Method, system and program for obtaining information about an external computer system

Abstract

A method for obtaining information about an external computer system is provided, the method including receiving a request from the external computer system, and in response to classifying the external computer system as a potential threat in response to the request, generating a computer file in response to the request, the computer file including instructions designed to, when executed on a processor of the external computer system, obtain information about the external computer system, and prepare data in response to the request, the data being sent along with the computer file to the external computer system, the method being configured to receive information generated in response to the instructions of the computer file and store the information in a database to provide the information for development of measures to protect the computer system. (Figure 5)

Description

[Technical field]

[0001] The present disclosure relates generally to the field of intrusion detection systems, and more particularly to a method for obtaining information about an external computer system after classifying the external computer system as a threat to the computer system.

[0002] Intrusion detection systems may attempt to detect potential attackers by comparing the attacker's actual requests directed at the protected system to a request database, which may contain information about other attacker requests directed at the protected system, who may have penetrated the protected system before the actual attacker. Summary of the Invention

[0003] Various embodiments provide a computer system and a method for obtaining information about an external computer system as described by the subject matter of the independent claims. Advantageous embodiments are described in the dependent claims. The embodiments of the present disclosure may be freely combined if they are not mutually exclusive.

[0004] In one aspect, the present disclosure includes a computer-implemented method for obtaining information regarding an external computer system having a connection to a computer system, the method including: - receiving requests from external computer systems via a connection; - classifying external computer systems as potential threats to the computer system; - generating, in response to classifying the external computer system as a potential threat, a computer file responsive to the request, the computer file including instructions that, when executed on a processor of the external computer system, are designed to obtain information about the external computer system; - Providing the data requested; - transmitting the data together with the computer file to an external computer system; - receiving information about external computer systems generated in response to instructions in computer files; - storing information about external computer systems within the computer system in order to provide such information for the development of measures to protect the computer system;

[0005] In another aspect, the present disclosure includes a computer program product for obtaining information regarding an external computer system having a connection to a computer system, the computer program product including one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media, the program instructions including: - program instructions for receiving requests from an external computer system via a connection; - upon request, program instructions for classifying external computer systems as potential threats to the computer system; - program instructions for generating, in response to classifying an external computer system as a potential threat, a computer file responsive to the request, the computer file comprising instructions, the instructions being designed to obtain information about the external computer system when executed on a processor of the external computer system; - program instructions for preparing the data in response to a request; - program instructions for transmitting data together with computer files to an external computer system; - program instructions for receiving information about an external computer system generated in response to instructions in a computer file; - program instructions for storing information about external computer systems in a database in order to provide information about external computer systems for the development of measures to protect computer systems;

[0006] In another aspect, the present disclosure includes a computer system for obtaining information regarding an external computer system having a connection to the computer system, the computer system configured to: - receiving requests from external computer systems via a connection; - upon request, classifying external computer systems as potential threats to your computer system; - generating, in response to classifying the external computer system as a potential threat, a computer file responsive to the request, the computer file including instructions that, when executed on a processor of the external computer system, are designed to obtain information about the external computer system; - Providing data as requested; - transmitting the data together with the computer file to an external computer system; - receiving information about external computer systems generated in response to instructions in computer files; - storing information about external computer systems in a database in order to provide such information for the development of measures to protect the computer system; [Brief description of the drawings]

[0007] In the following, embodiments of the present disclosure will be described in more detail, by way of example only, with reference to the drawings, in which:

[0008] [Figure 1] 1 is a block diagram that generally illustrates a proxy server and a controller server of a computer system, according to an example of the present subject matter.

[0009] [Diagram 2] FIG. 2 is a block diagram illustrating the components of the controller server shown in FIG. 1.

[0010] [Diagram 3] 2 is a block diagram illustrating components of the proxy server shown in FIG. 1.

[0011] [Figure 4] FIG. 2 is a block diagram showing the connection between the computer system shown in FIG. 1 and a network.

[0012] [Diagram 5] 1 is a flow chart of a method for obtaining information about an external system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The description of various embodiments of the present disclosure is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to allow other skilled in the art to understand the embodiments disclosed herein.

[0014] The computer system in some embodiments may be a personal computer system, a server computer system, a microprocessor-based system, or a programmable consumer electronics device such as a mobile phone or a network PC. In one example, the computer system may be a network of multiple computing devices, such as multiple servers. By way of further example, the computer system may be a stand-alone computer that is only connected to an external computer system.

[0015] The request may be generated by an external computer system (hereafter also referred to as the external system). The request may be an HTTP request, such as the HTTP requests "GET" or "HEAD". For example, the external computer system may execute web browser software to display web pages for a user of the external computer system. The web pages may be hosted on a web server of the computer system. The HTTP request may be generated in response to input data created by a user.

[0016] The input data may describe and be produced in response to a user's actions. A user's actions may include checking a box on a web page, entering text into a text field on a web page, etc. Thus, the input data may be received in the form of electronic signals generated by a keyboard or mouse of the external system. According to one example, the external system may execute an automation script that may automatically generate the input data by mimicking a user.

[0017] The request may include information to specify the data, such as a file name, a hyperlink, the name of the requested table, a table column number and / or a table row number.

