
     At step  1830 , attribute vectors are constructed for the query item  1816  and one or more candidate items  1818   x . The candidate items may have been previously identified, for example, by candidate item selection engine  1512   d  of  FIG. 15 . The attribute vectors may be created by attribute vector creation engine  1512   e , as described with respect to  FIG. 15 . 
     At step  1835 , the attribute vectors are normalized to remove the bias from high or low attribute values. In one embodiment, this is accomplished by converting the values in the vector to values between 0 and 1. In one example, the values may be converted to a scale between 0 and 1 by dividing each attribute value by the total number of logged events for a given attribute type, as described further herein with respect to  FIG. 15 . This produces a query item attribute vector  1807   a  and candidate item attribute vectors  1807   x.    
       FIG. 19  illustrates an example of a query item  1916  with attributes being compared to candidate items  1918   a - x  with attributes. Query item  1916  and candidate items  1918   a - x  are illustrated as having four types of attributes: A (e.g., machine data), M (e.g., malware data), U (e.g., authentication data), and V (e.g., vulnerability data). Although illustrated as having four types of attributes, it is contemplated that query item  1916  and candidate items  1918   a - x  may have any number or combination of attribute types. 
     Each attribute type A, M, U, V has attributes. For example, attribute type U (e.g., authentication data) has attributes u 1 , u 2 , . . . , u l . These attributes may include, for example, a successful authentication activity, a failed authentication activity, an unknown authentication activity, an ssh application activity, and a splunk application activity. Each of these attributes has corresponding attribute values. For example, query item  1916  may have attribute values such as 5, 6, 4, 10, and 5, respectively. These attribute values may be used to formulate a vector of authentication attributes for query item  1916 , such as:
 
 U   q   ={u   1   ,u   2   , . . . ,u   l }={5,6,4,10,5}
 
     Candidate items  1918   a - x  have the same attributes u 1 , u 2 , with corresponding attribute values. For example, candidate item  1918   a  may have attribute values such as 8, 3, 2, 4, and 9 respectively. These attribute values may be used to formulate a vector of authentication attributes for candidate item  1918   a , such as:
 
 U   ca   ={u   1   ,u   2   , . . . ,u   l }={8,3,2,4,9}
 
     Candidate item  1918   x  may have attribute values such as 5, 2, 3, 9, and 1, respectively. These attribute values may be used to formulate a vector of authentication attributes for candidate item  1918   x , such as:
 
 U   cx   ={u   1   ,u   2   , . . . ,u   l }={5,2,3,9,1}
 
     Once these vectors have been created, they may be normalized by converting the values in the vector to values between 0 and 1. In one example, the values may be converted to a scale between 0 and 1 by dividing each attribute value by the total number of logged events for a given attribute type. For U q , fifteen authentication events were logged (i.e., 5 successes, 6 failures, and 4 unknowns; 10 involving the “ssh” application, and 5 involving the “splunk” application). Thus, the normalized attribute vector would be as follows:
 
 U   q ={(5÷15),(6÷15),(4÷15),(10÷15),(5÷15)}={0.33,0.4,0.27,0.67,0.33}
 
     For U ca , thirteen authentication events were logged (i.e., 8 successes, 3 failures, and 2 unknowns; 4 involving the “ssh” application, and 9 involving the “splunk” application). Thus, the normalized attribute vector would be as follows:
 
 U   ca ={(8÷13),(3÷13),(2÷13),(4÷13),(9÷13)}={0.62,0.23,0.15,0.31,0.69}
 
     For U cx , ten authentication events were logged (i.e., 5 successes, 2 failures, and 3 unknowns; 9 involving the “ssh” application, and 1 involving the “splunk” application). Thus, the normalized attribute vector would be as follows:
 
