Systems and methods for intrusion detection and prevention using software patching and honeypots
AssigneeCloud Linux Software Inc.
InventorKirill Korotaev
Life of this patent
Estimating the term…
Abstract
A variety of methods are provided for an application or operating system (OS) kernel intrusion detection and prevention, based on usage of existing vulnerability fixes and their transformation into honeypot detectors. A honeypot patch may be generated for a computing system associated with a software vulnerability in software installed on the computing system. The honeypot patch, when used to modify the installed software, can convert the computing system into a honeypot system configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability.
Claims19
A computer-implemented method for software intrusion detection, comprising:
- generating a honeypot patch for a computing system associated with a software vulnerability in a software installed on the computing system, wherein the software comprises at least one of an application and an operating system,
- wherein the honeypot patch is configured to convert the computing system associated with the software vulnerability into a honeypot system configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability;
- and
- modifying the software installed on the computing system using the generated honeypot patch.
A system for software intrusion detection, comprising:
- a hardware processor configured to:
- generate a honeypot patch for a computing system associated with a software vulnerability in a software installed on the computing system, wherein the software comprises at least one of an application and an operating system,
- wherein the honeypot patch is configured to convert the computing system associated with the software vulnerability into a honeypot system configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability;
- and
- modify the software installed on the computing system using the generated honeypot patch.
A non-transitory computer readable medium comprising computer executable instructions for software intrusion detection, including instructions for:
- generating a honeypot patch for a computing system associated with a software vulnerability in a software installed on the computing system, wherein the software comprises at least one of an application and an operating system,
- wherein the honeypot patch is configured to convert the computing system associated with the software vulnerability into a honeypot system configured to detect attempts to exploit the software vulnerability of the software, and in response, generate a security event associated with the software vulnerability;
- and
- modifying the software installed on the computing system using the generated honeypot patch.
Dependencies are inferred from the claim text.