[0018] The external system may, for example, execute a web browser to display an updated version of the web page in response to the data transmitted with the computer file. The data is prepared in response to a request, and thus the request may be described as a request for the data. The data may include data to display a graphic, for example, to display a login screen. Additionally, the data may include sensitive data (e.g., data for a payroll system of the computer system) or non-sensitive data (e.g., an incorrect version of sensitive data), or both. In some embodiments, the data may be designed such that an updated version of the web page is displayed in response to the data. In some embodiments, the updated version of the web page may include the data.

[0019] The computer system can prepare the data in response to the information specifying the data. For example, the processor of the computer system can read the data from a storage of the computer system and send the data to an interface of the computer system. The storage can be the storage of a database server or a decoy server. According to one example, the computer system can generate the data in response to the request.

[0020] The connection between the external system and the computer system may be provided through the Internet, an interface of the computer system, and an interface of the external system. In one example, the interface of the computer system may be indirectly connected to the interface of the external system through a proxy server.

[0021] The computer system may classify an external system as a potential threat depending on recorded data traffic between the external system and the computer system. The recorded data traffic may include requests. In one example, the computer system may classify an external system as a potential threat depending on requests using a request database. The request database may store a profile of requests that have been previously classified as attacks against the computer system. In one example, the computer system may classify an external system as a potential threat depending on a history of requests performed by the external system. The request history may include multiple past requests and the request mentioned above. The request history may include several requests, e.g., 10 requests, to display a login page. Similarly, the request history may include several attempts to log in to a protected section of a web service of the computer system.

[0022] In some embodiments, the computer system may generate a computer file in response to a request such that the computer file is comprised of data requested in response to the request. Thus, in some embodiments, transmitting the data along with the computer file to the external system may be performed by transmitting the file to the external system. Thus, the computer file may be considered a response file to the request.

[0023] The computer file may be a file readable by a processor of the external system. For example, the processor of the external system may read the data as part of the computer file to update a web page using a web browser. In one example, the computer file may be an HTML document. The HTML document may consist of data and instructions. The instructions may consist of commands in the scripting language "Java(R)Script". In one example, the instructions may serve to track and / or profile actions being performed in the external system. In one example, the instructions may form a set of instructions for obtaining information about a central processing unit and / or a graphics processing unit of the external system, and / or a browser setting of a web browser of the external system, or a combination thereof, or a set of instructions for reading data in a database of the external system, or a combination thereof. In the latter case, the information about the external system may include data in the database of the external system. As a result, the information about the external computer system may consist of information about a central processing unit and / or a graphics processing unit of the external system, and / or a browser setting of a web browser of the external system, and / or data in a database of the external system, or a combination thereof. The information about the central processing unit may indicate that the external system is a high performance computing machine consisting of multiple sets of racks of processors. This information may be used to identify the external system as a suspicious system. Additionally, information about the browser settings of the external system's web browser may indicate the use of suspicious web browser plug-ins. Information about the external computer system may also include a fingerprint of the external system. A fingerprint can be a set of characteristics used to identify the external system. The set of characteristics may include a user agent identification, cookies, IP address, and / or user time zone of the external system's browser.

[0024] The set of instructions may involve commands such as: "navigator.userAgent", "window.navigator.hardwareConcurrency", "navigator.buildID", "navigator.clipboard", "navigator.language", and "navigator.mediaDevices". Thus, information about the external system may be generated by execution of a set of instructions on a processor of the external system.

[0025] The set of instructions may include instructions for initiating the transmission of information about the external system from the external system to the computer system or proxy server, also referred to hereafter as "send back instructions". Such instructions may consist of commands such as: "XMLHttpRequest", "navigator.sendBeacon", "document.body.appendChild(myForm)", "myForm.submit()", "img.src", and "iframe.src".

[0026] In other words, the instructions can be designed such that execution of the set of instructions causes obtaining information about an external system and transmitting the information about the external system to the computer system or proxy server.

[0027] Storing information about external computer systems within a computer system can be done by storing this information in a database, for example an intruder database, which can contain profiles of previous external computer systems (hereinafter also referred to as previous external systems) that have performed attacks against the computer system in the past.

[0028] According to one example, storing the information about the external computer system in the computer system can be performed by training an artificial intelligence module (AI-Module) in response to the information about the external computer system. The training can include adapting parameter values ​​of the AI-Module to the information about the external computer system. According to this example, the information about the external computer system can be stored in the form of adapted values ​​of parameters of the AI-Module. In this case, the information about the external computer system can be provided by generating an output dataset of the AI-Module in response to an input dataset of the AI-Module and the adapted values ​​of parameters of the AI-Module.

[0029] One feature and advantage of some embodiments is that the information about the external system can be obtained by an action performed outside the computer system, i.e., on the external system. Such an action includes executing a set of instructions to obtain information about the external system. Typically, the instructions can be executed by a processor of the external system. This may reduce the risk of the computer system being attacked by the external system, as compared to obtaining information about the external system only based on a request sent from the external system to the computer system. Furthermore, sending data with the computer file may prevent the instructions from being detected as malware by the external system. This effect may be enhanced if the computer file contains the instructions.

[0030] Generating a computer file in response to classifying an external computer system as a potential threat may mean that if the external computer system is not classified as a potential threat, the computer file is not generated and sent to the external system. As a result, the amount of data traffic between the computer system and the further external systems, each not classified as a potential threat to the computer system, may generally be reduced by performing the classification. If no classification was performed, the computer file containing the instructions would typically be sent by default to the further external systems requesting information from the computer system in order to obtain information about the further external system. This would increase data traffic between the computer system and the further external system. In addition, the information about the further external system may not be relevant to protecting the computer system. The further external system may be a computer system of a known user of the computer system.

