US 10,476,891 B2Granted

Monitoring access of network darkspace

AssigneeAttivo Networks Inc.

InventorsVenu Vissamsetty, Srikant Vissamsetti, Shivakumar Buruganahalli

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system includes one or more “BotMagnet” modules that are exposed to infection by malicious code. The BotMagnets may include one or more virtual machines hosing operating systems in which malicious code may be installed and executed without exposing sensitive data or other parts of a network. In particular, outbound traffic may be transmitted to a Sinkhole module that implements a service requested by the outbound traffic and transmits responses to the malicious code executing within the BotMagnet. Dark space in a network (unused IP addresses, unused ports and absent applications, and invalid usernames and passwords) is consumed by a BotSink such that attempts to access Darkspace resources will be directed to the BotSink, which will engage the source host of such attempts.

Claims7

Dependent claims

A method for detecting unauthorized access of a network environment, the method comprising:

monitoring, by a security computer system, access of authentically allocated network resources;
detecting, by the security computer system, one or more access requests referencing one or more dark space resources, the one or more dark space resources being network resources that have not been allocated authentically within the network environment;
in response to detecting the one or more access requests—
allocating, by the security computer system, to a decoy system the one or more dark space resources;
routing, by the security computer system, at least one of the one or more access requests and a subsequent request referencing the one or more dark space resources to the decoy system;
monitoring, by the security computer system, actions taken on the decoy system responsive to the at least one of the one or more access requests and the subsequent request;
determining, by the security computer system, that the actions taken on the decoy system indicate malicious activity;
and
in response to determining that the actions taken on the decoy system indicate malicious activity, instructing one or more computer systems of the network environment to block access by a source of the one or more access requests;
executing, by a first server system, a first instance of a first application;
transmitting, by the first instance of the first application, an error message to an application event logger of a security information and event management (SIEM) server, the error message indicating an unsuccessful attempt to access the first instance using a first username and identifying a source of the unsuccessful attempt;
wherein monitoring, by the security computer system, access of authentically allocated network resources comprises receiving application event logs from the SIEM server;
wherein detecting the one or more access requests referencing the one or more dark space resources comprises determining that the application event logs include the error message;
wherein the method further comprises, in response to determining that the application event logs include the error message:
creating a second instance of the first application on the decoy system;
creating, on the decoy system, a user account for the first username for the second instance;
and
modifying network address translation (NAT) rules to route traffic from the source of the unsuccessful attempt to the decoy system;
allowing, on the decoy system, access to the second instance using the user account in response to one or more subsequent requests including the first username.

16 more elements

A system for detecting unauthorized access, the system comprising:

a network environment including one or more computer systems and one or more internal networks coupling the one or more deployed computer systems to an external network;
a security computer system comprising one or more processors and one or more memory devices, the one or more memory devices storing executable and operational code to cause the one or more processors to—
monitor access of authentically allocated network resources within the one or more internal networks;
in response to one or more access requests referencing one or more dark space resources are detected, the one or more dark space resources being network resources of the internal network and the one or more deployed computer systems that have not been allocated authentically:
allocate the one or more dark space resources to the security computer system;
invoke routing of at least one of the one or more access requests and a subsequent request referencing the one or more dark space resources to the security computer system;
monitor actions taken on the security computer system responsive to the at least one of the one or more access requests and the subsequent request;
determine that the actions taken on the decoy system indicate, malicious activity;
in response to determining that the actions taken on the decoy system indicate malicious activity, instruct the one or more deployed computer systems of the network environment to block access by a source of the one or more access requests;
a security information and event management (SIEM) server programmed to receive application event logs from applications executing in the internal network;
wherein the executable and operational code are further to cause the one or more processors to monitor access of authentically allocated network resources by:
receiving an application event log from the SIEM server, the application event log including an error message received by the SEM server from a first instance of a first application executing on a first computer other than the security computer system, the error message indicating an unsuccessful attempt to access the first instance using a first username and indicating a source of the unsuccessful attempt;
wherein the executable and operational code are further to cause the one or more processors to, detecting the error message in the application event log, determine that the one or more access requests reference the one or more dark space resources;
wherein the executable and operational code are further to cause the one or more processors to, when the application log includes the error message:
(a) instantiate a second instance of the first application on the security computer system;
(b) create a user account having the first username for the second instance of the first application;
and
(c) grant access to the second instance of the application using the first username in response to a subsequent access requests including the username following the unsuccessful attempt.

15 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/805,202Filed 21 Jul 2015
Published: US 2017/0026387 A126 Jan 2017
Granted: 12 Nov 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 63/1458
Countermeasures against malicious traffic: denial of Service
H04L 63/1466
Countermeasures against malicious traffic: active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g.…