Abstract: Systems and methods are described for inception of suspicious network traffic to allow detection of the beginning of common attacks by network security devices, such as NGFWs, UTM appliances and IPS appliances. According to one embodiment, inception engine running on network security appliance protecting a private network monitors a session between an external computing device and a server device associated with the private network. In response to receipt of suspicious traffic from external computing device indicative of an attack sequence, the inception engine blocks the suspicious traffic from reaching the server device and incepts the attack sequence by providing one or more responses to the external computing device, which are selected based on the attack sequence. Further, when the attack is confirmed, the inception engine diverts the traffic to a more capable deception device.

Abstract: Systems and methods are described for inception of suspicious network traffic to allow detection of the beginning of common attacks by network security devices, such as NGFWs, UTM appliances and IPS appliances. According to one embodiment, inception engine running on network security appliance protecting a private network monitors a session between an external computing device and a server device associated with the private network. In response to receipt of suspicious traffic from external computing device indicative of an attack sequence, the inception engine blocks the suspicious traffic from reaching the server device and incepts the attack sequence by providing one or more responses to the external computing device, which are selected based on the attack sequence. Further, when the attack is confirmed, the inception engine diverts the traffic to a more capable deception device.