Back to results
US 11,689,568 B2Granted
Dynamic maze honeypot response system
AssigneeInternational Business Machines Corporation
InventorsFrancesco Maria Carteri, Roberto Ragusa
Life of this patent
Estimating the term…
Abstract
In several aspects of the present invention, a processor receives, from a rule-based intrusion detection system, an intercepted request sent by a hacker. A processor analyzes the intercepted request to determine, in part, a type of service and a type of hacker. A processor builds a first layer of a honeypot maze based on the analyzed intercepted request. A processor simulates the first layer of the honeypot maze to the hacker. A processor iteratively builds additional layers of the honeypot maze based on additional intercepted requests from the hacker.
Claims20
A computer-implemented method comprising:
- receiving, by one or more processors, from a rule-based intrusion detection system, an intercepted request sent by a hacker;
- responsive to receiving the intercepted request, analyzing, by the one or more processors, the intercepted request to determine, in part, a type of service and a type of hacker;
- responsive to analyzing the intercepted request, building, by the one or more processors, an initial layer of a honeypot maze that includes at least one service corresponding to the service type and the type of hacker from the analyzed intercepted request;
- responsive to building the initial layer of the honeypot maze, simulating, by the one or more processors, the initial layer of the honeypot maze to the hacker;
- and
- iteratively building, by the one or more processors, additional layers of the honeypot maze based on additional intercepted requests from the hacker using a Software-Defined Networking (SDN) approach.
3 more elements
A computer program product comprising:
- one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions comprising:
- program instructions to receive, from a rule-based intrusion detection system, an intercepted request sent by a hacker;
- responsive to the program instructions to receive the intercepted request, program instructions to analyze the intercepted request to determine, in part, a type of service and a type of hacker;
- responsive to the program instructions to analyze the intercepted request, program instructions to build an initial layer of a honeypot maze that includes at least one service corresponding to the service type and the type of hacker from the analyzed intercepted request;
- responsive to the program instructions to build the initial layer of the honeypot maze, program instructions to simulate the initial layer of the honeypot maze to the hacker;
- and
- program instructions to iteratively build additional layers of the honeypot maze based on additional intercepted requests from the hacker using a Software-Defined Networking (SDN) approach.
4 more elements
A computer system comprising:
- one or more computer processors;
- one or more computer readable storage media;
- program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
- program instructions to receive, from a rule-based intrusion detection system, an intercepted request sent by a hacker;
- responsive to the program instructions to receive the intercepted request, program instructions to analyze the intercepted request to determine, in part, a type of service and a type of hacker;
- responsive to the program instructions to analyze the intercepted request, program instructions to build an initial layer of a honeypot maze that includes at least one service corresponding to the service type and the type of hacker from the analyzed intercepted request;
- responsive to the program instructions to build the initial layer of the honeypot maze, program instructions to simulate the initial layer of the honeypot maze to the hacker;
- and
- program instructions to iteratively build additional layers of the honeypot maze based on additional intercepted requests from the hacker.
6 more elements
Dependencies are inferred from the claim text.