Patent Description:
The present disclosure relates to data analysis, and more specifically to systems and methods for building honeypot systems and detection of malicious objects.

Rapid development of computer technologies in the last decade, along with a wide spreading of various computing devices (personal computers, notebooks, tablets, smartphones, etc.) has become a powerful incentive to use such devices in a number of technical areas and for a large number of tasks (from Internet surfing to bank transfers and electronic document/record keeping). In parallel with the growth of the number of computer devices and the volume of software operating on such devices, the number of malicious programs has also grown rapidly, as have the methods for unauthorized access to the data processed by such devices and the fraudulent methods for using such data.

Currently, there are a large number of types of malicious programs. Some malicious programs steal personal and confidential data from user devices (e.g. logins and passwords, banking information, electronic documents). Others build so-called botnets from user devices for such attacks on computer systems as DDoS (Distributed Denial of Service), or for cracking of passwords using a brute force method. Still others offer users paid content through intrusive advertising, paid subscriptions, and texting to toll numbers, etc..

To counter malicious programs, including the detection of malicious programs and prevention of infection and restoration of the functionality of computer devices infected with malicious programs, specialized anti-virus programs are utilized. For the detection of the various types of malicious programs, anti-virus programs use various technologies, such as: statistical analysis, signature analysis, lists of authorized and prohibited applications and addresses, dynamic analysis, and heuristic analysis, proactive protection, etc..

In order to efficiently detect malicious program technologies, in particular, and malicious activity, in general, it can be necessary to obtain new samples of malicious programs or malicious activity logs. This task is well handled by special systems - honeypots - which are specially tuned computer systems with active vulnerabilities representing convenient targets for malicious attacks.

One of the drawbacks of honeypots is that they often require separate computers, significant computing resources, or complex setup and control, which can complicate their use for tasks related to information security.

For example <CIT> describes a technology for detecting network attacks using honeypot systems (honeypot resources). For this purpose, on a specifically dedicated computer system, a system is built, which facilitates a network-based attack on it by preparing relevant honeypots (files and software representing targets for a network-based attack). Detection of network-based attacks becomes possible because the state of the computer system is known in advance, before it begins functioning as a honeypot. In this manner, changes in the file system and in the activity of the software on the computer system are tracked, including the activity of malicious applications or any activity related to network-based attacks.

<CIT> describes a network traffic sending method and apparatus, and a hybrid honeypot system. The method includes determining that a request type of a first attack traffic flow is a first request type, and determining maturity of a virtual honeypot model for the first request type.

"<NPL>), XP080721623) describes "an extensive overview on honeypots," including methods to analyze honeypot data.

"<NPL>) describes "a hybrid and adaptable honeypot-based approach" that includes deploying low-interaction honeypots that act as emulators of services and operating systems to direct malicious traffic to high-interaction honeypots.

<CIT> describes various virtualized network honeypots in which client computing devices are coupled with both a primary host and a secondary virtualized host.

While the above-mentioned technologies successfully handle the building of a honeypot environment for detection of malicious programs, they build said honeypot environments on assigned computer devices, thereby reducing the effectiveness of their work on other tasks, and even often prevent such work (e.g. a user cannot safely work on a computer system serving as a honeypot for malicious programs).

Therefore, there is a need to build honeypots for malicious programs and other malicious objects (honeypot resources) without significantly limiting the functionality of computer systems serving as such honeypots.

Embodiments solve the aforementioned needs of the industry. In general, embodiments described herein implement data analysis to build systems of honeypot resources. The technical result of this disclosure includes building a system of honeypot resources for the detection of malicious objects in network traffic as set forth in the independent claims. The features of preferred embodiments are presented in the dependent claims.

Claim <NUM> discloses a method for building a honeypot environment comprises collecting, by a gathering tool, data about a computing system; selecting, by a distribution tool, at least one virtual environment of a plurality of pre-built virtual environments for association with the computing system based on the data, and one of: a rate of detection of malicious objects (<NUM>) in the at least one virtual environment (<NUM>) being above a rate detection threshold; a time for transferring the network traffic (<NUM>) between the computing system (<NUM>) and the at least one virtual environment (<NUM>) being below a transfer threshold; or a load on the at least one virtual environment (<NUM>) being below a load threshold, wherein each of the plurality of pre-built virtual environments includes an emulator; intercepting, by a network traffic control tool, network traffic of the computing system; emulating, by the emulator of the at least one virtual environment, the computing system; and detecting, by an analysis tool, at least one malicious object from the intercepted network traffic based on the emulating.

