Patent Document ID: 9473520
Application ID: 14571983
Patent Flag: 1

Claim One:
1. A system for tracking malware operator behavior patterns in a network environment simulated for an extended period of time, comprising: a non-transitory memory storing instructions; and a processor device executing the instructions to cause the system to perform a method comprising: receiving organizational data that describes a virtual organization, wherein the organizational data comprises a plurality of simulated users that are logged into a plurality of simulated machines; creating user profiles for the plurality of simulated users using career detail information obtained from searching a website so that the user profiles are compatible with the virtual organization; providing, using the processor device, a simulated computer network of the virtual organization based at least partially on the organizational data and the user profiles, wherein after the simulated computer network is provided, at least one malware is installed on the simulated computer network to create an incubator; monitoring one or more interactions between the simulated computer network and an operator of the malware, wherein the one or more interactions comprise the operator of the malware illicitly gathering information related to the user profiles; and building a malware operator profile that characterizes the operator of the malware based on the one or more interactions.