Embodiments of the invention are directed to techniques that include receiving a query intended for a targeted database and determining that the query is from an unauthorized user. A response is returned to the unauthorized user generated by a model, the response being dynamically generated to fulfill the query. The model is configured to generate responses consistent with any previous responses returned to the unauthorized user.

Provided is a method of securing a software code of an application including at least one constant data. The method produces secure software code can then be executed on a processor. The method includes fragmenting current constant data into several valid data chunks of random length, encoding and storing the valid data chunks at random locations in the application software code, identifying all occurrences of the current constant data in the application software code and replacing each of them with a call to a Runtime application self-protection (RASP) agent for reading the current constant data, and inserting, at random locations of a control flow graph of the application software code, RASP check instructions which when executed at runtime. The RASP agent being configured for running in the application runtime environment and being capable of controlling application execution and detecting and preventing real-time attacks.

A compliance monitor measures metrics regarding one or more managed devices in a network. The compliance monitor generates a log based on the information detected by the measurement trackers and to transmit a report based on the generated log to a recipient. The compliance monitor also initiates one or more security actions based on the one or more measurement trackers indicating that a measured metric exceeds an associated threshold measurement value.

A system and method of deployment of malware detection traps by at least one processor may include performing a first interrogation of a first Network Asset (NA) of a specific NA family; determining, based on the interrogation, a value of one or more first NA property data elements of the first NA; obtaining one or more second NA property data elements corresponding to the specific NA family; integrating the one or more first NA property data elements and the one or more second NA property data elements to generate a template data element, corresponding to the specific NA family; producing, from the template data element, a malware detection trap module; and deploying, on one or more computing devices of a computer network, one or more instantiations of the malware detection trap module as decoys of the first NA.

System, methods, and other embodiments described herein relate to improving security of protected values in a memory. In one embodiment, a method includes, in response to receiving a write request indicating at least an item and a write value to write into the memory, determining whether a protected items list (PIL) indicates that the item is protected. The method includes replacing the write value of the write request with a protected value from the PIL that corresponds with the item when the item is listed in the PIL as being protected. The method further includes executing the write request to the memory.

A controller emulator, coupled to an interface that exposes the controller emulator to inputs from external sources, provides one or more control signals to a process simulator and a deep learning process. In response, the process simulator simulates response data that is provided to the deep learning processor. The deep learning processor generates expected response data and expected behavioral pattern data for the one or more control signals, as well as actual behavioral pattern data for the simulated response data. A comparison of at least one of the simulated response data to the expected response data and the actual behavioral pattern data to the expected behavioral pattern data is performed to determine whether anomalous activity is detected. As a result of detecting anomalous activity, one or more operations are performed to address the anomalous activity.

Systems and methods are described for inception of suspicious network traffic to allow detection of the beginning of common attacks by network security devices, such as NGFWs, UTM appliances and IPS appliances. According to one embodiment, inception engine running on network security appliance protecting a private network monitors a session between an external computing device and a server device associated with the private network. In response to receipt of suspicious traffic from external computing device indicative of an attack sequence, the inception engine blocks the suspicious traffic from reaching the server device and incepts the attack sequence by providing one or more responses to the external computing device, which are selected based on the attack sequence. Further, when the attack is confirmed, the inception engine diverts the traffic to a more capable deception device.

Access is provided to a plurality of virtual logical hosts and a decoy resource. Each virtual logical host comprises comprising one or more virtualized containers. A communication sent to the decoy resource is detected. Network communication data with respect to the decoy resource is collected based at least in part on detecting the communication sent to the decoy resource. The network communication data includes metadata used to provide said access via network communications to the decoy resource.

Various automated techniques are described herein for protecting computing devices from malicious code injection and execution by providing a malicious process with incorrect information regarding the type and/or version and/or other characteristics of the operating system and/or the targeted program and/or the targeted computing device. The falsified information tricks the malicious process into injecting shellcode that is incompatible with the targeted operating system, program and/or computing device. When the incompatible, injected shellcode attempts to execute, it fails as a result of the incompatibility, thereby protecting the computing device.

A controller emulator, coupled to an interface that exposes the controller emulator to inputs from external sources, provides one or more control signals to a process simulator and a deep learning process. In response, the process simulator simulates response data that is provided to the deep learning processor. The deep learning processor generates expected response data and expected behavioral pattern data for the one or more control signals, as well as actual behavioral pattern data for the simulated response data. A comparison of at least one of the simulated response data to the expected response data and the actual behavioral pattern data to the expected behavioral pattern data is performed to determine whether anomalous activity is detected. As a result of detecting anomalous activity, one or more operations are performed to address the anomalous activity.