Claim <NUM> discloses a system for building a honeypot environment comprises: a processor and a memory; encoding instructions that, when executed by the processor, cause the processor to implement: a building tool configured to: build a plurality of virtual environments, wherein each virtual environment includes an emulator, and train a distribution model to define a plurality of characteristics, a distribution tool configured to select at least one virtual environment of the plurality of virtual environments for association with a computing system based on the characteristics of the distribution model such that: a rate of detection of malicious objects (<NUM>) in the at least one virtual environment (<NUM>) being above a rate detection threshold; a time for transferring the network traffic (<NUM>) between the computing system (<NUM>) and the at least one virtual environment (<NUM>) being below a transfer threshold; or a load on the at least one virtual environment (<NUM>) being below a load threshold, a gathering tool configured to collect data about the computing system; a network traffic control tool configured to intercept network traffic of the computing system; the emulator of the at least one virtual environment associated with the computing system, the emulator being configured to emulate the computing system; and an analysis tool configured to detect at least one malicious object from the intercepted network traffic based on the emulating.

Additional embodiments are disclosed in the dependent claims.

Subject matter hereof may be more completely understood in consideration of the following detailed description of various embodiments in connection with the accompanying figures, in which:.

The following sets forth definitions of terms used herein. These terms are applicable to only the present Application.

Honeypot - a computer system representing a bait for offenders. The purpose of a honeypot is to be subjected to unauthorized research and to gather data on the activity, which subsequently allows for the study the offender's strategy and determining a list of tools which may be used for attacks on actual security objects. The following can be used as such a honeypot computer system: a user's computer system; a server; a website; and/or software (for example, applications for electronic document processing). For example, a web server which does not have a name and technically is not known to anyone, should not, accordingly, have any guests visiting it. Therefore, all persons trying to visit it are potential hackers. A honeypot gathers information on the behavior of such hackers and on their methods for influencing the server. Subsequently, strategies for countering hacker attacks can be developed.

Virtual environment (or a virtual machine (VM)) - a software-based or a hardware-based system which emulates the hardware of a platform (a target platform) and executes programs for the target platform on a host platform, or virtualizes a platform and creates environments on it which isolate programs and even operating systems from each other.

Virtualization - provision of a set of computing resources or their logical consolidation, abstracted from hardware realization while providing logical isolation of computing processes executed on the same physical resource from each other. An example of the use of virtualization is the possibility to start multiple operating systems on a single computer: in this case, each of the guest operating systems uses its own set of logical resources (processors, random access memory, storage devices), whose provision from a common pool, accessible at the hardware level, is controlled by a host operating system - a hypervisor.

Turning to <FIG>, a block diagram of a system for detecting a malicious object in network traffic is depicted, according to an embodiment. In particular, the block diagram of a system for detecting a malicious object in network traffic comprises network traffic <NUM> including a malicious object <NUM>, a computer system <NUM> including a gathering tool <NUM>, a network traffic control tool <NUM>, a distribution tool <NUM>, a virtual environment <NUM> including an emulation tool <NUM>, and an analysis tool <NUM>.

A primary purpose of the system for detecting malicious objects in network traffic (hereinafter referred to as "malicious objects") is to detect said malicious objects, which, once sent to a computer system <NUM>, install themselves in the computer system <NUM> and begin actively interacting with other installed software. Such detection of malicious objects is performed by emulating the operation of the computer system <NUM> in a virtual environment <NUM> built for this purpose. In this manner, an offender, when attacking the computer system <NUM>, infects the bait virtual environment <NUM>, which acts as a honeypot resource.

In one embodiment, the malicious object can include a malicious application; a malicious file; a uniform resource locator (URL), from which at least the following occurs: malicious applications are propagated, and/or a network attack on the computer system is carried out; a network address, from which at least the following occurs: malicious applications are propagated, and/or a network attack on the computer system is carried out.

For example, the following can be sent in the network traffic <NUM>: a malicious program - a keylogger; and instructions for a botnet client.

In yet another example, the network traffic itself does not include the above-described entities (i.e. is safe or conditionally safe), but such entities can get into the network traffic from sources spreading spam, malicious programs, or intrusive advertising, etc. (for example, from specialized servers rented by nefarious operators).

In one embodiment, the computer system is represented by system depicted in <FIG>. The computer system <NUM> can include, for example: a personal computer; a notebook; a mobile device (such as a smartphone, a smart watch, a tablet, etc.); a server or a distributed server system; a System-on-a-Chip (SoC); and/or other built-in systems.

