Honeytoken tracker

A non-transitory computer readable storage medium comprising program instructions executable to:

• receive a malicious attack from an attacker at a honeypot;
• determine that an attack event associated with the malicious attack has compromised deceptive credential information maintained by the honeypot;
• generate a unique credential pair that corresponds to the deceptive credential information sought by the attack event;
• modify a honeytoken tracker state table to comprise the unique credential pair and attack event metadata in association with the attack event;
• transmit the unique credential pair to the attacker;
• synchronize the honeytoken tracker state table with a honeypot management system;
• detect another malicious attack from the attacker;
• access the honeytoken tracker state table;
• correlate the another malicious attack to the attacker using a hash uniquely generated for the attacker in the honeytoken tracker state table or a dynamically generated username;
• access a honeypot personality state table maintained by the honeypot management system;
• and
• generate a present personality for the honeypot that comprises one or more mimicked services, banner information, an operating system, and protocol information of a past personality of the honeypot that existed during the malicious attack based on information in the honeypot personality state table.

A system comprising:

• one or more processors;
• and
• a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
• receive a malicious attack from an attacker at a honeypot;
• determine that an attack event associated with the malicious attack has compromised deceptive credential information maintained by the honeypot;
• generate a unique credential pair that corresponds to the deceptive credential information sought by the attack event;
• modify a honeytoken tracker state table to comprise the unique credential pair and attack event metadata in association with the attack event;
• transmit the unique credential pair to the attacker;
• synchronize the honeytoken tracker state table with a honeypot management system;
• detect another malicious attack from the attacker;
• access the honeytoken tracker state table;
• correlate the another malicious attack to the attacker using a hash uniquely generated for the attacker in the honeytoken tracker state table or a dynamically generated username;
• access a honeypot personality state table maintained by the honeypot management system;
• and
• generate a present personality for the honeypot that comprises one or more mimicked services, banner information, an operating system, and protocol information of a past personality of the honeypot that existed during the malicious attack based on information in the honeypot personality state table.