Identifying attacks to active resources by trusted devices with fake vulnerabilities on deceptive proxy resources
AssigneeFortinet, Inc.
InventorKun Yu
Life of this patent
Estimating the term…
Abstract
A plurality of fake vulnerabilities are exposed to network traffic alongside an active resource. Each fake vulnerability cannot harm the active resource and wherein the deceptive proxy device and the legitimate device are reachable by a common IP address. Network traffic is monitored in real-time, to detect an attack by a malicious device concerning at least one of the fake vulnerabilities of the plurality of fake vulnerabilities exposed by the deceptive proxy resource. The malicious device is trusted by the enterprise network. Responsive to the attack detection, a security action is taken with respect to the malicious device.
Claims20
A computer-implemented method in a deceptive proxy device using fake vulnerabilities for identifying attacks to a legitimate device of an enterprise network by trusted devices, the method comprising:
- configuring a deceptive proxy resource of the enterprise network to expose a plurality of fake vulnerabilities to network traffic alongside an active resource, wherein each fake vulnerability cannot harm the active resource and wherein the deceptive proxy device and the legitimate device are reachable by a common Internet Protocol (IP) address;
- monitoring network traffic in real-time to detect an attack by a malicious device concerning at least one of the fake vulnerabilities of the plurality of fake vulnerabilities exposed by the deceptive proxy resource, wherein the malicious device is trusted by the enterprise network;
- and
- responsive to the attack detection, taking a security action with respect to the malicious device.
A non-transitory computer-readable medium in a deceptive proxy device on a data communication network, using fake vulnerabilities for identifying attacks to a legitimate device of an enterprise network by trusted device, the method comprising:
- configuring a deceptive proxy resource of the enterprise network to expose a plurality of fake vulnerabilities to network traffic alongside an active resource, wherein each fake vulnerability cannot harm the active resource and wherein the deceptive proxy device and the legitimate device are reachable by a common Internet Protocol (IP) address;
- monitoring network traffic in real-time to detect an attack by a malicious device concerning at least one of the fake vulnerabilities of the plurality of fake vulnerabilities exposed by the deceptive proxy resource, wherein the malicious device is trusted by the enterprise network;
- and
- responsive to the attack detection, taking a security action with respect to the malicious device.
A deceptive proxy device, for using fake vulnerabilities for identifying attacks to a legitimate device of an enterprise network by trusted devices, the deceptive proxy device comprising:
- a processor;
- a network interface communicatively coupled to the processor and to a data communication network;
- and
- a memory, communicatively coupled to the processor and storing:
- a fake vulnerability module to expose a plurality of fake vulnerabilities to network traffic alongside an active resource, wherein each fake vulnerability cannot harm the active resource and wherein the deceptive proxy device and the legitimate device are reachable by a common Internet Protocol (IP) address;
- a traffic monitoring module to monitor network traffic in real-time, to detect an attack by a malicious device concerning at least one of the fake vulnerabilities of the plurality of fake vulnerabilities exposed by the deceptive proxy resource, wherein the malicious device is trusted by the enterprise network;
- and
- a security module to, responsive to the attack detection, take a security action with respect to the malicious device.
Dependencies are inferred from the claim text.