Honeypot network services

A method for detecting a malicious device on a network, the method comprising:

• detecting network requests from a first device within an enterprise network to other network devices connected wirelessly to a wireless access point of the enterprise network;
• detecting traffic from the first device to an unassigned network address within the enterprise network;
• in response to detecting the network requests from the first device to other network devices connected wirelessly to the wireless access point and detecting the traffic from the first device to the unassigned network address, presenting a honeypot network service to the first device within the enterprise network by redirecting the traffic directed to the unassigned network address to the honeypot network service, the honeypot network service configured as a wireless device;
• monitoring communication between the first device and the honeypot network service;
• and
• determining that the first device is malicious based on the monitored communication.

A system for detecting a compromised device, the system comprising:

• a processor;
• and
• a memory comprising instructions executable by the processor, the instructions when executed causing the processor to perform steps, comprising
• detect network requests from a first device within an enterprise network to other network devices connected to a wireless access point of the enterprise network,
• detect traffic from the first device to an unassigned network address within the enterprise network,
• in response to detecting the network requests from the first device to other network devices connected wirelessly to the wireless access point and detecting the traffic from the first device to the unassigned network address, presenting a honeypot network service to the first device within the enterprise network by redirecting the traffic directed to the unassigned network address to the honeypot network service, the honeypot network service configured as a wireless device,
• monitoring communication between the first device and the honeypot network service, and
• determining that the first device is compromised based on the monitored communication.