Detecting automated site scans
AssigneeBank of America Corporation
InventorIgor A. Baikalov
Life of this patent
Estimating the term…
Abstract
Automated site scans are often seen as precursors to a cyber attack, from URI enumeration and version mapping to timing scans used to identify the most valuable DDoS targets. Disclosed are methods and apparatuses for detecting automated site scans and identifying the source of cyber attacks. Honeypot links are provided on a web page via a server. If multiple honeypot links are selected by a visitor of the web page, the server may identify the visitor as an automated system and generate a session ID. The server induces an artificial delay prior to displaying the data associated with the selected honeypot link. After a subsequent attack, the server is able to identify the attacker by association with the stored session ID of an automated site scan.
Claims19
A computer-implemented method, comprising:
- providing, from a computer server, a plurality of honeypot links in a web page to detect automatic scans;
- detecting, at the computer server via a communications module, that at least two of the plurality of honeypot links have been selected by a computer a predetermined number of times;
- generating, at the computer server, a session ID associated with the computer and the at least two selected honeypot links;
- storing, at the computer server, the session ID;
- displaying, from the computer server, data in response to each selected honeypot link, wherein the data is displayed on the web page after an artificial delay, and wherein the data does not include links to other web pages;
- determining, at the computer server, that the computer is an origin of an attack, wherein the determining is performed by comparing the selected honeypot links associated with the session ID with the links targeted in the attack to determine the similarities.
A non-transitory computer-readable storage medium having computer-executable program instructions stored thereon that, when executed by a processor, cause the processor to:
- provide, from a computer server, a plurality of honeypot links in a web page to detect automatic scans;
- detect, at the computer server, that at least two of the plurality of honeypot links have been selected by a computer a predetermined number of times;
- generate, at the computer server, a session ID associated with the computer and the at least two selected honeypot links;
- store, at the computer server, the session ID;
- display, from the computer server, data in response to each selected honeypot link, wherein the data is displayed on the web page after an artificial delay, wherein the data does not include links to other web pages;
- and
- determine, at the computer server, that the computer is an origin of an attack, wherein the determining is performed by comparing the selected honeypot links associated with the session ID with the links targeted in the attack to determine the similarities.
An apparatus comprising:
- a memory;
- a processor, wherein the processor executes computer-executable program instructions which cause the processor to:
- provide a plurality of honeypot links in a web page to detect automatic scans;
- detect that at least two of the plurality of honeypot links have been selected by a computer a predetermined number of times;
- generate a session ID associated with the computer and the at least two selected honeypot links;
- store, at the memory, the session ID;
- display data in response to each selected honeypot link, wherein the data is displayed on the web page after an artificial delay, wherein the data does not include links to other web pages;
- and
- determine that the computer is an origin of an attack, wherein the determining is performed by comparing the selected honeypot links associated with the session ID with the links targeted in the attack to determine the similarities.
Dependencies are inferred from the claim text.