 U   cx ={(5÷10),(2÷10),(3÷10),(9÷10),(1÷10)}={0.5,0.2,0.3,0.9,0.1}
 
     In one embodiment, the attributes are then weighted, as described further herein. Once the attribute vectors are known, a query item distance may be calculated between U q  and a random vector. A first candidate item distance can be calculated between U ca  and the random vector, and a second candidate item distance can be calculated between U cx  and the random vector. The query item distance can be compared to the first candidate item distance to generate a first comparison value for candidate item  1918   a . The query item distance can be compared to the second candidate item distance to generate a second comparison value for candidate item  1918   x.    
     It can then be determined whether the first comparison value and the second comparison value are within a threshold value. If the first comparison value is within a threshold value, candidate item  1918   a  may be characterized as a similar item to query item  1916 . If not, candidate item  1918   a  may be characterized as a non-similar item to query item  1916 . If the second comparison value is within a threshold value, candidate item  1918   x  may be characterized as a similar item to query item  1916 . If not, candidate item  1918   x  may be characterized as a non-similar item to query item  1916 . This process is described further herein with respect to  FIG. 15 . Once similar items are identified, they can be used as hosts for one or more deception mechanisms, can be taken off the network as being likely compromised or likely to become compromised, or can be quarantined. 
       FIG. 20  is a flowchart illustrating an embodiment of a process for comparing a query item to candidate items to determine similar items  2040   a . At step  2010 , a random vector, y, is generated. A query item attribute vector  2007   a  that was previously generated according to the systems and processes described herein is used to calculate a query item Euclidian distance between the query item attribute vector  2007   a  and the random vector, y, by applying a hash function h 1  at step  2015   a . A plurality of candidate item attribute vectors  2007   x  that were previously generated according to the systems and processed described herein are used to calculate candidate item Euclidian distances between each candidate item attribute vector  2007   x  and the random vector, y, by applying a hash function h 2  at step  2015   x.    
     At step  2020 , locality sensitive hashing is applied to the candidate item Euclidian distances to create indexed candidate items  2025   x . The hash functions h 2  of the indexed candidate items  2025   x  are then compared to the hash function h 1  of the query item to create buckets of indexed candidate items at step  2030  based on their candidate item Euclidian distances. The candidate item Euclidian distances in the bucket closest to the query item Euclidian distance can be selected, and used to calculate comparison Euclidian distances between the query item Euclidian distance and each candidate item Euclidian distance. If the comparison Euclidian distances are within a threshold value, the associated candidate items are characterized as similar items  2040   a  to the query item. If the comparison Euclidian distances are not within a threshold value, the associated candidate items are characterized as non-similar items  2040   b  to the query item. 
       FIG. 21  is a flowchart illustrating an embodiment of a process for updating attribute weights  2155  using feedback on identified similar items  2140   a  and non-similar items  2140   b . Similar items  2140   a  may comprise similar items  1514   a  of  FIG. 15 , similar item  1614   a  of  FIG. 16 , and/or similar items  2040   a  of  FIG. 20 , for example. Non-similar items  2140   b  may comprise non-similar items  1514   b  of  FIG. 15 , non-similar item  1614   b  of  FIG. 16 , and/or non-similar items  2040   b  of  FIG. 20 , for example. Attribute weights  2155  may comprise attribute weights  1855  of  FIG. 18 , for example. 
     At step  2145 , similar items  2140   a  and non-similar items  2140   b  are provided and feedback is received regarding their similarity or non-similarity to the query item. Similar items  2140   a  and non-similar items  2140   b  may be identified according to any of the systems and processed described herein. In one embodiment, the feedback may be provided by a user, such as a network analyst. In another embodiment, the feedback may be provided by the systems described herein based on whether a similar item  2140   a  was indeed compromised or became compromised. The feedback may be a confirmation that one or more of the similar items  2140   a  are indeed similar to the query item, and/or that one or more of the non-similar items  2140   b  are indeed not similar to the query item. The feedback may also include an assertion that one or more of the similar items  2140   a  are not similar to the query item and/or that one or more of the non-similar items  2140   b  are indeed similar to the query item (e.g., a reversal). 
     A similarity value for a confirmed or reversed similar item or non-similar item as compared to the query item may be generated using the feedback. The similarity value may be the inverse of the comparison value as described with respect to  FIG. 15  (or the third value as described with respect to  FIG. 16 ). In other words, the similarity value is a numeric value between 0 and 1 that is computed by subtracting the comparison value (i.e., the third value) from  1 . The similarity value may be used to optimize the attribute weights. At step  2150 , optimization techniques are applied to update the attribute weights used to calculate the attribute vectors for the query item and the candidate items. The optimization techniques may include the Steepest Gradient method and/or the Newton Rapson method. 