[0031] According to one embodiment, the method may further include developing and executing a means for protecting the computer system in response to the information about the external computer system, the means may include isolating the external system from the computer system in response to performing an analysis of the information about the external system. A controller node of the computer system may perform the analysis of the information about the external system. Performing the analysis may include performing a comparison of the information about the external computer system with information provided by an intruder database.

[0032] According to a further example, the trained AI module may be used to recognize future external computer systems as potential threats. Alternatively, or additionally, information about the future external computer systems may be compared to information provided by an intruder database to recognize future external computer systems as potential threats. In response to recognizing one of the future external computer systems as a potential threat, the computer system may isolate the future external computer system. This would be an example of a means for protecting the computer system relying on information about external computer systems.

[0033] According to one embodiment, the method may further include receiving a series of requests from the external system, the request being a most recent request in the series of requests. This embodiment may involve counting the number of requests in the series and initiating transmission of data with the computer file when the number of requests reaches a predetermined threshold. This may cause a delay between an initial request sent from the external system to the computer system and transmission of the computer file to the external system.

[0034] In some embodiments, the external system may perform an inspection of the initial response file. The initial response file may be sent from the computer system in response to the initial request. The initial request may be sent from the external system to the computer system and may be the first of a series of requests. The initial response file may not include any of the aforementioned instructions. As such, the external system may classify the computer system as non-aggressive and continue to send further requests to the computer system, including the aforementioned request. In response to receiving the further request, the computer system may send a further response file, including the aforementioned response file, i.e., computer file. In many applications, the external system may not check whether the computer system is non-aggressive, depending on the further response file. This may allow the execution of instructions to begin on the processor of the external system, without this execution being detected by the external system.

[0035] According to one embodiment, the computer system may comprise a data server providing the data. The connection may be established using a proxy server. According to this embodiment, the method may further include: - Using a proxy server to receive requests; - Using a proxy server to direct requests to a data server; - Transmitting data from the data server to the proxy server upon request; - Generating computer files using proxy servers; - Transmitting data along with computer files from a proxy server to an external computer system.

[0036] A proxy server can be designed in the form of a server application and can act as an intermediary between an external system and at least a part of a computer system, for example a data server or a decoy server. In one example, a computer system can include a proxy server. The proxy server performs an evaluation of the request and, depending on the result of the evaluation of the request, can direct the request to the data server or the decoy server. For example, if the proxy server evaluates the request as a completely unknown request, the proxy server can block the sending of the request to the data server or the decoy server. Thus, the proxy server can encapsulate at least a part of a computer system, for example a data server and / or a decoy server, from the external system. Furthermore, the proxy server can mask the origin of the data sent to the external system.

[0037] The generation of a computer file using a proxy server has the advantage that only the proxy server needs to be adapted to perform the generation of the computer file, in which case there may be no need to adapt the protected parts of the computer system.

[0038] According to one embodiment, the computer system may comprise a data service. According to this embodiment, preparing the data in response to the request may include mimicking the data service using a decoy module. In some embodiments, the data service may be designed to provide the data requested by the request. However, the request may include a request for sensitive data, e.g., data for a payroll system. The decoy module may be designed to generate the data such that the data may include a format for the sensitive data and may include false values ​​for the sensitive data. In this way, the risk of the data being detected as "fake data" by an external system may be reduced. The format may specify the number of rows and / or columns of a table, e.g., a payroll table.

[0039] In some embodiments, the data may be provided by a decoy module, and the method may further include establishing a connection using a proxy server, receiving the request using the proxy server, and transmitting both the data and the computer file from the proxy server to the external computer system as described above. According to one variation of this embodiment, the computer file may be generated using a proxy server. Furthermore, the proxy server may constitute the decoy module. Thus, only the proxy server needs to be adapted to generate the data in the form of "fake data". In one example, the proxy server may be configured with a format database. Furthermore, the proxy server may be designed to create the format database in response to a training set of past requests and a training set of past data files that constitute the data format. Each request in the training set of past requests may correspond to one of the data formats of the training set of past data files.

[0040] According to one embodiment, the method may further include providing a decoy server, the decoy server may include a decoy module. According to this embodiment, the method may further include directing requests from the proxy server to the decoy server and receiving data from the decoy server using the proxy server. The decoy server and / or the decoy module may be designed to include a security flaw. For example, the decoy server may include system software that has not been updated. The security flaw may cause the request to be designed to be directed to the decoy module and / or the decoy server. Doing so may prevent the request from being directed to a data server that may store sensitive data.

[0041] According to one embodiment, the method may further comprise performing a classification of the external computer system. The classification may be performed depending on the recorded data traffic between the external system and the computer system, for example depending on the requests and / or the history of requests. According to a variant of this embodiment, preparing the data may comprise generating the data depending on the result of the classification of the external computer system. According to a further variant of this embodiment, instructions may be generated depending on the result of the classification of the external computer system. Thus, the data and / or instructions may be considered as customized data and customized instructions, respectively, and the data and / or instructions are adapted for the external system. This may encourage the external system to maintain a connection to the computer system and thus increase the chance of receiving information about the external system. Classification of the external computer system may involve classifying the external system by its geography, by its request sending pattern, or by its request history.