The system for detection of malicious objects in the network traffic being described includes at least two gathering tools <NUM>, each functioning on a separate computer system <NUM>.

In one embodiment, the virtual environment <NUM> operates on a server which is not a computer system <NUM>.

The gathering tool <NUM> is configured for gathering data about the computer system <NUM> on which the gathering tool <NUM> operates, and for sending the gathered data to the distribution tool <NUM>.

The gathering of data about the computer system <NUM> can be done both before interception of the network traffic <NUM> (for example, during the booting of the operating system), and/or during interception of the network traffic <NUM>. The second case, although requiring more computing resources, allows for the more efficient building of a virtual environment <NUM>, and therefore allows more efficient detection of malicious objects in the network traffic.

In one embodiment, data about the computer system <NUM> can include: the hardware characteristics of the computer system <NUM>; information about the computing resources of the computer system <NUM>; information about the software installed on the computer system <NUM>; information about the network environment of the computer system <NUM>; and/or information about the physical location of the computer system <NUM>.

For example, data about the computer system can include: random access memory size; the number of hard drives, the total capacity of the hard drives, and the amount of free space on the hard drives; a list of installed software; software versions; and/or name of the processor, video board, peripheral devices, etc..

In yet another example, if an advanced persistent threat (APT) is supposed, then the data about the computer system <NUM> can be represented directly by an image of the above-mentioned computer system <NUM>. Such an image can be used to build a virtual environment <NUM> (in which the image is to be deployed). In this manner, the virtual environment <NUM> can completely emulate the functioning of the operating system <NUM>, which, in turn, can facilitate the detection of malicious objects that are intended exclusively for a specific computer system <NUM> and which would not be detected in a virtual environment <NUM> built on a different basis (for example, in a virtual environment emulating the functioning of an average user's computer system).

In yet another embodiment, the gathering tool <NUM> is additionally configured for gathering data about the functioning of applications on a computer system <NUM>. The functioning of applications can include: information on creation, modification and deletion of files on the computer system <NUM>; information on network connections and on the data sent on a network; and/or information about the users operating the computer system <NUM>.

The distribution tool <NUM> is configured for choosing a virtual environment <NUM> from at least two pre-built virtual environments based on the data gathered by the gathering tool <NUM> about the computer system <NUM>.

In one embodiment, the virtual environment <NUM> is chosen from pre-built virtual environments. For example, pre-build virtual environments can at least have software installed that has the same functionality as the software installed on the computer system <NUM>; have computing resources similar to those of the computer system <NUM>; have a speed of data transfer from the computer system <NUM> to the virtual environment <NUM> that exceeds a preset threshold value; function with the same network environment as the computer system <NUM>; and/or have a set of vulnerabilities assigned in advance.

For example, in order to detect malicious cryptoware programs, which encrypt electronic documents (for example, Microsoft Office documents), relevant applications (such as Microsoft Office) must be installed in the virtual environment <NUM>. To ensure that the virtual environment <NUM> matches the computer system <NUM> more accurately, the virtual environment <NUM> needs to have applications of the same versions as on the computer system <NUM> (e.g. Microsoft Office <NUM>) installed.

In another example of detection of exploits (i.e. executable code that uses vulnerabilities of operating systems or applications), the virtual environment <NUM> must have the same operating system installed as the one on the computer system <NUM>, but with uncorrected vulnerabilities. On the one hand, this approach allows the most accurate reproduction of a computer system <NUM> with minimal consumption of computing resources, while, on the other hand, allows for the obtaining of malicious objects in the network traffic <NUM> with the highest probability.

In another embodiment, the virtual environment <NUM> is chosen from pre-built virtual environments, based on a pre-trained model. In yet another embodiment, the pre-trained model represents a group of rules. The rules can be related to the choice of a virtual environment <NUM>; and/or the building of a virtual environment <NUM> for the assigned computer system <NUM>.

A trained model is built using machine learning methods. For example, neural networks; error correction methods; back-propagation methods; support vector machine methods; boosting methods; and/or Bayesian networks can be utilized. A particular example of a trained model is the trained distribution model <NUM> presented in the description of <FIG>.

For example, for various types of malicious objects, various virtual environments <NUM> may be pre-built with respective software and characteristics. To detect vulnerabilities in the virtual environment <NUM>, an operating system and software with uncorrected vulnerabilities is installed. To detect cryptoware programs, software for electronic document turnover and for working with media data is installed. To detect spam mailings, software for working with social networks is installed, and so on.

