Abstract: A computer network of an organization has network assets and honeypots. Probes are deployed on the computer network to collect telemetry data of the network assets. Asset profiles of the network assets are extracted from the telemetry data to obtain organization-specific data. A prompt is generated, with the prompt including an instruction to generate a honeypot configuration based on the organization-specific data. The prompt is input to a generative artificial intelligence (AI) model, such as a large language model (LLM). A honeypot is configured in accordance with the honeypot configuration that is output by the generative AI model responsive to the prompt.

Abstract: An agent on an endpoint computer computes a locality-sensitive hash value for an API call sequence of an executing process. This value is sent to a cloud computer which includes an API call sequence blacklist database of locality-sensitive hash values. A search is performed using a balanced tree structure of the database using the received hash value and a match is determined based upon whether or not a metric distance is under or above a distance threshold. The received value may also be compared to a white list of locality-sensitive hash values. Attribute values of the executing process are also received from the endpoint computer and may be used to inform whether or not the executing process is deemed to be malicious. An indication of malicious or not is returned to the endpoint computer and if malicious, the process may be terminated and its subject file deleted.