     For example, a query item may have a “delete” file system change attribute and a “Unix” operating system attribute; a confirmed similar item may have a “delete” file system change attribute and a “Windows” operating system attribute, while a reversed similar item may not have a “delete” file system change attribute and a “Unix” operating system attribute. The attribute weights may be optimized to give greater weight to the “delete” file system change attribute and less weight to the “Unix” operating system attribute. For example, if the initial assigned attribute weights were 0.5 or 50% each, the “delete” file system change attribute may have an optimized attribute weight of 0.9 or 90%, while the “Unix” operating system attribute may have an optimized attribute weight of 0.1 or 10%. The updated attribute weights  2155  may be used in future iterations of the systems and methods described herein as attribute weights  1855  of  FIG. 18 , for example. 
     The systems and methods described herein may be deployed in a cloud-based network, and/or in an on-site, enterprise network.  FIG. 22  illustrates an example of a cloud network  2200 . When implemented as a cloud network  2200 , the systems described can be used to monitor and collected data from hosts on multiple networks and located at multiple sites. 
     The cloud network  2200  may include a controller  2220 , which may be coupled to a memory  2210 , an application repository  2230 , and a storage  2240  storing cloud data  2245 . The controller  2220  may include any electronic device, such as a processor, capable of executing computer instructions. For example, the controller  2220  may load an operating system into memory  2210  to interact with the application repository  2230  and the storage  2240 . In another example, the controller  2220  may process instructions or fetch data from the storage  2240 . 
     The application repository  2230  may store engines of the similarity engine described herein, such as the query item selection engine, the attribute selection engine, the attribute weight engine, the candidate item selection engine, the attribute vector creation engine, the attribute vector comparison engine, and the similar item identification engine. 
     Storage  2240  may represent any suitable storage device(s), and may include a database for storing cloud data  2245 . The cloud data  2245  may include attribute data, such as the machine data, vulnerability data, malware data, authentication data, file system changes, and/or intrusion detection data discussed herein. 
     The controller  2220  may be capable of executing instructions to load applications from the application repository  2230  into the memory  2210 . The controller  2220  may then, for example, execute instructions to identify similar items to a query item using the similarity engine. 
     The systems and methods described herein may also be deployed in a hybrid network. In a hybrid network, part of an enterprise network is located local to the network&#39;s owner and/or users, and part of the enterprise network may be in the cloud. The cloud portion of the hybrid network may be implemented according to the example of  FIG. 22 . In a hybrid network, data may be collected from both local systems and systems provided by the cloud. 
     Further, the systems described herein may be implemented as a physical or a virtual appliance. The functions of the system described herein may be implemented on a single piece of hardware or on multiple pieces of hardware, each handling a different function or all of the functions described herein for a monitored network or portion of a monitored network. 
     Specific details were given in the preceding description to provide a thorough understanding of various implementations of systems and components for network threat detection and analysis. It will be understood by one of ordinary skill in the art, however, that the implementations described above may be practiced without these specific details. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form in order not to obscure the embodiments in unnecessary detail. In other instances, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail in order to avoid obscuring the embodiments. 
     It is also noted that individual implementations may be described as a process which is depicted as a flowchart, a flow diagram, a data flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed, but could have additional steps not included in a figure. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination can correspond to a return of the function to the calling function or the main function. 