In another example, various virtual environments <NUM> can be assigned various computing resources, such as random access memory, space on a hard drive, or processor performance (controlled by allocated processor time frames). Therefore, a virtual environment <NUM> configured for detection of certain types of malicious objects uses a minimally required amount of computing resources. This approach allows additional virtual environments <NUM> to be built and supported on one server, which, in turn, provides more flexibility in choosing between different virtual environments <NUM> for the assigned computer system <NUM>.

In another example, in addition to the building of virtual environments <NUM> for assigned types of malicious objects, virtual environments <NUM> can be built for certain groups of users, such as: a group of average users, i.e. users working with popular software and performing the most frequent actions on computer systems <NUM>; a group of users working with electronic documents; a group of users working with video and audio data; and/or a group of users working with databases, etc..

Accordingly, a maximum number of target audiences with a minimal use of computing resources (allocated for the functioning of virtual environments <NUM>) can be covered. Also, for specific users, computer systems <NUM>, or actions taken by users on the said computer systems <NUM>, separate virtual environments can be built. As discussed above, this approach is the most efficient one for detecting malicious objects used for advanced persistent threats (APTs).

In another embodiment, the distribution tool <NUM> is additionally configured for choosing a virtual environment <NUM> on the basis of the characteristics of intercepted network traffic <NUM>.

In yet another embodiment, the characteristics of intercepted network traffic can include a uniform resource locator (URL), from which network traffic <NUM> comes to the computer system <NUM>; network address, from which network traffic <NUM> comes to the computer system <NUM>; and/or hash sums calculated on the basis of the content of the network traffic <NUM>.

The network traffic control tool <NUM> is configured for intercepting the network traffic <NUM> of the computer system <NUM> and for sending it to the emulation tool <NUM> in the chosen virtual environment <NUM>.

In one embodiment, the network traffic control tool <NUM> is a driver working on the computer system <NUM>. In another embodiment, the gathering tool <NUM> and the network traffic control tool <NUM> are provided in the form of a thin client.

In yet another embodiment, the network traffic control tool <NUM> additionally sends the intercepted network traffic <NUM> to other software running on the computer system <NUM>. In this manner, it becomes possible to intercept network traffic <NUM> and to use the intercepted intercept network traffic <NUM> for subsequent emulation of the operation of the computer system <NUM> in the virtual environment <NUM>, while allowing the user to continue using the computer system <NUM>.

In yet another embodiment, the network traffic <NUM> interception tool is additionally configured for: filtering the network traffic <NUM> on the basis of the data about the source of the network traffic <NUM>, the content of the network traffic <NUM>, etc.; categorizing the network traffic <NUM> on the basis of the filtration results; and subsequent sending of the network traffic, depending on the chosen category, to the emulation tool <NUM> running in the virtual environment <NUM> or to other software running on the computer system <NUM>.

For example, all network packets from the network traffic <NUM> whose source is known and included in the list of authorized addresses are categorized as safe network packets and are thus sent to other software running on the computer system <NUM>. Conversely, all network packets whose source is unknown or included in the list of prohibited addresses are categorized as potentially dangerous and are sent to the emulation tool <NUM> running in the virtual environment <NUM>.

In another example, a user visits a site using a browser and receives site content from the server. The network traffic from the server that stores the site's pages includes both the code of the site's page and links to resources used by the page. In an embodiment, one of the links is a link to a malicious javascript. The link is then found to be unsafe. As a result, the network traffic control tool <NUM> sends data from the network traffic <NUM> to the browser without the data from the said link, but sends the full traffic to the emulation tool <NUM>.

In another embodiment, the intercepted network traffic <NUM> is sent to the emulation tool <NUM> using a virtual private network (VPN). Virtual environments <NUM> can run either on a single computer device (for example, on a single server) or on multiple computer devices (building a distributed computer system and a distributed systems of virtual environments <NUM>).

The emulation tool <NUM> is configured for emulating the functioning of a computer system <NUM> in a virtual environment <NUM> on the basis of data from intercepted network traffic <NUM> and transfer of the results of the emulation of the functioning of the computer system to the analysis tool <NUM>.

In one embodiment, the emulation tool <NUM> comprises virtualization software. For example, the emulation tool <NUM> can comprise such software as Microsoft Hyper-V, VMware Server, VMware Workstation, VirtualBox, etc..

