Methods and systems for network attack detection and prevention through redirection

A non-transitory computer-readable medium containing instructions for controlling a processor to detect unauthorized access attempts to a network by:

• receiving a request from a user at a user address to obtain a target address;
• obtaining said target address;
• generating a substitute return address corresponding to output of a function applied to said target address, said substitute return address and to said user address corresponding to a used one of a block of substitute addresses;
• returning said substitute return address to said user;
• monitoring access to said target address;
• and
• detecting an unauthorized attempt to access said target address when an attempted address corresponds to at least one unused substitute address of a group of unused substitute addresses in said block of substitute addresses, wherein said group of unused substitute addresses is user-specific.

A system for detecting unauthorized access attempts to a network, comprising:

• means for receiving a request from a user at a user address to obtain a target address;
• means for obtaining said target address;
• means for generating a substitute return address corresponding to output of a function applied to said target address, said substitute return address corresponding to a used one of a block of substitute addresses and to said user address, said means for generating including a processor programmed to apply said function to said target address and to said user address;
• means for returning said substitute return address to said user;
• means for monitoring access to said target address;
• and
• means for detecting an unauthorized attempt to access said target address when an attempted address corresponds to at least one unused substitute address of a group of unused substitute addresses in said block of substitute addresses, wherein said group of unused substitute addresses is user-specific.

A computer program, disposed on a non-transitory computer-readable medium, for enabling detection of unauthorized access attempts to a network, said computer program including instructions for causing a processor to:

• receive a request from a user at a user address to obtain a target address;
• obtain said target address;
• generate a substitute return address corresponding to output of a function applied to said target address and to said user address, said substitute return address corresponding to a used one of a block of substitute addresses;
• return said substitute return address to said user;
• monitor access to said target address;
• and
• detect an unauthorized attempt to access said target address when an attempted address corresponds to at least one unused substitute address of a group of unused substitute addresses in said block of substitute addresses, wherein said group of unused substitute addresses is user-specific.