     The term “computer-readable medium” includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other mediums capable of storing, containing, or carrying instruction(s) and/or data. A computer-readable medium may include a non-transitory medium in which data can be stored and that does not include carrier waves and/or transitory electronic signals propagating wirelessly or over wired connections. Examples of a non-transitory medium may include, but are not limited to, a magnetic disk or tape, optical storage media such as compact disk (CD) or digital versatile disk (DVD), flash memory, memory or memory devices. A computer-readable medium may have stored thereon code and/or machine-executable instructions that may represent a procedure, a function, a subprogram, a program, a routine, a subroutine, a module, a software package, a class, or any combination of instructions, data structures, or program statements. A code segment may be coupled to another code segment or a hardware circuit by passing and/or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc. may be passed, forwarded, or transmitted via any suitable means including memory sharing, message passing, token passing, network transmission, or the like. 
     The various examples discussed above may further be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks (e.g., a computer-program product) may be stored in a computer-readable or machine-readable medium. A processor(s), implemented in an integrated circuit, may perform the necessary tasks. 
     Where components are described as being “configured to” perform certain operations, such configuration can be accomplished, for example, by designing electronic circuits or other hardware to perform the operation, by programming programmable electronic circuits (e.g., microprocessors, or other suitable electronic circuits) to perform the operation, or any combination thereof 
     The various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the implementations disclosed herein may be implemented as electronic hardware, computer software, firmware, or combinations thereof. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure. 
     The techniques described herein may also be implemented in electronic hardware, computer software, firmware, or any combination thereof. Such techniques may be implemented in any of a variety of devices such as general purposes computers, wireless communication device handsets, or integrated circuit devices having multiple uses including application in wireless communication device handsets and other devices. Any features described as modules or components may be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be realized at least in part by a computer-readable data storage medium comprising program code including instructions that, when executed, performs one or more of the methods described above. The computer-readable data storage medium may form part of a computer program product, which may include packaging materials. The computer-readable medium may comprise memory or data storage media, such as random access memory (RAM) such as synchronous dynamic random access memory (SDRAM), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), FLASH memory, magnetic or optical data storage media, and the like. The techniques additionally, or alternatively, may be realized at least in part by a computer-readable communication medium that carries or communicates program code in the form of instructions or data structures and that can be accessed, read, and/or executed by a computer, such as propagated signals or waves. 
     The program code may be executed by a processor, which may include one or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, an application specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuitry. Such a processor may be configured to perform any of the techniques described in this disclosure. A general purpose processor may be a microprocessor; but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Accordingly, the term “processor,” as used herein may refer to any of the foregoing structure, any combination of the foregoing structure, or any other structure or apparatus suitable for implementation of the techniques described herein. In addition, in some aspects, the functionality described herein may be provided within dedicated software modules or hardware modules configured for network threat detection and analysis. 
     While illustrative embodiments of the application have been described in detail herein, it is to be understood that the inventive concepts may be otherwise variously embodied and employed, and that the appended claims are intended to be construed to include such variations, except as limited by the prior art. 
     As used below, any reference to a series of examples is to be understood as a reference to each of those examples disjunctively (e.g., “Examples 1-4” is to be understood as “Examples 1, 2, 3, or 4”). 
     Example 1 is a computer-implemented method, comprising: determining a query item, wherein the query item is associated with a compromised host of a plurality of hosts; selecting an attribute associated with the query item; assigning an attribute weight to the attribute; identifying a query attribute value associated with the attribute and the query item; weighting the query attribute value using the attribute weight; determining a first distance between the weighted query attribute value and a random value; identifying a candidate item, wherein the candidate item includes a host of the plurality of hosts; identifying a candidate attribute value associated with the attribute and the candidate item; weighting the candidate attribute value using the attribute weight; determining a second distance between the weighted candidate attribute value and the random value; determining a third distance between the first distance and the second distance; and characterizing the candidate item as a similar item to the query item when the third distance is within a threshold value. 
     Example 2 is the computer-implement method of example 1, further comprising: receiving feedback confirming similarity of the similar item to the query item; generating a similarity value for the similar item and the query item using the feedback; and optimizing the attribute weight using the similarity value. 
