Adaptive response generation on an endpoint

Abstract

An endpoint configured for adaptively generating responses to data queries, comprising program store for storing code, and one or more processors of an endpoint coupled to the program store for executing the code which comprises: (1) Code instructions for detecting a data query from a requester with respect to one or more information resources of the endpoint. (2) Code instructions for adaptively generating a response to the data query. The adaptively generated response comprises data indicative of one or more fictive information resources which are of a similar type as the information resource(s). The response is adaptively generated according to an analysis of data extracted from the data query, the information resource(s), previous interaction of the requester with the endpoint and/or identified information resource operation(s) at the endpoint which precede the detection of the data query. (3) Code instructions for providing the adaptively generated response to the requester.

What is claimed is: 
     
         1 . An endpoint configured for adaptively generating responses to data queries, comprising:
 a program store for storing a code; and   at least one hardware processor of an endpoint coupled to said program store for executing said code, said code comprising:   code instructions for detecting a data query from a requester with respect to at least one of a plurality of information resources of said endpoint;   code instructions for adaptively generating a response to said data query, said adaptively generated response comprises data indicative of at least one fictive information resource which is of a similar type as said at least one information resource, said response is adaptively generated according to an analysis of data extracted from at least one of: said data query, said at least one information resource, a previous interaction of said requester with said endpoint, and at least one identified information resource operation at said endpoint which precedes said detection of said data query; and   code instructions for providing said adaptively generated response to said requester.   
     
     
         2 . The endpoint of  claim 1 , wherein said endpoint is a member selected from a group consisting of: a physical device and a virtual device, said virtual device is executed on at least one said physical device. 
     
     
         3 . The endpoint of  claim 1 , wherein said requester is at least one of: a user, a process, a machine and an automated tool. 
     
     
         4 . The endpoint of  claim 1 , wherein said at least one information resource is a member selected from a group consisting of:
 a local information resource which is locally available at said endpoint, and   a network information resource which is accessible from said endpoint over at least one network through at least one network interface of said endpoint.   
     
     
         5 . The endpoint of  claim 1 , wherein said code further comprising code instructions for invoking at least one responsive operation based on said analysis of said extracted data, said at least one responsive operation implemented to mitigate an activity associated with said requester at the endpoint. 
     
     
         6 . The endpoint of  claim 5 , wherein said at least one responsive operation includes at least one of: controlling said activity of said requester, disrupting said activity of said requester, monitoring said activity of said requester, and issuing a warning message indicating of said activity of said requester. 
     
     
         7 . The endpoint of  claim 1 , wherein said data query includes an information request regarding a member selected from a group consisting of: existence of said at least one information resource and availability of said at least one information resource. 
     
     
         8 . The endpoint of  claim 1 , wherein said data query includes an access request to access said at least one information resource. 
     
     
         9 . The endpoint of  claim 1 , wherein said data query includes an operation request to said at least one information resource. 
     
     
         10 . The endpoint of  claim 1 , further comprising said adaptively generated response comprises data indicative of at least one emulated operation of said at least one fictive information resource. 
     
     
         11 . The endpoint of  claim 1 , wherein said code further comprising code instructions for intercepting an actual response provided by said at least one information resource in response to said data query and replacing said actual response with said adaptively generated response. 
     
     
         12 . The endpoint of  claim 1 , wherein said code further comprising code instructions for interactively responding to said requester by adaptively generating at least one additional adaptively generated response to at least one additional data query issued by said requester. 
     
     
         13 . The endpoint of  claim 1 , wherein said code further comprising code instructions for identifying an activity pattern of said requester by analyzing said data query and at least one additional data query issued by said requester. 
     
     
         14 . The endpoint of  claim 13 , further wherein said code further comprising code instructions for:
 analyzing said activity pattern of said requester;   classifying said activity pattern according to said analysis; and   generating, based on said classifying, an assessment of whether said activity pattern is indicative of a potential malicious activity.   
     
     
         15 . The endpoint of  claim 13 , wherein said code further comprising code instructions for applying a learning process on said activity pattern to improve future adaptive generation of at least one future adaptively generated response to at least one future data query. 
     
     
         16 . The endpoint of  claim 1 , wherein said code further comprising code instructions for directing at least one network access indicated by said data query to a designated entity which is in communication with said endpoint over at least one network. 
     
     
         17 . A computer implemented method of adaptively generating responses on an endpoint, comprising:
 using at least one hardware processor at an endpoint for executing a code for:   detecting a data query from a requester with respect to at least one of a plurality of information resources of said endpoint;   adaptively generating a response to said data query, said adaptively generated response comprises data indicative of at least one fictive information resource which is of a similar type as said at least one information resource, said response is adaptively generated according to an analysis of data extracted from at least one of: said data query, said at least one information resource, a previous interaction of said requester with said endpoint and at least one identified information resource operation at said endpoint which precedes said detection of said data query; and   providing said adaptively generated response to said requester.   
     
     
         18 . A computer program product for adaptively generating responses on an endpoint, comprising:
 a non-transitory computer readable storage medium;   first program instructions to detect a data query from a requester with respect to at least one of a plurality of information resources of said endpoint;   second program instructions to adaptively generate a response to said data query, said adaptively generated response comprises data indicative of at least one fictive information resource which is of a similar type as said at least one information resource, said response is adaptively generated according to an analysis of data extracted from at least one of: said data query, said at least one information resource, a previous interaction of said requester with said endpoint and at least one identified information resource operation at said endpoint which precedes said detection of said data query; and   third program instructions to provide said adaptively generated response to said requester;   wherein said first, second and third program instructions are executed by at least one processor of said endpoint from said non-transitory computer readable storage medium.