Honeytoken tracker
AssigneeRapid7, Inc.
InventorThomas Eugene Sellers
Life of this patent
Estimating the term…
Abstract
Disclosed herein are methods, systems, and processes for tracking honeytokens. A malicious attack from an attacker is received at a honeypot and a determination is made that an attack event associated with the malicious attack has compromised deceptive credential information maintained by the honeypot. A unique credential pair that corresponds to the deceptive credential information sought by the attack event is generated and a honeytoken tracker state table is modified to include the unique credential pair and attack event metadata in association with the attack event. The unique credential pair is then transmitted to the attacker.
Claims20
A computer-implemented method, comprising:
- receiving a malicious attack from an attacker at a honeypot;
- determining that an attack event associated with the malicious attack has compromised deceptive credential information maintained by the honeypot;
- generating a unique credential pair that corresponds to the compromised deceptive credential information sought by the attack event;
- generating a honeytoken tracker;
- modifying a honeytoken tracker state table with the honeytoken tracker that comprises the unique credential pair and attack event metadata in association with the attack;
- transmitting the unique credential pair to the attacker;
- and
- tracking a subsequent malicious attack from the attacker with the honeytoken tracker without processing a hash value associated with the unique credential pair that is used by the attacker as part of the subsequent malicious attack.
A non-transitory computer readable storage medium comprising program instructions executable to:
- receive a malicious attack from an attacker at a honeypot;
- determine that an attack event associated with the malicious attack has compromised deceptive credential information maintained by the honeypot;
- generate a unique credential pair that corresponds to the compromised deceptive credential information sought by the attack event;
- generate a honeytoken tracker;
- modify a honeytoken tracker state table with the honeytoken tracker that comprises the unique credential pair and attack event metadata in association with the attack;
- transmit the unique credential pair to the attacker;
- and
- track a subsequent malicious attack from the attacker with the honeytoken tracker without processing a hash value associated with the unique credential pair that is used by the attacker as part of the subsequent malicious attack.
A system comprising:
- one or more processors;
- and
- a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
- receive a malicious attack from an attacker at a honeypot;
- determine that an attack event associated with the malicious attack has compromised deceptive credential information maintained by the honeypot;
- generate a unique credential pair that corresponds to the compromised deceptive credential information sought by the attack event;
- generate a honeytoken tracker;
- modify a honeytoken tracker state table with the honeytoken tracker that comprises the unique credential pair and attack event metadata in association with the attack;
- transmit the unique credential pair to the attacker;
- and
- track a subsequent malicious attack from the attacker with the honeytoken tracker without processing a hash value associated with the unique credential pair that is used by the attacker as part of the subsequent malicious attack.
Dependencies are inferred from the claim text.