Probabilistically identifying anomalous honeypot activity
AssigneeRapid7, Inc.
InventorsWah-Kwan Lin, Curtis Barnard
Life of this patent
Estimating the term…
Abstract
Disclosed herein are methods, systems, and processes for probabilistically identifying anomalous levels of honeypot activity. A honeypot dataset associated with a honeypot network is received and a representative usage value is determined from the honeypot dataset. The representative usage value is identified as being associated with anomalous behavior if the representative usage value deviates from an expected probability distribution. A remediation operation is initiated in the honeypot network in response to the identification of the representative usage value as being associated with the anomalous behavior by virtue of the representative usage value deviating from the expected probability distribution.
Claims20
A computer-implemented method, comprising:
- receiving a honeypot dataset associated with a honeypot network, wherein the honeypot dataset comprises one or more connections to at least one or more ports or one or more applications of one or more honeypots in the honeypot network over a period of time;
- determining a representative usage value from the honeypot dataset, wherein the representative usage value comprises a number of connections to a port of the one or more ports or to an application of the one or more applications over the period of time;
- identifying the number of connections as being associated with anomalous behavior, wherein the identification is based on a probability of a deviation of the number of connections from a historical average of the number of connections according to an expected probability distribution;
- and
- initiating a remediation operation in the honeypot network in response to the identification of the number of connections as being associated with the anomalous behavior.
A non-transitory computer readable storage medium comprising program instructions executable to:
- receive a honeypot dataset associated with a honeypot network, wherein the honeypot dataset comprises one or more connections to at least one or more ports or one or more applications of one or more honeypots in the honeypot network over a period of time;
- determine a representative usage value from the honeypot dataset, wherein the representative usage value comprises a number of connections to a port of the one or more ports or to an application of the one or more applications over the period of time;
- identify the number of connections as being associated with anomalous behavior, wherein the identification is based on a probability of a deviation of the number of connections from a historical average of the number of connections according to an expected probability distribution;
- and
- initiating a remediation operation in the honeypot network in response to the identification of the number of connections as being associated with the anomalous behavior.
A system comprising:
- one or more processors;
- and
- a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
- receive a honeypot dataset associated with a honeypot network, wherein the honeypot dataset comprises one or more connections to at least one or more ports or one or more applications of one or more honeypots in the honeypot network over a period of time;
- determine a representative usage value from the honeypot dataset, wherein the representative usage value comprises a number of connections to a port of the one or more ports or to an application of the one or more applications over the period of time;
- identify the number of connections as being associated with anomalous behavior, wherein the identification is based on a probability of a deviation of the number of connections from a historical average of the number of connections according to an expected probability distribution;
- and
- initiating a remediation operation in the honeypot network in response to the identification of the number of connections as being associated with the anomalous behavior.
Dependencies are inferred from the claim text.