[0042] According to one embodiment, the request may include initial information about the external system. According to this embodiment, the computer system may generate a computer file, e.g., data and / or instructions, in response to the initial information about the external system. Alternatively or additionally, the computer system may generate data and / or instructions in response to the recorded data traffic. The initial information about the external system and / or the recorded data traffic may include IP addresses and / or geolocation data sent from the external system. The request may include a header, which may include information about the user agent of the browser and / or additional information about the browser of the external system, e.g., acceptable languages, cookies and / or referrers.

[0043] Thus, in some embodiments, the data and / or instructions may be considered customized data and customized computer files, respectively, where the data and / or computer files are adapted for an external system based on the initial information, which may prompt the external system to maintain a connection with the computer system.

[0044] According to an embodiment, the classification of the external computer system as a potential threat can be implemented using a further artificial intelligence module (hereinafter also referred to as further AI module). Information on the traffic data recorded between the external system and the computer system can be sent in the form of an input signal to the further AI module. The further AI module can classify the external computer system as a potential threat depending on the information on the traffic data. The AI ​​module can include a neuronal network and / or a rule-based decision module.

[0045] According to one embodiment, the method may further include generating a report as a function of the information about the external computer system. The report may be sent to a security manager of the computer system.

[0046] The embodiments of the present disclosure may be implemented using a computing device, also referred to as a computer system, client, or server. Referring now to FIG. 1, a schematic diagram of an example of a computer system 10 is shown. The computer system 10 is merely one example of a suitable computer system and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments described herein. Nevertheless, the computer system 10 is capable of implementing and / or performing any of the functionality described herein above.

[0047] The computer system 10 may include a controller server in the form of a first computer system / server 12 as shown in FIG. 2, and a proxy server in the form of a second computer system / server 212 as shown in FIG.

[0048] The first computer system / server 12 and the second computer system / server 212 are each capable of operation with numerous other general purpose or special purpose computing system environments or configurations. Examples of computing systems, environments, or configurations suitable for use with the first computer system / server 12 and the second computer system / server 212 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed computing environments that include any of the above systems or devices.

[0049] The first computer system / server 12 and the second computer system / server 212 may be described in the general context of computer system executable instructions, such as program modules, executed by a computer system. Generally, program modules include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The first computer system / server 12 and the second computer system / server 212 may be practiced in a distributed computing environment where tasks may be performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0050] As shown in Figure 2, the first computer system / server 12 in the computer system 10 may be a general-purpose computing device. Components of the first computer system / server 12 include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 that couples various system components including the system memory 28 to the processing unit 16. The bus 18 may represent any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and without limitation, such architectures may include the following: Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0051] The first computer system / server 12 may include a variety of computer system readable media, which may be any available media that is accessible by the first computer system / server 12 and may include both volatile and nonvolatile media, removable and non-removable media.

[0052] The system memory 28 may include computer system readable media in the form of volatile memory such as random access memory (RAM) 30 and / or cache memory 32. The first computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, commonly referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from and writing to a removable, non-volatile optical disk (e.g., a CD-ROM, DVD-ROM or other optical medium). In such a case, some or all may be connected to the bus 18 by one or more data media interfaces. As further shown and described below, the memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of some embodiments.

[0053] A program / utility 40 having a set (at least one) of program modules 50 can be stored in memory 28, as well as, by way of example and not limitation, an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or combinations thereof, can include an implementation of a networking environment. The program modules 50 can perform the functions and / or methodologies of some embodiments described herein.

[0054] The first computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, one or more devices that allow a user to interact with the first computer system / server 12, or any device (e.g., network card, modem, etc.) that allows the first computer system / server 12 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur via an input / output (I / O) interface 22. Further still, the first computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, via a network adapter 20. As depicted, the network adapter 20 may communicate with other components of the first computer system / server 12 via a bus 18. Although not shown, it should be understood that other hardware and / or software components may also be used in combination with the first computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems.

[0055] As shown in Figure 3, the second computer system / server 212 in the computer system 10 may be a general-purpose computing device. Components of the second computer system / server 212 may include, but are not limited to, one or more processors or processing units 216, a system memory 228, and a bus 218 that couples various system components including the system memory 228 to the processing unit 216. The bus 218 may represent any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures may include the following: Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0056] The second computer system / server 212 may include a variety of computer system readable media, such as any available media that is accessible by the second computer system / server 212 and may include both volatile and nonvolatile media, removable and non-removable media.

[0057] The system memory 228 may include computer system readable media in the form of volatile memory such as random access memory (RAM) 230 and / or cache 232. The second computer system / server 212 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 234 may be provided for reading from and writing to a non-removable, non-volatile magnetic or solid state storage medium (e.g., a "hard drive," not shown). Not shown may be provided with a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium. In such a case, each may be connected to the bus 218 by one or more data media interfaces. As further illustrated and described below, the memory 228 may include at least one program product having a set (e.g., at least one) of program modules configured to perform functions of embodiments of the present disclosure.

[0058] A program / utility 240 having a set (at least one) of program modules 250 can be stored in memory 228, as well as, by way of example and not limitation, an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or combinations thereof, can include an implementation of a networking environment. The program modules 250 can generally perform the functions and / or methodologies of some embodiments described herein.

