Network intrusion diversion using a software defined network

A non-transitory computer-readable medium with computer executable instructions stored thereon for diverting an intruder in a computer network, instructions comprising:

• receiving an indication that a first connection from a user's computer is suspicious, the first connection being between the user's computer and a production host computer through a physical switch, wherein Internet Protocol (IP) packets associated with the first connection have a user IP address associated with the user's computer, a host IP address associated with the production host computer, and a host port associated with the production host computer;
• instantiating and initializing a software-based host emulator behind a virtual switch, the host emulator configured to respond to an address resolution protocol (ARP) request for the host IP address;
• commanding the physical switch to redirect subsequent flows with the user IP address, the host IP address, and the host port between the user's computer and the virtual switch;
• instructing the virtual switch to allow packets with the user IP address, the host IP address, and the host port to flow to the physical switch;
• forwarding, through the virtual switch, a request for a second connection to the host emulator;
• and
• establishing, at the host emulator, the second connection between the user's computer and the host emulator, the second connection flowing through the production and virtual switches.

A computer system executing instructions in a computer program, the system comprising:

• at least one processor;
• and
• a memory operatively coupled with the at least one processor, the at least one processor executing program code from the memory comprising:
• program code for receiving an indication that a first connection from a user's computer is suspicious, the first connection being between the user's computer and a production host computer through a physical switch, wherein Internet Protocol (IP) packets associated with the first connection have a user IP address associated with the user's computer, a host IP address associated with the production host computer, and a host port associated with the production host computer;
• program code for instantiating and initializing a software-based host emulator behind a virtual switch, the host emulator configured to respond to an address resolution protocol (ARP) request for the host IP address;
• program code for commanding the physical switch to redirect subsequent flows with the user IP address, the host IP address, and the host port between the user's computer and the virtual switch;
• program code for instructing the virtual switch to allow packets with the user IP address, the host IP address, and the host port to flow to the physical switch;
• program code for forwarding, through the virtual switch, a request for a second connection to the host emulator;
• and
• program code for establishing, at the host emulator, the second connection between the user's computer and the host emulator, the second connection flowing through the production and virtual switches.