Increasing security of network resources utilizing virtual honeypots

A computer-readable storage medium having computer-executable instructions stored thereon which, when executed by one or more processing units of a computing device, cause the one or more processing units to:

• access security configuration data for each of a plurality of network resources, wherein the security configuration data includes at least one of a setup of a firewall, a strength of a user password, or a number of users of a corresponding network resource;
• generate an initial vulnerability score for each of the plurality of network resources based solely on the security configuration data of a corresponding network resource, wherein the initial vulnerability score for each of the plurality of network resources is below a threshold vulnerability score established to identify a virtual honeypot;
• collect activity data from the plurality of network resources during a first period of time;
• train a vulnerability model based on the initial vulnerability scores and the activity data collected from the plurality of network resources during the first period of time;
• collect new activity data for the plurality of network resources during a second period of time that occurs after the first period of time;
• generate a predicted vulnerability score for each of the plurality of network resources by applying the new activity data to the vulnerability model;
• identify a vulnerable network resource, from the plurality of network resources, that has a predicted vulnerability score that exceeds the threshold vulnerability score established to identify the virtual honeypot;
• and
• analyze an activity pattern that is unique to the vulnerable network resource to determine that the activity pattern is associated with an attack pattern used by a malicious entity.

A computer-implemented method for detecting network attacks and vulnerable network resources, the method comprising:

• accessing security configuration data of a plurality of network resources, wherein the security configuration data includes at least one of a setup of a firewall, a strength of a user password, or a number of users of a corresponding network resource;
• generating an initial vulnerability score for each of the plurality of network resources based solely upon the security configuration data of a corresponding network resource, wherein the initial vulnerability score for each of the plurality of network resources is below a threshold vulnerability score established to identify a virtual honeypot;
• accessing activity data from the plurality of network resources during a first period of time;
• building a vulnerability model based on the initial vulnerability scores and the activity data of the network resources;
• obtaining new activity data for the plurality of network resources during a second period of time that occurs after the first period of time;
• generating, using the vulnerability model, a predicted vulnerability score for each of the plurality of network resources based on the new activity data;
• identifying at least one vulnerable network resource, from the plurality of network resources, that has a predicted vulnerability score that exceeds the threshold vulnerability score established to identify the virtual honeypot;
• and
• analyzing an activity pattern that is unique to the at least one vulnerable network resource to determine that the activity pattern is associated with an attack pattern used by a malicious entity.