The analysis tool <NUM> is configured for detecting a malicious object <NUM> in a virtual environment <NUM> based on analysis of the results of the emulation of the functioning of the computer system <NUM>.

In one embodiment, the analysis tool <NUM> comprises anti-virus software. Accordingly, the analysis tool can utilize at least static analysis (e.g. analysis of programs for maliciousness based on data included in the files of the programs being analyzed). In an embodiment, static analysis can include, for example, signature analysis. In an embodiment, signature analysis includes a search for matches between any part of the code of the programs being analyzed and a known code (signature) from the database of malicious programs' signatures). In an embodiment, signature analysis can include utilization of lists of authorized and prohibited applications as a search for calculated checksums from the programs being analyzed (or their parts) in a database of checksums of malicious programs (lists of prohibited programs) or a database of checksums of safe programs (lists of authorized programs).

In embodiments, the analysis tool <NUM> can utilize dynamic analysis. In an embodiment, dynamic analysis includes analysis of programs for maliciousness based on data obtained during execution or emulation of the programs being analyzed. In an embodiment dynamic analysis can include, for example, heuristic analysis. In an embodiment, a heuristic analysis can include emulation of the functioning of the programs being analyzed, creation of emulation logs (including data on calls for API functions, transmitted parameters, parts of the code of the programs being analyzed, etc.) and search for any matches of data from the created logs to data from the database of behavior signatures of malicious programs. In an embodiment, dynamic analysis can include, for example, proactive protection as interception of calls for API functions of the programs being analyzed, creation of behavior logs of the programs being analyzed (including data on calls for API functions, transmitted parameters, parts of the code of the programs being analyzed, etc.) and search for any matches of data from the created logs to data from the database of calls for malicious programs.

In yet another embodiment, analysis tool <NUM> can further build and provide a flow of URL/IP addresses to outside security solutions (anti-virus software, network filters, etc.). In another embodiment, analysis tool <NUM> can further add URL addresses with malicious software to cloud services, in order to protect users who use anti-virus products.

Referring to <FIG>, a flowchart of a method for detecting a malicious object in network traffic is depicted, according to an embodiment. The method for detecting a malicious object in network traffic includes <NUM> in which data about the computer system are gathered, <NUM> in which a virtual environment is chosen, <NUM> in which network traffic is intercepted, <NUM> in which the computer system's functioning is emulated, and <NUM> in which a malicious object is detected.

At <NUM>, using the gathering tool <NUM>, data about the computer system <NUM> are gathered.

At <NUM>, using the distribution tool <NUM>, a virtual environment <NUM> is chosen from at least two pre-built virtual environments, based on the gathered data about the computer system <NUM>. In an embodiment, <NUM> and <NUM> can be performed before the beginning of <NUM> (for example, during the loading of an operating system or the launch of an application, such as a browser); during <NUM> (for example, while an application is running which actively generates network traffic, such as a browser when loading a site page); and/or after <NUM> is completed.

At <NUM>, using the traffic network control tool <NUM>, the network traffic of the computer system <NUM> is intercepted.

At <NUM>, using the emulation tool <NUM>, the functioning of the computer system <NUM> is emulated in the virtual environment <NUM>, based on data from the intercepted network traffic <NUM>.

At <NUM>, using the analysis tool <NUM>, a malicious object <NUM> is detected in the virtual environment <NUM>, based on analysis of the results of the emulation of the functioning of the computer system <NUM>.

Referring to <FIG>, a block diagram of a system for building a system of honeypot resources is depicted, according to an embodiment. The block diagram of a system for building a system of honeypot resources generally includes a building tool <NUM>, a virtual environments database <NUM>, a distribution model <NUM>, a distribution tool <NUM>, computer systems <NUM>, each including a gathering tool <NUM> and a network traffic control tool <NUM>, and virtual environments <NUM>, each including an emulation tool <NUM>.

One of the purposes of a honeypot building system is to provide a system for distribution of virtual environments <NUM> between computer systems <NUM>, which ensures efficient detection of malicious objects <NUM> from network traffic <NUM>, because each computer system <NUM> is assigned the most suitable virtual environment <NUM>. Advantageously, the total use of computing resources by the system being described is reduced, and, further, the rate of detection of malicious files <NUM> in the virtual environment <NUM> specially configured for this purpose is increased.

In an embodiment, a system for building a honeypot system includes at least two computer systems <NUM>. For example, details on the computer system <NUM> are provided in <FIG>.