     Example 3 is the computer-implement method of examples 1-2, wherein determining a query item comprises: identifying compromised hosts from the plurality of hosts; determining a cluster for the compromised hosts, wherein the cluster includes a cluster centroid, and wherein the cluster includes similar compromised hosts; computing a cluster quality parameter for the cluster, wherein the cluster quality parameter is based on a scatter of the cluster; weighting the cluster centroid with the cluster quality parameter to form a population centroid of the compromised hosts; and characterizing the population centroid as the query item. 
     Example 4 is the computer-implement method of examples 1-3, wherein determining a query item comprises: identifying compromised hosts from the plurality of hosts; determining clusters for the compromised hosts, wherein each cluster includes a cluster centroid, and wherein each cluster includes similar compromised hosts; computing a cluster quality parameter for each cluster, wherein each cluster quality parameter is based on a scatter of a corresponding cluster; weighting the cluster centroid of each cluster with a corresponding cluster quality parameter; summing the weighted cluster centroids to form a population centroid of the compromised hosts; and characterizing the population centroid as the query item. 
     Example 5 is the computer-implement method of examples 1-4, wherein the first distance and the second distance are Euclidian distances. 
     Example 6 is the computer-implement method of examples 1-5, wherein determining the first distance includes computing a first hash function and determining the second distance includes computing a second hash function. 
     Example 7 is the computer-implement method of examples 1-6, further comprising: generating buckets of hash functions including the first hash function and the second hash function; and determining that the first hash function and the second hash function are in a same bucket. 
     Example 8 is the computer-implement method of examples 1-7, wherein the query item includes a plurality of attributes. 
     Example 9 is the computer-implement method of examples 1-8, wherein identifying the query attribute value includes receiving the query attribute value from a logging agent. 
     Example 10 is the computer-implement method of examples 1-9, wherein identifying the candidate attribute value includes receiving the candidate attribute value from a logging agent. 
     Example 11 is the computer-implement method of examples 1-10, further comprising: normalizing the query attribute value and the candidate attribute value. 
     Example 12 is a network device comprising: one or more processors; and a non-transitory computer-readable medium containing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including: determining a query item, wherein the query item is associated with a compromised host of a plurality of hosts; selecting an attribute associated with the query item; assigning an attribute weight to the attribute; identifying a query attribute value associated with the attribute and the query item; weighting the query attribute value using the attribute weight; determining a first distance between the weighted query attribute value and a random value; identifying a candidate item, wherein the candidate item includes a host of the plurality of hosts; identifying a candidate attribute value associated with the attribute and the candidate item; weighting the candidate attribute value using the attribute weight; determining a second distance between the weighted candidate attribute value and the random value; determining a third distance between the first distance and the second distance; and characterizing the candidate item as a similar item to the query item when the third distance is within a threshold value. 
     Example 13 is the network device of example 12, wherein the operations further include: further comprising: receiving feedback confirming similarity of the similar item to the query item; generating a similarity value for the similar item and the query item using the feedback; and optimizing the attribute weight using the similarity value. 
     Example 14 is the network device of examples 12-13, wherein determining a query item comprises: identifying compromised hosts from the plurality of hosts; determining a cluster for the compromised hosts, wherein the cluster includes a cluster centroid, and wherein the cluster includes similar compromised hosts; computing a cluster quality parameter for the cluster, wherein the cluster quality parameter is based on a scatter of the cluster; weighting the cluster centroid with the cluster quality parameter to form a population centroid of the compromised hosts; and characterizing the population centroid as the query item. 
     Example 15 is the network device of examples 12-14, wherein determining a query item comprises: identifying compromised hosts from the plurality of hosts; determining clusters for the compromised hosts, wherein each cluster includes a cluster centroid, and wherein each cluster includes similar compromised hosts; computing a cluster quality parameter for each cluster, wherein each cluster quality parameter is based on a scatter of a corresponding cluster; weighting the cluster centroid of each cluster with a corresponding cluster quality parameter; summing the weighted cluster centroids to form a population centroid of the compromised hosts; and characterizing the population centroid as the query item. 
