Back to results
US 2021/0067553 A1Published application
Honeypots for infrastructure-as-a-service security
AssigneeOracle International Corporation
InventorsChristopher James Ries, Nikkolas Anthony Lavorato, Kevin Raymond, JR., Philip Nathan Andrews, III, Christa Agnes Johnson Scura
Life of this patent
Estimating the term…
Abstract
Techniques for using honeypots to lure attackers and gather data about attackers and attack patterns on Infrastructure-as-a-Service (IaaS) instances. The gathered data may then be analyzed and used to proactively prevent such attacks.
Claims20
A method, comprising:
- providing, by a compute instance, a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type;
- luring, by the compute instance, an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers;
- receiving, by the compute instance, a first request from the attacker, the first request related to the instance and including a request characteristic;
- identifying, by the compute instance, a particular honeypot server of the plurality of honeypot servers based at least in part on the request characteristic and the honeypot type;
- establishing, by the compute instance, a session with the attacker for connection with the particular honeypot server;
- generating, by the particular honeypot server of the compute instance, a response to a second request from the attacker;
- causing, by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request;
- and
- recording, by the compute instance, data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server.
6 more elements
One or more computer-readable storage medium, comprising computer-executable instructions that, when executed by one or more processors of a compute instance, cause the one or more processors to perform operations comprising:
- providing a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type;
- luring an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers;
- receiving a first request from the attacker, the first request related to the instance and including a request characteristic;
- identifying a particular honeypot server of the plurality of honeypot servers based at least in part on the first request characteristic and the honeypot type;
- establishing a session with the attacker for connection with the particular honeypot server;
- generating, by the particular honeypot server of the compute instance, a response to a second request from the attacker;
- causing, by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request;
- and
- recording data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server.
6 more elements
A computing system, comprising:
- a memory;
- and
- one or more processors configured to:
- provide, by a compute instance, a plurality of honeypot servers, each honeypot server of the plurality of honeypot servers comprising a honeypot type;
- lure, by the compute instance, an attacker to establish a session with at least one honeypot server of the plurality of honeypot servers;
- receive, by the compute instance, a first request from the attacker, the first request related to the instance and including a request characteristic;
- identify, by the compute instance, a particular honeypot server of the plurality of honeypot servers based at least in part on the request characteristic and the honeypot type;
- establish, by the compute instance, a session with the attacker for connection with the particular honeypot server;
- generate, by the particular honeypot server of the compute instance, a response to a second request from the attacker;
- cause, by the particular honeypot server of the compute instance, the response to be communicated to the attacker responsive to the second request;
- and
- record, by the compute instance, data related to the attacker or data related to one or more interactions by the attacker with the particular honeypot server.
9 more elements
Dependencies are inferred from the claim text.