In one embodiment, the building tool <NUM>, the distribution tool <NUM> and the virtual environments <NUM> run on separate servers. In another embodiment, the building tool <NUM> and the virtual environments <NUM> run on the same servers, while the computer systems <NUM> and the distribution tool <NUM> run on other computer systems. In such an embodiment, the computer system <NUM> and the distribution tool <NUM> can run on the same computer system.

For example, a user computer can be a computer system <NUM> that runs a distribution tool <NUM>, which establishes connection with a remote server that runs a building tool <NUM> and a virtual environment <NUM> built by the building tool <NUM>.

Previously, data are gathered about each computer system <NUM>, using a gathering tool <NUM>.

In one embodiment, data about the computer system <NUM> can include the hardware characteristics of the computer system; information about the computing resources of the computer system <NUM>; information about the software installed on the computer system <NUM>; information about the network environment of the computer system <NUM>; and/or information about the physical location of the computer system <NUM>.

The building tool <NUM> is configured for building at least two virtual environments <NUM>, each including an emulation tool <NUM> configured for emulating the functioning of the computer system <NUM> in the virtual environment <NUM> based on the gathered data about the computer systems <NUM> and for transferring of data about the built virtual environments to the distribution tool <NUM>.

In one embodiment, the virtual environment <NUM> is built according to the following characteristics: contains software that has the same functionality as the software installed on the computer system <NUM>; has computing resources similar to those of the computer system <NUM>; has a speed of data transfer from the computer system <NUM> to the virtual environment <NUM> that exceeds a preset threshold value; functions with the same network environment as the computer system <NUM>; and/or has a set of vulnerabilities assigned in advance.

In another embodiment, the virtual environment <NUM> is built according to the following characteristics: based on elements of previously built virtual environments stored in the virtual environments database <NUM> (for example, in the form of images), where at least the following act as virtual environment elements: components of an operating system running in a virtual environment, applications running in a virtual environment, operating system settings, application settings; and/or data (such as electronic documents, media data, etc.). Further, the virtual environment <NUM> is built according to the following additional characteristics: by choosing one of the virtual environments stored in the virtual environments database <NUM>; and/or based on pre-built rules for building virtual environments.

In another embodiment, the building of the virtual environment <NUM> for one computer system <NUM> influences the building of the virtual environment <NUM> for another computer system <NUM>. For example, virtual environments <NUM> for computer systems <NUM> can be built so that they do not exceed, when running, the allocated computing resources of the server (on the condition that the built virtual environments <NUM> will work on the same server).

The building tool <NUM> is additionally configured for training the distribution model <NUM> based on data about the computer systems <NUM> and on the built virtual environments <NUM>. For example, during the subsequent selection using the distribution tool <NUM> using the distribution model <NUM> of virtual environments <NUM>, the distribution model <NUM> is trained such that tasks are performed for the assigned computer systems, where, at least: the rate of detection of malicious objects of various types in the chosen virtual environments <NUM> would be the highest; the time for the transfer of network traffic <NUM> between the computer systems <NUM> and the virtual environments <NUM> would be minimal; and/or the load (i.e. the use of computing resources, machine time consumption, electric energy consumption, etc.) on the virtual environment <NUM> would be below preset threshold values.

For example, the building tool <NUM> can be used to train the distribution model <NUM> based on the previously built virtual environments <NUM>, which were used for detecting Windows operating system exploits in the network traffic <NUM>.

In another example, the building tool <NUM> can be used to re-train the distribution model <NUM> using the results of the functioning of the analysis tool <NUM> (e.g. see <FIG>). For example, such re-training is done to reduce the time for the transfer of network traffic <NUM> between computer systems <NUM> and virtual environments <NUM>. Accordingly, for this purpose, the virtual environments <NUM> are chosen at shorter network distances to the computer systems <NUM>.

The building of a virtual environment <NUM> for a specific computer system <NUM> (the building of a virtual environment <NUM> based on data about the functioning of the computer system <NUM>) ensures more accurate emulation of the functioning of the computer system <NUM>, which, in turn, increases the rate of detection of malicious applications <NUM>.

For example, in case of a targeted attack on a computer system <NUM>, an insufficiently accurate emulation of the computer system <NUM> functioning may prevent the triggering of the malicious functionality of the malicious application <NUM> contained in the network traffic <NUM>. In turn, detection of the malicious application is prevented. The more accurately the operation of the computer system <NUM> is emulated, the higher is the chance of detecting a malicious application configured for running on the computer system, and/or the higher is the chance of determining the malicious functionality of such application.

