Network decoys
AssigneeSymantec Corporation
InventorJeremy Bennett
Life of this patent
Estimating the term…
Abstract
A technique for providing computer security is described. The technique comprises providing network configuration information on a dynamic network; determining whether the network configuration information meets a criterion; and in the event the configuration information meets the criterion, configuring a decoy associated with the network.
Claims19
A method for providing computer security, comprising:
- Obtaining, using hardware processor, network configuration information regarding a dynamic network at a decoy server connected to the network;
- determining, using at least one hardware processor, whether the network configuration information meets a criterion that at least in part relates to a configuration of the network, wherein determining whether the network configuration information meets the criterion comprises determining used and free addresses on the network and determining whether a percentage of free addresses on the network is greater than a request threshold;
- in the event the configuration information meets the criterion, adding a decoy to the network;
- and
- in the event the configuration information does not meet the criterion, observing traffic on the network to determine if a decoy should be removed from the network.
A system for providing computer security, comprising:
- at least one hardware processor configured to obtain network configuration information regarding a dynamic network at a decoy server connected to the network, to determine whether the network configuration information meets a criterion that at least in part relates to a configuration of the network, to add a decoy to the network in the event the configuration information meets the criterion, and to observe traffic on the network to determine if a decoy should be removed from the network in the event the configuration information does not meet the criterion, wherein determining whether the network configuration information meets the criterion comprises determining used and free addresses on the network and determining whether a percentage of free addresses on the network is greater than a request threshold;
- and
- a memory coupled with the at least one hardware processor, wherein the memory is configured to provide the at least one hardware processor with instructions.
A computer program product for providing computer security, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
- obtaining network configuration information regarding a dynamic network at a decoy server connected to the network;
- determining whether the network configuration information meets a criterion that at least in part relates to a configuration of the network, wherein determining whether the network configuration information meets the criterion comprises determining used and free addresses on the network and determining whether a percentage of free addresses on the network is greater than a request threshold;
- in the event the configuration information meets the criterion, adding a decoy to the network;
- and
- in the event the configuration information does not meet the criterion, observing traffic on the network to determine if a decoy should be removed from the network.
Dependencies are inferred from the claim text.