[0059] The second computer system / server 212 may also communicate with one or more external devices 214, such as a keyboard, pointing device, display 224, one or more devices that allow a user to interact with the second computer system / server 212, or any device (e.g., network card, modem, etc.) that allows the second computer system / server 212 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur via an input / output (I / O) interface 222. Furthermore, the second computer system / server 212 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, via a network adapter 220. As depicted, the network adapter 220 may communicate with other components of the second computer system / server 212 via a bus 218. Although not shown, it is to be understood that other hardware and / or software components may also be used in combination with the second computer system / server 212. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data archival storage systems, etc.

[0060] A computer system, such as computer system 10 shown in FIG. 1, may be configured to perform operations disclosed herein, such as receiving an HTTP-request 1 from an external computer system 2 via a connection between computer system 10 and the external computer system 2 (hereinafter also referred to as a first receiving operation), detecting the external computer system 2 as a potential threat to computer system 10 (hereinafter also referred to as a detection operation), generating a computer file 3 in response to request 1 (hereinafter also referred to as a file generating operation), providing data 4 in response to request 1 (hereinafter also referred to as data generating), transmitting the data 4 together with the computer file 3 to the external computer system 2 (hereinafter also referred to as a response operation), receiving information 6 about the external computer system 2 generated in response to instructions 5 in the computer file 3 (hereinafter also referred to as a second receiving operation), and storing the information 6 about the external computer system 2 in computer system 10 (hereinafter also referred to as a storing operation).

[0061] The instructions 5 , when executed by a processor 7 of the external computer system 2 , may be designed to obtain information 6 .

[0062] FIG. 4 illustrates an exemplary computing environment in which a computer system, such as computer system 10, is connected to a network 200, for example, using a network adapter 220. The network 200 can be a communication network, such as the Internet, a local area network (LAN), a wireless network, such as a mobile communication network, and the like, without limitation. The network 200 may include a computing network, such as a cloud computing network. The computer system 10 can be connected to an external computer system 2 through the network 200. The computer system 10 can receive data to be processed from the network 200, such as communication data and a request 1 for establishing a connection between the external computer system 2 and the computer system 10. Additionally, the computer system 10 can provide a computation result, such as a computer file 3, to another computing device, such as the external computer system 2, connected to the computer system 10 through the network 200.

[0063] Computer system 10 may perform the operations described herein, in whole or in part, in response to a request 1 received over network 200. In particular, computer system 10 may perform such operations in a distributed computation with one or more further computer systems connected to computer system 10 over network 200. To that end, computing system 10 and / or further participating computer systems may use network 200 to access further computing resources, such as dedicated or shared memory.

[0064] The proxy server 212 can perform the first receiving operation, the response operation and the second receiving operation by executing the first receiving program module 251, the response program module 252 and the second receiving program module 253 on the processing unit 216, respectively. The execution of the first receiving program module 251 on the processing unit 216 can cause the transmission of a first data package 101 including a request 1 in the form of an electronic signal from the network adapter 220 to the memory 228, for example to the cache 232. The external computer system 2 can transmit the request 1 in the form of the first data package 101 to the proxy server 212 via the network 200. The first data package 101 and / or the request 1 can include initial information regarding the external computer system 2, for example geolocation information and / or an IP address of the external computer system 2. Further, execution of the first receiving program module 251 on the processing unit 216 may cause transmission of the request 1 together with the initial information to the I / O interface 22 via the I / O interface 222. Thus, the proxy server may direct the request 1 together with the initial information to the controller server 12.

[0065] Similarly, executing the second receiving program module 253 on the processing unit 216 may cause a transmission of the third data package 103 including the information 6 in the form of a first further electronic signal from the network adapter 220 to the memory 228, for example to the cache 232, and a transmission of the information 6 via the I / O interface 222 to the I / O interface 22. Thus, the proxy server may direct the information 6 to the controller server 12. The processing unit 216 may check whether the first data package 103 and the third data package 103 may comply with the defined security rules stored in the memory 228.

[0066] Executing the response program module 253 on the processing unit 216 may cause the computer file 3 to be transmitted from the memory 228, for example from the cache 232, to the network 200 via the network adapter 220 using a second data package including the address of the external computer system 2 and the computer file 3.

[0067] The controller server 12 can perform detection operations, file generation operations, data generation operations and storage operations by executing a detection program module 51, a file generation program module 52, a data generation program module 53 and a storage program module 54, respectively, on the processing device 16.

[0068] Executing the detection program module 51 may cause the program module 51 to calculate an output value of the AI ​​module 61 in response to data of the request 1, including for example the initial information. In one example, executing the detection program module 51 comprises calculating an output value of the AI ​​module 61 in response to data of the past request and the request 1. In this case, the data of the past request and the request 1 may be used as input data of the AI ​​module 1. The past request may be sent from the external computer system 2 or a further external system to the proxy server 212. The output value of the AI ​​module 61 may indicate whether the external computer system 2 (hereinafter also referred to as the external system 2) is classified as a potential threat. For example, an output value of "1" may indicate that the AI ​​module evaluates the external system 2 as a potential threat. If the external system 2 is not evaluated as a potential threat, the output value of the AI ​​module 61 may be "0".

[0069] The detection program module 51 and / or the AI ​​module 61 may be designed to evaluate the external system 2 as a potential threat by detecting a common pattern between the past request and the request 1 and / or an overall pattern provided by the past request and the request 1. The common pattern may constitute the initial information. In this case, each of the past requests may constitute the initial information. In one example, the common pattern may be such that the past request and the request 1 contain similar data. The past request and the request 1 may each contain a phrase, for example a password phrase. The similar data may contain a similar set of characters. For example, the past request and the request 1 containing similar data may include a case where the phrase of the past request and the phrase of the request 1 differ from each other by one or two characters, respectively.