     Example 16 is the network device of examples 12-15, wherein the first distance and the second distance are Euclidian distances. 
     Example 17 is the network device of examples 12-16, wherein determining the first distance includes computing a first hash function and determining the second distance includes computing a second hash function. 
     Example 18 is the network device of examples 12-17, further comprising: generating buckets of hash functions including the first hash function and the second hash function; and determining that the first hash function and the second hash function are in a same bucket. 
     Example 19 is the network device of examples 12-18, wherein the query item includes a plurality of attributes. 
     Example 20 is the network device of examples 12-19, wherein identifying the query attribute value includes receiving the query attribute value from a logging agent. 
     Example 21 is the network device of examples 12-20, wherein identifying the candidate attribute value includes receiving the candidate attribute value from a logging agent. 
     Example 22 is the network device of examples 12-21, further comprising: normalizing the query attribute value and the candidate attribute value. 
     Example 23 is a computer-program product tangibly embodied in a non-transitory machine-readable storage medium of a network device, including instructions that, when executed by the one or more processors, cause the one or more processors to perform: determining a query item, wherein the query item is associated with a compromised host of a plurality of hosts; selecting an attribute associated with the query item; assigning an attribute weight to the attribute; identifying a query attribute value associated with the attribute and the query item; weighting the query attribute value using the attribute weight; determining a first distance between the weighted query attribute value and a random value; identifying a candidate item, wherein the candidate item includes a host of the plurality of hosts; identifying a candidate attribute value associated with the attribute and the candidate item; weighting the candidate attribute value using the attribute weight; determining a second distance between the weighted candidate attribute value and the random value; determining a third distance between the first distance and the second distance; and characterizing the candidate item as a similar item to the query item when the third distance is within a threshold value. 
     Example 24 is a computer-program product of example 23, wherein the operations further include: further comprising: receiving feedback confirming similarity of the similar item to the query item; generating a similarity value for the similar item and the query item using the feedback; and optimizing the attribute weight using the similarity value. 
     Example 25 is a computer-program product of examples 23-24, wherein determining a query item comprises: identifying compromised hosts from the plurality of hosts; determining a cluster for the compromised hosts, wherein the cluster includes a cluster centroid, and wherein the cluster includes similar compromised hosts; computing a cluster quality parameter for the cluster, wherein the cluster quality parameter is based on a scatter of the cluster; weighting the cluster centroid with the cluster quality parameter to form a population centroid of the compromised hosts; and characterizing the population centroid as the query item. 
     Example 26 is a computer-program product of examples 23-25, wherein determining a query item comprises: identifying compromised hosts from the plurality of hosts; determining clusters for the compromised hosts, wherein each cluster includes a cluster centroid, and wherein each cluster includes similar compromised hosts; computing a cluster quality parameter for each cluster, wherein each cluster quality parameter is based on a scatter of a corresponding cluster; weighting the cluster centroid of each cluster with a corresponding cluster quality parameter; summing the weighted cluster centroids to form a population centroid of the compromised hosts; and characterizing the population centroid as the query item. 
     Example 27 is a computer-program product of examples 23-26, wherein the first distance and the second distance are Euclidian distances. 
     Example 28 is a computer-program product of examples 23-27, wherein determining the first distance includes computing a first hash function and determining the second distance includes computing a second hash function. 
     Example 29 is a computer-program product of examples 23-28, further comprising: generating buckets of hash functions including the first hash function and the second hash function; and determining that the first hash function and the second hash function are in a same bucket. 
     Example 30 is a computer-program product of examples 23-29, wherein the query item includes a plurality of attributes. 
     Example 31 is a computer-program product of examples 23-30, wherein identifying the query attribute value includes receiving the query attribute value from a logging agent. 
     Example 32 is a computer-program product of examples 23-31, wherein identifying the candidate attribute value includes receiving the candidate attribute value from a logging agent. 
     Example 33 is a computer-program product of examples 23-32, further comprising: normalizing the query attribute value and the candidate attribute value.