US 2021/0344714 A1 · CYBER THREAT DECEPTION METHOD AND SYSTEM, AND FORWARDING DEVICE

Abstract

This application discloses a cyber threat deception method and system, and a forwarding device. The forwarding device obtains a deception target set, where the deception target set includes a deception target, and the deception target includes an unused internet protocol (IP) address or an unopened port number on a used IP address. The forwarding device receives an IP packet from a host, and determines whether a destination party that the IP packet requests to access belongs to the deception target set. If the destination party that the IP packet requests to access belongs to the deception target set, the forwarding device sends the IP packet to a honeypot management server. The forwarding device receives a response packet, returned by the honeypot management server, of the corresponding IP packet. The forwarding device sends the response packet to the host.

Claims20

Dependent claims

A cyber threat deception method, comprising:

obtaining, by a forwarding device, a deception target set, wherein the deception target set comprises at least one deception target, and the at least one deception target comprises an unused internet protocol (IP) address or an unopened port number on a used IP address;
receiving, by the forwarding device, a first IP packet from a first host;
determining, by the forwarding device, whether a destination party that the first IP packet requests to access belongs to the deception target set;
when the destination party that the first IP packet requests to access belongs to the deception target set, sending, by the forwarding device, the first IP packet to a honeypot management server;
receiving, by the forwarding device, a second IP packet from the honeypot management server, wherein the second IP packet is a response packet of the first IP packet;
and
sending, by the forwarding device, the second IP packet to the first host.

4 more elements

A forwarding device, comprising:

a network interface;
and
at least one processor coupled to the network interface, wherein
the at least one processor is configured to:
obtain a deception target set, wherein the deception target set comprises at least one deception target, and the at least one deception target comprises an unused internet protocol (IP) address or an unopened port number on a used IP address;
the network interface is configured to receive a first IP packet from a first host;
the at least processor is further configured to determine whether a destination party that the first IP packet requests to access belongs to the deception target set;
and
the network interface is configured to:
when the destination party that the first IP packet requests to access belongs to the deception target set, send the first IP packet to a honeypot management server;
receive a second IP packet from the honeypot management server, wherein the second IP packet is a response packet of the first IP packet;
and
send the second IP packet to the first host.

10 more elements

Dependencies are inferred from the claim text.

Cyber threat deception method and system, and forwarding device

Life of this patent

Cyber threat deception method and system, and forwarding device

Life of this patent

Abstract

Claims20