[0070] The overall pattern may be such that the past request and request 1 are received by proxy server 212 within a time interval having a size smaller than a given time threshold.

[0071] The AI ​​module 61 may be in a trained state. The AI ​​module 61 may have been trained by presenting it with a training data set of previous HTTP requests. The previous HTTP requests may be sent from a second, further external system that is known to pose a threat to the computer system 10.

[0072] The data in request 1 may consist of access data for logging into a secured database server 8 of computer system 10. In one example, database server 8 may provide a payroll database.

[0073] Executing the data generator module 53 may include generating the data 4 using a decoy module 63. The decoy module 63 may be configured to generate the data 4 in the form of modified confidential data of the protected database server 8. The decoy module 63 may generate the data 4 such that the data 4 does not include confidential information of the protected database server 8. The data 4 may, in one example, include unclassified public information.

[0074] In one example, decoy module 63 may generate data 4 by mimicking the functionality of database server 8. For example, decoy module 63 may generate data 4 such that data 4 includes information about the operating system of database server 8.

[0075] In one example, decoy module 63 may generate data 4 such that data 4 includes decoy information. The decoy information may be designed such that the information regarding the operating system of database server 8 indicates an out-of-date version of the operating system of database server 8.

[0076] The controller server 12 may connect to the database server 8 via the I / O interface 22 to read the sensitive data upon execution of the data generator module 53 .

[0077] 2 as a component of the controller server 12. In a not shown example, the decoy module 63 may be a component of a decoy server that is connected to the controller server 12 via the I / O interface 22. Execution of the data generator module 53, in this case, may include establishing a communications session between the controller server 12 and the decoy server.

[0078] Executing the file generator module 52 may include writing the data 4 and the instructions 5 to the computer file 3. The file generator module 52 may generate the instructions 5 depending on the initial information, the data of the request 1, or the result of the classification of the external system 2, or a combination thereof. The classification module 62 of the file generator module 52 may perform the classification of the external system 2 depending on the initial information, or depending on the data of the request 1, or depending on both. For example, the instructions 5 may be adapted to a type of operation system of the external system 2. The file generator module 52 may determine a type of operation system of the external system 2 depending on a result of the classification of the external system 2.

[0079] The instructions 5 may include a tracking script, a profiling script, or a script for accessing a database of the external system 2, or a combination thereof. The tracking script may record information about actions performed on the external system 2, such as processing of the data 4 in the external system 2. Processing of the data 4 may include copying the data 4 once or several times, analyzing the data 4 using a data analysis tool, and storing the data 4 in a persistent storage device of the external system 2. Executing the profiling script on the external system 2 may include classifying the actions performed on the external system 2. In one example, executing the profiling script may include collecting information about the operation system of the external system 2. Transmitting the profiling script together with the computer file 3 may have the advantage that the profiling of the external system 2 is performed by a processor of the external system 2. This may reduce the computational work of the computer system 10. The script for accessing a database of the external system 2 may consist of instructions for reading data of the database of the external system 2. The instructions 5 may be in the form of HTML and / or Java(R)Script languages.

[0080] In one example, the instructions 5 may include a message generation script. The message generation script may create a message including the information 6. The information 6 may include information obtained by executing a tracking script, a profiling script, or a script for accessing a database of the external system 2, or a combination thereof, on a processor of the external system 2. The message generation script may generate the message as part of a third data package 103. The third data package 103 may include a further HTTP request generated by the external system 2. The external system 2 may generate the further HTTP request in response to reading the decoy information.

[0081] The file generator module 52 is shown in FIG. 2 as a component of the controller server 12. In an example not shown in the figure, the file generator module 52 may be a component of a proxy server 212, which may be connected to the database server 8 via an I / O interface 222. Executing the file generator module 52 may in this case include establishing a communication session between the proxy server 212 and the database server 8. According to this example, the proxy server 212 may generate a computer file 3.

[0082] The controller server 12, e.g., the processing device 16, may perform an analysis of the information 6 regarding the external system 2 in response to receiving the information 6 from the proxy server 212. Performing the analysis of the information 6 may include comparing the information 6 with information in an intruder database 35. The intruder database 35 may store various intruder profiles. Since the information 6 may include more data than the initial information, the information 6 may match one of the intruder profiles stored in the intruder database 35. In this case, the processing device 16 may initiate a protection measure for protecting the computer system 10. The processing device 16 may select a protection measure from a set of protection measures depending on the intruder profile that matches the information 6.

[0083] The processing device 16 may select the protection measure depending on a part of the information 6, for example the type of browser plug-in of the web browser used by the external system 2 and / or the IP address of the external system 2.

[0084] In one example, the processing device 16 may generate an additional intruder profile in response to the information 6. If the information 6 does not match any intruder profile in the intruder database 35, an additional intruder profile may be created.

[0085] In one example, the intruder database 35 may be further AI modules trained based on the intruder profiles. Each of the intruder profiles may include data having a structure similar to that of the information 6. The structure of the information 6 may consist of different headers and different text bodies, each corresponding to one of the headers. If the information 6 does not match any of the intruder profiles, the processing device 16 may update the intruder database 35 and, for example, use the information 6 or the further intruder profiles to train further AI modules. Updating the intruder database 35 in response to the information 6 may be performed by executing a stored program module 54 on the processor 16.

