US 10,873,601 B1Granted

Decoy network-based service for deceiving attackers

AssigneeAmazon Technologies, Inc.

InventorThomas C. Stickle

Life of this patent

Estimating the term…

Loading patent…

Abstract

A decoy network-based service uses a decoy credential to lure an attacker to access the decoy network-based service, and monitors the attacker's activity with respect to the decoy network-based service to determine the attacker's motivation. In various examples, a decoy credential is published on an Internet-accessible site, and a system that provides a network-based service (e.g., a service provider network) subsequently receives an access request from a computing device that includes the decoy credential. Based on the decoy credential, the computing device may be provided access to a decoy network-based service, and application programming interface (API) calls made by the computing device may be routed through a decoy control plane. The data relating to the API calls may be stored and analyzed to determine a motivation of the attacker, which may be used in various downstream applications to improve security for customers of the network-based service.

Claims18

Dependent claims

A system to provide attackers access to a decoy network-based service, the system comprising:

one or more hardware processors;
and
memory storing computer-executable instructions which, when executed by the one or more hardware processors, cause the system to:
embed a plurality of decoy credentials within content available on multiple different publicly-accessible source code repositories;
receive, from a computing device, a request to access a network-based service, the request including a credential;
determine that the credential included in the request is a decoy credential of the plurality of decoy credentials based at least in part on a decoy credential signature included in metadata of the credential;
provide, to the computing device, access to the decoy network-based service based at least in part on determining that the credential included in the request is the decoy credential;
route application programming interface (API) calls made by the computing device through a decoy control plane;
return, to the computing device via a decoy data plane, decoy data or decoy resources that mimic data or resources that would be returned by the network-based service;
store sequence data relating to a sequence of the API calls made by the computing device;
and
analyze the sequence data to determine a motivation of an attacker associated with the computing device, the motivation including at least one of data exfiltration, fraud, spying, or ransom.

9 more elements

A computer-implemented method to provide attackers access to a decoy network-based service, the method comprising:

embedding a plurality of decoy credentials within content available on multiple different publicly-accessible source code repositories;
receiving, by a system that provides a network-based service, a request from a computing device, the request including a credential;
determining that the credential included in the request is a decoy credential of the plurality of decoy credentials based at least in part on a decoy credential signature included in metadata of the credential;
providing, to the computing device, access to the decoy network-based service based at least in part on the determining that the credential included in the request is the decoy credential;
routing one or more application programming interface (API) calls made by the computing device through a decoy control plane;
storing sequence data associated with a sequence of the one or more API calls made by the computing device;
and
analyzing the sequence data to determine a motivation of an entity associated with the computing device.

5 more elements

A system for providing access to a decoy network-based service, the system comprising:

one or more hardware processors;
and
memory storing computer-executable instructions which, when executed by the one or more hardware processors, cause the system to:
embed a plurality of decoy credentials within content available on multiple different publicly-accessible source code repositories;
receive a request from a computing device to access a network-based service, the request including a credential;
determine that the credential included in the request is a decoy credential of the plurality of decoy credentials based at least in part on a decoy credential signature included in metadata of the credential;
provide, to the computing device, access to the decoy network-based service based at least in part on determining that the credential included in the request is the decoy credential;
receive, via a decoy control plane, one or more application programming interface (API) calls made by the computing device;
store sequence data associated with a sequence of the one or more API calls made by the computing device;
and
analyze the sequence data to determine a motivation of an entity associated with the computing device.

8 more elements

Dependencies are inferred from the claim text.