Back to results
US 2022/0286471 A1Published application
Honeypot Network with Dynamically Updated Alert Modules for Detecting Anomalous Connections
AssigneeRapid7, Inc.
InventorsRoy Hodgman, Wah-Kwan Lin, Vasudha Shivamoggi
Life of this patent
Estimating the term…
Abstract
Analyzing and reporting anomalous internet traffic data by accepting a request for a connection to a virtual security appliance, collecting attribute data about the connection, applying an alert module to the data, and automatically generating an alert concerning an identified incident. An alert system for analyzing and reporting the anomalous internet traffic data. A processor to analyze and report anomalous internet traffic data.
Claims21
-20. (canceled)
A method, comprising:
- performing, by one or more computing devices that implement a honeypot network:
- adding or deleting one or more alert modules to or from a set of alert modules, wherein individual ones of the alert modules in the set is configured to analyze different subsets of attribute data about connections accepted by the honeypot network for one or more anomalies, wherein the one or more anomalies includes:
- an IP port of a given connection,
- a TCP flag of the given connection,
- a handshake of the given connection,
- a timing of the given connection,
- a duration of the given connection, or
- a termination of the given connection;
- accepting a request for a connection to the honeypot network;
- collecting attribute data about the connection, wherein the attribute data includes a time of the connection, a number of bytes associated with the connection, a source IP address of the connection, or an IP port of the connection;
- applying the set of alert modules to at least some of the attribute data about the connection to identify an anomaly about the connection;
- and
- reporting an incident via a user interface, wherein the incident indicates the anomaly.
10 more elements
A system comprising:
- one or more computing devices that implement a honeypot network, configured to:
- add or delete one or more alert modules to or from a set of alert modules, wherein individual ones of the alert modules in the set is configured to analyze different subsets of attribute data about connections accepted by the honeypot network for one or more anomalies, wherein the one or more anomalies includes:
- an IP port of a given connection,
- a TCP flag of the given connection,
- a handshake of the given connection,
- a timing of the given connection,
- a duration of the given connection, or
- a termination of the given connection;
- accept a request for a connection to the honeypot network;
- collect attribute data about the connection, wherein the attribute data includes a time of the connection, a number of bytes associated with the connection, a source IP address of the connection, or an IP port of the connection;
- apply the set of alert modules to at least some of the attribute data about the connection to identify an anomaly about the connection;
- and
- report an incident via a user interface, wherein the incident indicates the anomaly.
10 more elements
One or more non-transitory computer-readable media storing program instructions that when executed on one or more processors of one or more computing devices to implement a honeypot network and cause the honeypot network to:
- add or delete one or more alert modules to or from a set of alert modules, wherein individual ones of the alert modules in the set is configured to analyze different subsets of attribute data about connections accepted by the honeypot network for one or more anomalies, wherein the one or more anomalies includes:
- an IP port of a given connection,
- a TCP flag of the given connection,
- a handshake of the given connection,
- a timing of the given connection,
- a duration of the given connection, or
- a termination of the given connection;
- accept a request for a connection to the honeypot network;
- collect attribute data about the connection, wherein the attribute data includes a time of the connection, a number of bytes associated with the connection, a source IP address of the connection, or an IP port of the connection;
- apply the set of alert modules to at least some of the attribute data about the connection to identify an anomaly about the connection;
- and
- report an incident via a user interface, wherein the incident indicates the anomaly.
9 more elements
Dependencies are inferred from the claim text.