The distribution tool <NUM> is configured for building a system of honeypots. Such building includes choosing, for each computer system <NUM>, at least one virtual environment <NUM> based on data about the built virtual environments <NUM> and establishing connection between the computer system <NUM> and the virtual environment <NUM> for transfer of data between the computer system <NUM> and the emulation tool <NUM> for emulating the chosen virtual environment <NUM>.

In one embodiment, the virtual environment <NUM> for the computer system <NUM> is selected on the basis of a trained model <NUM>.

In another embodiment, the virtual environment <NUM> for the computer system <NUM> is selected at least so that: the usage of computing resources of the virtual environment <NUM> would be below a preset threshold; and/or the speed of data transfer from the computer system <NUM> to the virtual environment <NUM> would exceed a preset threshold value.

In yet another embodiment, the virtual environment <NUM> for the computer system <NUM> is chosen on the basis of the types of malicious objects expected to be detected in the network traffic <NUM>. For example, efficient detection of malicious cryptoware programs and exploits requires two custom-built virtual environments <NUM>. Therefore, the distribution tool <NUM> can choose, for an assigned computer system <NUM>, two virtual environments <NUM> at once, to which the network traffic <NUM> intercepted by the network traffic control tool <NUM> will be sent (e.g. see <FIG>).

Therefore, in one embodiment, the distribution tool <NUM> is configured to choose, for the assigned computer systems <NUM>, the kind of virtual environments <NUM> that maximize the rate of detection of malicious objects of various types. In an embodiment, the distribution tool <NUM> is configured to choose, for the assigned computer systems <NUM>, the kind of virtual environments <NUM> that minimize the time for the transfer of network traffic <NUM> between the computer systems <NUM> and the virtual environments <NUM>. In an embodiment, the distribution tool <NUM> is configured to choose, for the assigned computer systems <NUM>, the kind of virtual environments <NUM> that ensure that the load on the virtual environments <NUM> (i.e. the use of computing resources, machine time consumption, electric energy consumption, etc.) is below preset threshold values.

In an embodiment, distribution of virtual environments <NUM> between computer systems <NUM> allows for spreading of the computing load more efficiently between the tasks of emulating the functioning of the computer systems <NUM>. Accordingly, more complex and resource-consuming emulation algorithms can be utilized, which in turn increases the efficiency (accuracy) of the emulation of the computer systems <NUM>.

In another embodiment, the connection for the data transfer between the computer system <NUM> and the emulation tool <NUM> is established using a virtual private network (VPN).

In yet another embodiment, additionally, depending on the result of the functioning of the analysis tool <NUM> for the virtual environment <NUM> (e.g. see <FIG>), the building tool <NUM> is used to make a decision to re-train the distribution model <NUM> so that the choice of virtual environments <NUM> for the computer system <NUM> based on data about the computer system <NUM> or about the network traffic <NUM> performs the aforementioned tasks more efficiently.

Referring to <FIG>, a flowchart of a method for building a system of honeypot resources is depicted, according to an embodiment. The method for building a system of honeypot resources depicted in <FIG> includes <NUM> in which data about the computer systems are gathered, <NUM> in which virtual environments are built, and <NUM> in which a system of honeypot resources is built.

At <NUM>, using the gathering tool <NUM>, data about at least two computer systems <NUM> are gathered. At <NUM>, the building tool <NUM> is used to build at least two virtual environments <NUM>, each including an emulation tool <NUM> configured for emulating the operation of the computer system <NUM> in the virtual environment <NUM>, on the basis of the gathered data about the computer systems <NUM>. At <NUM>, the distribution tool <NUM> is used to build a system of honeypots. For example, <NUM> can include choosing, for each computer system <NUM>, at least one virtual environment <NUM> based on the data about the built virtual environments <NUM> and establishing connection between the computer system <NUM> and the virtual environment <NUM> for transfer of data between the computer system <NUM> and the emulation tool <NUM> for emulating the chosen virtual environment <NUM>.

Referring to <FIG>, a diagram illustrating in greater detail a computer system <NUM> on which aspects of the disclosure as described herein may be implemented according to various embodiments is depicted.

