Systems and methods for intrusion detection and prevention using software patching and honeypots
AssigneeCloud Linux Software Inc.
InventorKirill Korotaev
Life of this patent
Estimating the term…
Abstract
A variety of methods are provided for an application or operating system (OS) kernel intrusion detection and prevention, based on usage of existing vulnerability fixes and their transformation into honeypot detectors. A honeypot patch may be generated for a computing system associated with a software vulnerability in software installed on the computing system. The honeypot patch, when used to modify the installed software, can convert the computing system into a honeypot system configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability.
Claims17
A computer-implemented method for software intrusion detection, comprising:
- generating a honeypot patch for a computing system associated with a software vulnerability in a software installed on the computing system, wherein the software comprises at least one of an application and an operating system,
- wherein the honeypot patch is configured to convert the computing system associated with the software vulnerability into a honeypot system by modifying code of the software running on the computing system using the generated honeypot patch without restarting the software, wherein the generated honeypot patch is a live patch that updates the code of the software without interruption in execution of the software, and wherein the honeypot system is configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability.
A system for software intrusion detection, comprising:
- a hardware processor configured to:
- generate a honeypot patch for a computing system associated with a software vulnerability in a software installed on the computing system, wherein the software comprises at least one of an application and an operating system,
- wherein the honeypot patch is configured to convert the computing system associated with the software vulnerability into a honeypot system by modifying code of the software running on the computing system using the generated honeypot patch without restarting the software, wherein the generated honeypot patch is a live patch that updates the code of the software without interruption in execution of the software, and wherein the honeypot system is configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability.
A non-transitory computer readable medium comprising computer executable instructions for software intrusion detection, including instructions for:
- generating a honeypot patch for a computing system associated with a software vulnerability in a software installed on the computing system, wherein the software comprises at least one of an application and an operating system,
- wherein the honeypot patch is configured to convert the computing system associated with the software vulnerability into a honeypot system by modifying code of the software running on the computing system using the generated honeypot patch without restarting the software, wherein the generated honeypot patch is a live patch that updates the code of the software without interruption in execution of the software, and wherein the honeypot system is configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability.
Dependencies are inferred from the claim text.