Detection of softswitch attacks

The A security device, comprising:

• a softswitch emulator that performs no switching functions;
• a communication interface configured to connect the security device to a data network;
• a deceptive operating system that is configured to emulate a softswitch operating system;
• and
• a detection unit configured to:
• detect activity directed to the softswitch emulator;
• record detected activity;
• detect activity directed to the deceptive operating system;
• and
• record the detected activity directed to the deceptive operating system.

A security device, comprising:

• a softswitch emulator that performs no switching functions;
• a communication interface configured to connect the security device to a data network;
• a detection unit configured to:
• detect activity directed to the softswitch emulator and
• record detected activity;
• a deceptive operating system that is configured to emulate a softswitch operating system;
• and
• a real operating system platform for the security device.

A security device, comprising:

• a softswitch emulator that performs no switching functions;
• a communication interface configured to connect the security device to a data network;
• a deceptive operating system that is configured to emulate a softswitch operating system;
• a detection unit configured to:
• detect activity directed to the softswitch emulator;
• record detected activity;
• and
• record at least one of keystrokes when recording the detected activity and functions executed by the softswitch when recording the detected activity.

A method, comprising:

• connecting a security device to a data network, wherein the security device includes a softswitch emulator that performs no switching functions;
• monitoring traffic directed to the security device;
• and
• recording the traffic directed to the security device;
• wherein the security device includes a deceptive operating system and wherein the recording includes:
• capturing at least one of keystrokes and functions executed by the softswitch emulator directed to the deceptive operating system, and
• storing the at least one of keystrokes and executed functions.

A security device, comprising:

• a softswitch emulator that performs no switching functions;
• a real operating system platform for the security device;
• a deceptive operating system that is configured to emulate a softswitch operating system wherein the softswitch emulator and the deceptive operating system are configured to mirror settings in one or more softswitches in a data network;
• a communication interface that connects the security device to the data network;
• and
• a detection unit that monitors activity in the data network and that is configured to:
• detect activity directed to the softswitch emulator,
• record detected activity,
• detect activity directed to the deceptive operating system, and
• record the detected activity directed to the deceptive operating system.

A security device, comprising:

• a softswitch emulator that performs no switching functions;
• a real operating system platform for the security device;
• a deceptive operating system that is configured to emulate a softswitch operating system, wherein the softswitch emulator and the deceptive operating system are configured to mirror settings in one or more softswitches in a data network;
• a communication interface that connects the security device to the data network;
• and
• a detection unit that monitors activity in the data network and that is configured to:
• detect activity directed to the softswitch emulator, and
• record detected activity;
• and
• a first storage unit configured to:
• store first data for configuring the softswitch emulator to mirror at least one active softswitch connected to the data network, and
• store second data for configuring the deceptive operating system to emulate an operating system of the at least one active softswitch.

A security device, comprising:

• a softswitch emulator that performs no switching functions;
• a real operating system platform for the security device;
• a deceptive operating system that is configured to emulate a softswitch operating system, wherein the softswitch emulator and the deceptive operating system are configured to mirror settings in one or more softswitches in a data network;
• a communication interface that connects the security device to the data network;
• and
• a detection unit that monitors activity in the data network and that is configured to:
• detect activity directed to the softswitch emulator
• record detected activity, and
• record at least one of keystrokes when recording the detected activity and functions executed by the softswitch when recording the detected activity.