An information security system that includes an information security engine configured to detect an attack by a malicious software element in a network. The information security engine is further configured to transfer the malicious software element from the network to the emulated network in response to detecting an attack. The information security engine is further configured to select defense strategies for restricting communications using different port configurations and to implement each defense strategy within the emulated network. The information security engine is further configured to execute a duplicate of the malicious software element in the emulated network and to determine a performance level for each of the defense strategies against the duplicate of the malicious software element. The information security engine is further configured to select a defense strategy with a highest performance level and to implement the selected defense strategy within the network.