[0086] FIG. 5 shows a flow chart of a computer-implemented method for obtaining information 6.

[0087] At operation 1001, the proxy server 212 may receive a request 1 from an external system 2, for example in the form of a first data package 101 as described above.

[0088] In operation 1002, the controller server 12 may classify the external computer system 2 as a potential threat to the computer system 10, for example, by executing the detection program module 51 described above.

[0089] In operation 1003, the controller server 12 or the proxy server 212 may generate a computer file 3, for example, by executing the file generator module 52 described above.

[0090] In operation 1004, data 4 may be prepared, for example, by executing data generation program module 53 as described above.

[0091] In operation 1005 , the proxy server 212 may transmit the data 4 along with the computer file 3 to the external system 2 .

[0092] At operation 1006, the proxy server 212 may receive information 6 about the external computer system 2 generated in response to instructions 5 in the computer file 6. A processor of the external system 2 may execute instructions 5 while executing a web browser of the external system 2.

[0093] In operation 1007, the controller server 12 can store information 6 regarding the external computer system 2 within the computer system 10 to provide information 6 for developing protection measures to protect the computer system 10 against the external system 2 or a third further external system.

[0094] The operation numbers 1001, 1002, 1003, 1004, 1005, 1006, and 1007 do not dictate the order in which these operations are performed. For example, in some embodiments, data 4 may be prepared before computer file 3 is generated.

[0095] Various embodiments are defined in the following numbered claims:

[0096] 1. A computer-implemented method for obtaining information about an external computer system having a connection to a computer system, the method comprising: receiving a request from the external computer system over the connection; classifying the external computer system as a potential threat to the computer system; generating a computer file responsive to the request in response to classifying the external computer system as the potential threat, the computer file including instructions that, when executed on a processor of the external computer system, are designed to obtain the information about the external computer system; preparing data responsive to said request; transmitting said data together with said computer file to said external computer system; receiving the information regarding the external computer system generated in response to the instructions in the computer file; storing said information about said external computer system within said computer system to provide said information about said external computer system for development of measures to protect said computer system; 4. A computer-implemented method comprising:

[0097] 2. The computer system includes a data server providing the data, the connection is established by a proxy server, and the method further comprises: receiving the request by the proxy server; directing the request by the proxy server to the data server; transmitting the data from the data server to the proxy server in response to the request; generating said computer file by said proxy server; transmitting the data along with the computer file from the proxy server to the external computer system; The method of claim 1, further comprising:

[0098] 3. The method of claim 1 or 2, wherein the computer system includes a data service, and wherein providing the data in response to the request includes mimicking the data service with a decoy module.

[0099] 4. The method comprising: establishing said connection by a proxy server; receiving the request by the proxy server; transmitting both said data and said computer file from said proxy server to said external computer system; 4. The method of claim 3, further comprising:

[0100] 5. The method of claim 4, wherein the computer file is generated by the proxy server.

[0101] 6. A method according to any one of claims 2 to 5, wherein the method further includes providing a decoy server, the decoy server including a decoy module, and the method further includes directing the request from a proxy server to the decoy server, and receiving the data from the decoy server by the proxy server.

[0102] 7. The method of any of claims 1 to 6, wherein the method further comprises receiving a series of requests from the external system, the request being a most recent request in the series of requests.

[0103] 8. A method according to any preceding claim, wherein the request includes initial information about the external computer system, and the computer file is generated in response to the initial information about the external computer system.

[0104] 9. A method according to any one of claims 1 to 8, wherein the method further comprises performing a classification of the external computer system, and wherein preparing the data comprises generating the data in response to a result of the classification of the external computer system.

[0105] 10. A method according to any preceding claim, further comprising performing a classification of the external computer system, and wherein the instructions are generated in response to a result of the classification of the external computer system.

[0106] 11. The method of any of claims 1 to 10, wherein the classifying of the external computer system as the potential threat is performed by an artificial intelligence module (AI module).

[0107] 12. The method of claim 11, wherein the AI ​​module comprises a neuronal network.

[0108] 13. The method of claim 11, wherein the AI ​​module comprises a rule-based decision module.

[0109] 14. A method according to any preceding claim, wherein the information about the external computer system includes information about browser settings of the external computer system.

[0110] 15. A method according to any preceding claim, wherein the information relating to the external computer system includes information relating to a central processing unit of the external computer system.

[0111] 16. A method according to any preceding claim, wherein the information relating to the external computer system includes information relating to a graphics processing unit of the external computer system.

[0112] 17. A method according to any preceding claim, wherein the information relating to the external computer system comprises data in a database of the external computer system.

[0113] 18. The method of any preceding claim, further comprising developing and implementing measures for protecting the computer system in response to the information about the external computer system.

[0114] 19. A computer program product for obtaining information regarding an external computer system having a connection to a computer system, the computer program product including one or more computer readable storage media and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising: program instructions for receiving a request from the external computer system over the connection; in response to the request, program instructions for classifying the external computer system as a potential threat to the computer system; program instructions for generating, in response to classifying the external computer system as the potential threat, a computer file responsive to the request, the computer file including instructions that, when executed on a processor of the external computer system, are designed to obtain information about the external computer system; program instructions for preparing data responsive to said request; program instructions for transmitting said data together with said computer file to said external computer system; program instructions for receiving the information about the external computer system generated in response to the instructions in the computer file; and program instructions for storing said information about said external computer system in a database to provide said information about said external computer system for development of measures to protect said computer system. Computer program products.

