Network security elements using endpoint resources

An endpoint server in a network having a distributed network security system comprising:

• an interface to receive requests for access to the network;
• one or more processors to run instructions in memory, the processors including:
• a module to detect an unauthorized request for access to the network, wherein the detected unauthorized request includes a request for an unused element of an active network address, the unused element being an unused port for an active IP (Internet Protocol) address;
• and
• a first endpoint network security element, the module to direct detected unauthorized requests to the first endpoint network security element, the first endpoint network security element being a part of the distributed network security system in which each of a plurality of endpoint servers includes a respective endpoint network security element, the first endpoint network security element being operable to provide an emulation of a server on the network, wherein the first endpoint network security element is further operable to generate and provide a response to the sender of the unauthorized request acknowledging the receipt of the unauthorized request, and
• wherein the first endpoint network security element is to generate a statistic describing the unauthorized request and forward the statistic to a central darknet server, the central darknet server acting as a controller of the first endpoint network security element in the distributed network security system.

A distributed network security system for a network comprising:

• a router to provide access to endpoint servers;
• a plurality of endpoint servers coupled to the router, each of the plurality of endpoint servers including an endpoint network security element for the distributed network security system, including a first endpoint server containing a first endpoint network security element, wherein:
• the first endpoint network security element is operable to generate an emulation of a server that is connected to the router for purposes for handling unauthorized requests, the first endpoint server to detect unauthorized requests for access to the network,
• the first endpoint server directs unauthorized requests for access to the first endpoint network security element of the first endpoint server, and
• the first endpoint network security element is operable to generate and send a response to a sender of each received unauthorized request, and to generate and forward statistics regarding the detected unauthorized requests for centralized processing;
• and
• a central security server for the distributed security system that is separated from the operations of the network, the central server operating as a controller for the endpoint network security elements of the distributed security system, the central security server being operable to receive the statistics regarding the unauthorized requests from the first endpoint network security element and statistics from any other endpoint network security elements of distributed network security system.

A non-transitory computer-readable storage medium having stored thereon data representing sequences of instructions that, when executed by a processor, cause the processor to perform operations comprising:

• receiving a request from a sender for access to a network at a first endpoint server of a plurality of endpoint servers, each of the plurality of endpoint servers including an endpoint network security element, each of the endpoint network security elements being a part of a distributed network security system, the first endpoint server including a first endpoint network security element;
• detecting that the request for access to the network includes an unauthorized request;
• directing the unauthorized request to the first endpoint network security element of the first endpoint server, the first endpoint network security element being operable to emulate a server for purposes of processing of unauthorized requests received by the first endpoint server;
• generating at the first endpoint network security element an acknowledgement for the unauthorized request, the acknowledgement being sent from the first endpoint network security element to the sender of the request;
• and
• generating by the first endpoint network security element a statistic describing the unauthorized request and forwarding the statistic from the first endpoint network security element to a central security server for the network, the central security server operating as a controller for operations of the distributed security system, including the endpoint network security elements of the endpoint servers.