Attack correlation using marked information

A system comprising:

• a marked information database;
• one or more processors;
• an attack correlation system having a marked information module that receives a probe communication from a potential attack device, sends marked information to the potential attack device in response to the probe communication, and stores the marked information in the marked information database maintained by the attack correlation system, wherein the marked information comprises detectable false information that is traceable by the attack correlation system and is uniquely generated for the potential attack device, and wherein the marked information module further monitors incoming communications and identifies communications that include the marked information uniquely generated for the potential attack device;
• and
• a controller operable by the one or more processors to receive a communication that includes the marked information uniquely generated for the potential attack device and identifies a source computing device that sent the communication as an attack device that is associated with both the marked information uniquely generated for the potential attack device and with the potential attack device in the marked information database,
• wherein, using the marked information uniquely generated for the potential attack device, the controller updates the marked information database to associate the probe communication received from the potential attack device with the communication received from the source computing device as coordinated phases of the same network attack, wherein the updating of the marked information database includes storing an identification of the source computing device to be associated with both the marked information uniquely generated for the potential attack device and with an identification of the potential attack device, and
• wherein the controller exchanges at least a portion of the information stored in the marked information database with another attack correlation system.

An attack correlation system comprising:

• at least one processor;
• a virtual vulnerable device operable by the at least one processor to run one or more services that emulate services offered by at least one device within a protected network on top of a virtual infrastructure;
• at least one marked information module operable by the at least one processor to analyze a communication from an attack device and addressed to a device within the protected network and to reroute the communication to the virtual vulnerable device when the communication includes marked information that had previously been uniquely generated by the attack correlation system for a potential attack device in response to the attack correlation system receiving a prior probe communication from the potential attack device, and wherein upon determining that the communication from the attack device includes the marked information uniquely generated for the potential attack device, the attack correlation system updates a marked information database to associate an identifier of the attack device with an identifier of the potential attack device based on the marked information to indicate that the communication and the prior probe communication are coordinated phases of one network attack against the protected network;
• and
• a controller operable by the at least one processor to terminate the virtual vulnerable device when the virtual vulnerable device is compromised, and to restart the virtual vulnerable device in an uncompromised state,
• wherein the controller reloads an image of a boot disk from a protected archive into the virtual vulnerable device to restart the virtual vulnerable device.

A non-transitory computer-readable storage medium comprising instructions that cause one or more processors to:

• generate a marked information database maintained by a first attack correlation system, wherein the database stores data that associates (1) identifiers of potential attack devices that sent probe communications to a protected network, (2) marked information uniquely generated and traceable by the first attack correlation system for each individual potential attack device in response to each of the probe communications, and (3) identifiers of attack devices that subsequently send communications that each include marked information uniquely generated for a corresponding one of the potential attack devices;
• receive, by the first attack correlation system, a communication sent from a first attack device;
• responsive to determining that the communication includes marked information uniquely generated for a first potential attack device, update the marked information database to indicate that the communication and a corresponding probe communication previously sent from the first potential attack device are coordinated phases of one network attack against the protected network, wherein updating the marked information database includes associating an identifier of the first attack device with an identifier of the first potential attack device based on the marked information uniquely generated for the first potential attack device;
• and
• exchange at least a portion of the data stored in the marked information database with a second attack correlation system different from the first attack correlation system.