Systems and methods for monitoring network ports to redirect computing devices to a protected network

A computer system that is configured to redirect a computing device from a first network to a second network, the computer system comprising:

• a second server;
• and
• a monitoring device having:
• a processor;
• memory in electronic communication with the processor;
• instructions stored in the memory, the instructions being executable to:
• monitor, by the monitoring device, a plurality of network ports;
• detect, by the monitoring device, a communication from a computing device at one of the network ports;
• send information from the monitoring device to a first server and the second server regarding the identity of the computing device;
• send a command from the monitoring device to the first server to send a request to the computing device to renew the connection with the second server, wherein the command is sent after the information regarding the identity of the computing device is sent from the monitoring device to the first server and the second server;
• determine whether the request was sent from the computing device where an attack by a worm originated, wherein the determining occurs after the request to renew its connection was received;
• and
• the ports, wherein the monitoring device is configured to appear to possess characteristics of a server and wherein the monitoring device configured to appear to possess characteristics of the server acts as bait for the worm to attack the monitoring device;
• wherein the second server receives a request from the computing device to renew its connection with the second server, wherein the second server redirects the computing device to a second network from a first network.

A non-transitory computer-readable medium comprising executable instructions to redirect a computing device from a first network to a second network, the instructions being executable to:

• monitor, by a monitoring device, a plurality of network ports;
• detect, by the monitoring device, a communication from a computing device at one of the network ports;
• send information from the monitoring device to a first server and a second server regarding the identity of the computing device;
• send a command from the monitoring device to the first server to send a request to the computing device to renew the connection with the second server, wherein the command is sent after the information regarding the identity of the computing device is sent from the monitoring device to the first server and the second server;
• determine whether the request was sent from the computing device where an attack by a worm originated, wherein the determining occurs after the request to renew its connection was received;
• and
• receive a request from the computing device to renew its connection with the second server, wherein the second server redirects the computing device to a second network from a first network;
• wherein the monitoring device comprises the ports and is configured to appear to possess characteristics of a server and wherein the monitoring device configured to appear to possess characteristics of the server acts as bait for the worm to attack the monitoring device.