Deception Studio: Attacker Characterization and Dynamic Relocation

Deception Studio (DS) is a learning, behavior-based defense system for ensuring service availability and trust. DS's learning capabilities include attack detection, prediction, and attribution and can react to attacks in real time by shaping an adversary's perception and creating an illusion capable of manipulating his planning processes. Responses are deployed in a targeted fashion, allowing DS to respond with responses proportionate to the attack without inflicting hard penalties on valid users. Such responses can be both deceptive and active, extending the protection boundary of the system and forcing attackers to react to ever-changing conditions. DS can further provide availability of critical services by moving them out-of-band during ongoing attacks, dynamically migrating an attacker into a decoy environment, or degrading his access while maintaining availability for legitimate users. Before employing such responses, DS includes technology to heal critical services from infection and can also bring this healing technology to bare on compromised systems, returning them to the pool of usable systems. Deception Studio represents the state-of-the-art in active, behavior-based attack detection and prevention systems, imbuing systems with the ability to remain operational, available, and trustworthy through even the most targeted attacks.