Systems and Methods of Virtual Honeypots
AssigneeCox Communications, Inc.
InventorMatthew Edwin Carothers
Life of this patent
Estimating the term…
Abstract
Virtual honeypots methods and systems disclosed herein route all IP space of an ISP to a Darknet server as a default. When an IP address is used, it is assigned to a different server. So any IP address left on the Darknet server is an unassigned IP address. All traffic that accesses the Darknet server (the IP unassigned addresses assigned to the Darknet server as a default) is logged. Because those IP addresses are unused, it can be assumed that any traffic that hits them is the result of malicious activity. If malware is scanning the whole internet trying to spread itself, the malware will eventually access the Darknet server with the unassigned IPs.
Claims20
A method comprising:
- assigning a Darknet server as a default destination for all IP addresses of a service provider;
- monitoring traffic sent to unassigned IP addresses on the Darknet server;
- and
- identifying the traffic to the unassigned IP addresses on the Darknet server as malicious traffic.
A system comprising:
- a Darknet server configured as a default route for every IP address of a service provider, the Darknet server further configured to receive traffic through unused IP addresses on the Darknet server and identify the traffic to the Darknet server as malicious traffic.
A computer readable medium, comprising a computer program with instructions for:
- assigning a Darknet server as a default destination for all IP addresses of a service provider;
- monitoring traffic sent to unassigned IP addresses on the Darknet server;
- and
- identifying the traffic to the unassigned IP addresses on the Darknet server as malicious traffic.
Dependencies are inferred from the claim text.