The computer system <NUM> can comprise a computing device such as a personal computer <NUM> includes one or more processing units <NUM>, a system memory <NUM> and a system bus <NUM>, which contains various system components, including a memory connected with the one or more processing units <NUM>. In various embodiments, processing units <NUM> can include multiple logical cores that are able to process information stored on computer readable media. The system bus <NUM> is realized as any bus structure known at the relevant technical level, including, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus, which is able to interact with any other bus architecture. The system memory can include non-volatile memory such as Read-Only Memory (ROM) <NUM> or volatile memory such as Random Access Memory (RAM) <NUM>. The Basic Input/Output System (BIOS) <NUM> contains basic procedures ensuring transfer of information between the elements of personal computer <NUM>, for example, during the operating system boot using ROM <NUM>.

Personal computer <NUM>, in turn, has a hard drive <NUM> for data reading and writing, a magnetic disk drive <NUM> for reading and writing on removable magnetic disks <NUM>, and an optical drive <NUM> for reading and writing on removable optical disks <NUM>, such as CD-ROM, DVD-ROM and other optical media. The hard drive <NUM>, the magnetic drive <NUM>, and the optical drive <NUM> are connected with system bus <NUM> through a hard drive interface <NUM>, a magnetic drive interface <NUM> and an optical drive interface <NUM>, respectively. The drives and the corresponding computer information media represent energy-independent means for storage of computer instructions, data structures, program modules and other data on personal computer <NUM>.

The system depicted includes hard drive <NUM>, a removable magnetic drive <NUM> and a removable optical drive <NUM>, but it should be understood that it is possible to use other types of computer media, capable of storing data in a computer-readable form (solid state drives, flash memory cards, digital disks, random-access memory (RAM), etc.), connected to system bus <NUM> through a controller <NUM>.

The computer <NUM> comprises a file system <NUM>, where the recorded operating system <NUM> is stored, as well as additional program applications <NUM>, other program engines <NUM> and program data <NUM>. The user can input commands and information into the personal computer <NUM> using input devices (keyboard <NUM>, mouse <NUM>). Other input devices (not shown) can also be used, such as: a microphone, a joystick, a game console, a scanner, etc. Such input devices are usually connected to the computer system <NUM> through a serial port <NUM>, which, in turn, is connected to a system bus, but they can also be connected in a different way - for example, using a parallel port, a game port or a Universal Serial Bus (USB). The monitor <NUM> or another type of display device is also connected to system bus <NUM> through an interface, such as a video adapter <NUM>. In addition to monitor <NUM>, personal computer <NUM> can be equipped with other peripheral output devices (not shown), such as speakers, a printer, etc..

Personal computer <NUM> is able to work in a network environment; in this case, it uses a network connection with one or several other remote computers <NUM>. Remote computer(s) <NUM> is (are) similar personal computers or servers, which have most or all of the above elements, noted earlier when describing the substance of personal computer <NUM> shown in <FIG>. The computing network can also have other devices, such as routers, network stations, peering devices or other network nodes.

Network connections can constitute a Local Area Network (LAN) <NUM> and a Wide Area Network (WAN). Such networks are used in corporate computer networks or in corporate intranets, and usually have access to the Internet. In LAN or WAN networks, personal computer <NUM> is connected to the Local Area Network <NUM> through a network adapter or a network interface <NUM>. When using networks, personal computer <NUM> can use a modem <NUM> or other means for connection to a world area network, such as the Internet. Modem <NUM>, which is an internal or an external device, is connected to system bus <NUM> through serial port <NUM>. It should be clarified that these network connections are only examples and do not necessarily reflect an exact network configuration, i.e. in reality there are other means of establishing a connection using technical means of communication between computers.

Claim 1:
A method for building a honeypot environment, the method comprising:
collecting, by a gathering tool (<NUM>), data about a computing system (<NUM>);
selecting, by a distribution tool (<NUM>), at least one virtual environment (<NUM>) of a plurality of pre-built virtual environments for association with the computing system (<NUM>) based on the data, and one of:
a rate of detection of malicious objects (<NUM>) in the at least one virtual environment (<NUM>) being above a rate detection threshold;
a time for transferring the network traffic (<NUM>) between the computing system (<NUM>) and the at least one virtual environment (<NUM>) being below a transfer threshold; or
a load on the at least one virtual environment (<NUM>) being below a load threshold,
wherein each of the plurality of pre-built virtual environments includes an emulator (<NUM>);
intercepting, by a network traffic control tool (<NUM>), network traffic (<NUM>) of the computing system;
emulating, by the emulator (<NUM>) of the at least one virtual environment (<NUM>), the computing system (<NUM>); and
detecting, by an analysis tool (<NUM>), at least one malicious object (<NUM>) from the intercepted network traffic (<NUM>) based on the emulating.