[0115] 20. A computer system for obtaining information about an external computer system having a connection to the computer system, the computer system comprising: receiving a request from the external computer system via the connection; In response to said request, classifying said external computer system as a potential threat to said computer system; generating a computer file responsive to said request in response to classifying said external computer system as said potential threat, said computer file including instructions that, when executed on a processor of said external computer system, are designed to obtain said information regarding said external computer system; preparing data responsive to said request; transmitting said data together with said computer file to said external computer system; receiving the information regarding the external computer system generated in response to the instructions in the computer file; storing information about said external computer system in a database for providing said information about said external computer system for development of measures to protect said computer system; A computer system configured to:

[0116] Embodiments of the present disclosure may be a system, a method, and / or a computer program product, which may include one or more computer-readable storage media having computer-readable program instructions thereon for causing a processor to perform aspects of the present disclosure.

[0117] A computer readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer readable storage media includes: portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or grooved structures on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal itself, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over electrical wires.

[0118] The computer readable program instructions described herein may be downloaded from a computer readable storage medium to an individual computing / processing device or to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface of each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the individual computing / processing device.

[0119] The computer readable program instructions for performing some operations in some embodiments may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or object-oriented programming languages ​​such as Smalltalk®, C++, and traditional procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may be executed entirely on the user's computer, partly on the user's computer as a standalone software package, partly on the user's computer and partly on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), can execute computer readable program instructions to individualize the electronic circuitry by utilizing state information of the computer readable program instructions to perform aspects of some embodiments.

[0120] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to certain embodiments. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0121] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to make a machine, such that instructions executable by the processor of the computer or other programmable data processing apparatus implement the functions / acts / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored in a computer readable storage medium having instructions stored thereon to instruct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer readable storage medium having the instructions stored thereon comprises an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0122] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a sequence of operations to create a computer-implemented process such that the instructions, which execute on the computer, other programmable apparatus, or other device, implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0123] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the drawings. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, are implemented by a special-purpose hardware-based system that performs the specified functions or actions or executes a combination of special-purpose hardware and computer instructions.

[0124] The presently described embodiments are therefore to be considered in all respects as illustrative and not restrictive and reference should be made to the appended claims in order to determine the scope of the invention.

Claims

1. 1. A method of obtaining information about an external computer system having a connection to a computer system, the method comprising: receiving a request from the external computer system over the connection; classifying the external computer system as a potential threat to the computer system; generating, in response to classifying the external computer system as the potential threat, a computer file responsive to the request, the computer file including instructions that, when executed on a processor of the external computer system, are designed to obtain the information about the external computer system; preparing data responsive to said request; transmitting said data together with said computer file to said external computer system; receiving the information regarding the external computer system generated in response to the instructions in the computer file; storing said information about said external computer system within said computer system to provide said information about said external computer system for development of measures to protect said computer system; A method comprising:

2. The computer system includes a data server providing the data, the connection being established by a proxy server, and the method further comprising: receiving the request by the proxy server; directing the request to the data server by the proxy server; transmitting the data from the data server to the proxy server in response to the request; generating said computer file by said proxy server; transmitting said data along with said computer file from said proxy server to said external computer system; The method of claim 1 further comprising:

3. 2. The method of claim 1, wherein the computer system includes a data service, and wherein providing the data in response to the request includes mimicking the data service with a decoy module.

4. The method further comprising: establishing said connection through a proxy server; receiving the request by the proxy server; transmitting both said data and said computer file from said proxy server to said external computer system; The method of claim 3 further comprising:

5. The method of claim 4 , wherein the computer file is generated by the proxy server.

6. 4. The method of claim 3, wherein the method further includes providing a decoy server, the decoy server including the decoy module, the method further includes directing the request from a proxy server to the decoy server, and receiving the data from the decoy server by the proxy server.

7. 2. The method of claim 1, further comprising receiving a series of requests from the external computer system, the request being a most recent request in the series of requests.

8. 2. The method of claim 1, wherein the request includes initial information about the external computer system, and the computer file is generated in response to the initial information about the external computer system.

9. 2. The method of claim 1, wherein the method further comprises performing a classification of the external computer system, and wherein the providing of the data comprises generating the data in response to a result of the classification of the external computer system.

10. 2. The method of claim 1, further comprising: performing a classification of the external computer system, the instructions being generated in response to a result of the classification of the external computer system.

11. The method of claim 1 , wherein the classifying the external computer system as the potential threat is performed by an artificial intelligence module (AI module).

12. The method of claim 11 , wherein the AI ​​module comprises a neuronal network.

13. The method of claim 11 , wherein the AI ​​module comprises a rule-based decision module.

14. The method of claim 1 , wherein the information about the external computer system includes information about browser settings of the external computer system.

15. 2. The method of claim 1, wherein said information regarding said external computer system includes information regarding a central processor of said external computer system.

16. 2. The method of claim 1, wherein the information about the external computer system includes information about a graphics processing unit of the external computer system.

17. 2. The method of claim 1, wherein the information about the external computer system comprises data in a database of the external computer system.

18. 2. The method of claim 1, further comprising developing and implementing measures for protecting said computer system in response to said information regarding said external computer system.

19. A computer program causing a computer to execute a method according to any one of claims 1 to 18.

20. A computer system that executes the method according to any one of claims 1 to 18 by computer hardware.

Images